Prof. Barry Irwin

Barry Irwin has a PhD in Computer Science, and holds the CISSP certification. He is currently an Associate Professor and has headed the Security and Networks Research Group (SNRG) since its founding in 2003 in the Department of Computer Science at Rhodes University, South Africa. His research interests include network traffic analysis, data visualisation, web based malware, botnets and anti-phishing  tools.

A baseline study of potentially malicious activity across five network telescopes
This paper explores the Internet Background Radiation (IBR) observed across five distinct network telescopes over a 15 month period. These network telescopes consisting of a /24 netblock each and are deployed in IP space administered by TENET, the tertiary education network in South Africa covering three numerically distant /8 network blocks. The differences and similarities in the observed network traffic are explored. Two anecdotal case studies are presented relating to the MS08-067 and MS12-020 vulnerabilities in the Microsoft Windows platforms. The first of these is related to the Conficker worm outbreak in 2008, and traffic targeting 445/tcp remains one of the top constituents of IBR as observed on the telescopes. The case of MS12-020 is of interest, as a long period of scanning activity targeting 3389/tcp, used by the Microsoft RDP service, was observed, with a significant drop on activity relating to the release of the security advisory and patch. Other areas of interest are highlighted, particularly where correlation in scanning activity was observed across the sensors. The paper concludes with some discussion on the application of network telescopes as part of a cyber-defence solution.

News