  Network operators and system administrators are increasingly overwhelmed with
incessant cyber-security threats ranging from malicious network reconnaissance
to attacks such as distributed denial of service and data breaches. A large
number of these attacks could be prevented if the network operators were better
equipped with threat intelligence information that would allow them to block or
throttle nefarious scanning activities. Network telescopes or "darknets" offer
a unique window into observing Internet-wide scanners and other malicious
entities, and they could offer early warning signals to operators that would be
critical for infrastructure protection and/or attack mitigation. A network
telescope consists of unused or "dark" IP spaces that serve no users, and
solely passively observes any Internet traffic destined to the "telescope
sensor" in an attempt to record ubiquitous network scanners, malware that
forage for vulnerable devices, and other dubious activities. Hence, monitoring
network telescopes for timely detection of coordinated and heavy scanning
activities is an important, albeit challenging, task. The challenges mainly
arise due to the non-stationarity and the dynamic nature of Internet traffic
and, more importantly, the fact that one needs to monitor high-dimensional
signals (e.g., all TCP/UDP ports) to search for "sparse" anomalies. We propose
statistical methods to address both challenges in an efficient and "online"
manner; our work is validated both with synthetic data as well as real-world
data from a large network telescope.
