{"id":"https://openalex.org/W4399852628","doi":"https://doi.org/10.23919/tma62044.2024.10558914","title":"Can Blocklists Explain Darknet Traffic?","display_name":"Can Blocklists Explain Darknet Traffic?","publication_year":2024,"publication_date":"2024-05-21","ids":{"openalex":"https://openalex.org/W4399852628","doi":"https://doi.org/10.23919/tma62044.2024.10558914"},"language":"en","primary_location":{"id":"doi:10.23919/tma62044.2024.10558914","is_oa":false,"landing_page_url":"http://dx.doi.org/10.23919/tma62044.2024.10558914","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2024 8th Network Traffic Measurement and Analysis Conference (TMA)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5095868878","display_name":"Damiano Ravalico","orcid":"https://orcid.org/0009-0001-9631-4252"},"institutions":[{"id":"https://openalex.org/I142444530","display_name":"University of Trieste","ror":"https://ror.org/02n742c10","country_code":"IT","type":"education","lineage":["https://openalex.org/I142444530"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Damiano Ravalico","raw_affiliation_strings":["University of Trieste"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Trieste","institution_ids":["https://openalex.org/I142444530"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5042656855","display_name":"Rodolfo Valentim","orcid":"https://orcid.org/0000-0002-7702-2991"},"institutions":[{"id":"https://openalex.org/I55143463","display_name":"University of Turin","ror":"https://ror.org/048tbm396","country_code":"IT","type":"education","lineage":["https://openalex.org/I55143463"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Rodolfo Valentim","raw_affiliation_strings":["University of Turin"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Turin","institution_ids":["https://openalex.org/I55143463"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5061815649","display_name":"Martino Trevisan","orcid":"https://orcid.org/0000-0002-4258-4679"},"institutions":[{"id":"https://openalex.org/I142444530","display_name":"University of Trieste","ror":"https://ror.org/02n742c10","country_code":"IT","type":"education","lineage":["https://openalex.org/I142444530"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Martino Trevisan","raw_affiliation_strings":["University of Trieste"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Trieste","institution_ids":["https://openalex.org/I142444530"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5077745494","display_name":"Id\u00edlio Drago","orcid":"https://orcid.org/0000-0003-1932-1261"},"institutions":[{"id":"https://openalex.org/I55143463","display_name":"University of Turin","ror":"https://ror.org/048tbm396","country_code":"IT","type":"education","lineage":["https://openalex.org/I55143463"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Idilio Drago","raw_affiliation_strings":["University of Turin"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Turin","institution_ids":["https://openalex.org/I55143463"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.1164709,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"4"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.9886999726295471,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12519","display_name":"Cybercrime and Law Enforcement Studies","score":0.9886999726295471,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9678000211715698,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.95660001039505,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6975076794624329},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.3208341896533966}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6975076794624329},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3208341896533966}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.23919/tma62044.2024.10558914","is_oa":false,"landing_page_url":"http://dx.doi.org/10.23919/tma62044.2024.10558914","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2024 8th Network Traffic Measurement and Analysis Conference (TMA)","raw_type":"proceedings-article"},{"id":"pmh:oai:arts.units.it:11368/3079158","is_oa":false,"landing_page_url":"https://hdl.handle.net/11368/3079158","pdf_url":null,"source":{"id":"https://openalex.org/S4306400480","display_name":"ArTS Archivio della ricerca di Trieste (University of Trieste https://www.units.it/)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I142444530","host_organization_name":"University of Trieste","host_organization_lineage":["https://openalex.org/I142444530"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":7,"referenced_works":["https://openalex.org/W2976555458","https://openalex.org/W2981241721","https://openalex.org/W3102301037","https://openalex.org/W3157391927","https://openalex.org/W3215290469","https://openalex.org/W4312739050","https://openalex.org/W4367847704"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W4396696052","https://openalex.org/W2382290278","https://openalex.org/W4395014643"],"abstract_inverted_index":{"Darknets":[0],"are":[1,178,246],"IP":[2,92,238],"addresses":[3,93,242],"that":[4,94,215],"function":[5],"as":[6,209],"passive":[7],"probes,":[8],"recording":[9],"all":[10],"received":[11],"packets":[12],"without":[13],"hosting":[14],"services.":[15],"The":[16],"traffic":[17,137],"they":[18],"capture,":[19],"being":[20],"unsolicited,":[21],"makes":[22],"darknets":[23,31,52,128],"akin":[24],"to":[25,56,80,102,116,156,255],"\u201cnetwork":[26],"telescopes\u201d.":[27],"Traces":[28],"collected":[29],"on":[30,139],"aggregate":[32],"multiple":[33,124],"events":[34,49,148,207],"useful":[35,76],"for":[36,112,146,222,232],"cybersecurity,":[37],"like":[38],"network":[39,113],"scans":[40,101],"and":[41,75,104,129,205,251,257],"exploit":[42],"attempts.":[43],"Yet,":[44,240],"the":[45,66,136,144,194,200,224,233,249,259],"mix":[46],"of":[47,68,91,123,167,219,226,235],"heterogeneous":[48],"observed":[50,247],"from":[51,98],"poses":[53],"significant":[54],"challenges":[55],"those":[57],"who":[58],"must":[59],"understand":[60],"darknet":[61,71,151,162,188,227,250],"traffic.":[62,163],"Here":[63],"we":[64,172],"face":[65],"question":[67],"whether":[69],"new":[70],"deployments":[72],"provide":[73],"novel":[74],"information":[77],"when":[78,197],"compared":[79],"public":[81],"blocklists.":[82,260],"Multiple":[83],"Cyber":[84],"Threat":[85],"Intelligence":[86],"(CTI)":[87],"sources":[88,169],"publish":[89],"lists":[90,133,177],"perform":[95],"malicious":[96],"activities,":[97],"simple":[99],"automated":[100],"SPAM":[103],"phishing":[105],"campaigns.":[106],"They":[107],"represent":[108],"a":[109,121,236],"valuable":[110],"resource":[111],"administrators,":[114],"helping":[115],"block":[117],"cyberattacks.":[118],"Built":[119],"with":[120,243],"combination":[122],"sensors":[125],"\u2014":[126,131],"including":[127],"honeypots":[130],"these":[132,176],"could":[134,252],"explain":[135,161],"seen":[138,185],"other":[140],"darknets,":[141],"thus":[142,154],"simplifying":[143],"search":[145],"relevant":[147],"in":[149,186,248],"independent":[150],"deployments.":[152],"We":[153],"investigate":[155],"what":[157],"extent":[158],"open":[159],"blocklists":[160,216],"By":[164],"crawling":[165],"hundreds":[166],"CTI":[168],"providing":[170],"blocklists,":[171,195],"first":[173],"notice":[174],"how":[175],"often":[179],"incomplete":[180],"or":[181],"slowly":[182],"updated.":[183],"Traffic":[184],"our":[187],"deployment":[189],"is":[190],"hardly":[191],"explained":[192],"by":[193,229],"even":[196],"considering":[198],"only":[199],"most":[201],"prominent":[202],"scan":[203],"attempts,":[204],"ignoring":[206],"such":[208],"backscattering.":[210],"Our":[211],"preliminary":[212],"results":[213],"suggest":[214],"can":[217],"be":[218,253],"great":[220],"use":[221],"seeding":[223],"explanation":[225],"traffic,":[228],"giving":[230],"context":[231],"activity":[234],"few":[237],"addresses.":[239],"more":[241],"similar":[244],"behaviour":[245],"used":[254],"enrich":[256],"complement":[258]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}