DarkFT: Automatic Scanning Behavior Analysis with FastText in Darknet Traffic.

Network telescopes (Darknets) collect and record unsolicited Internet-wide traffic destined for a routed but unused address space, which provides a global perspective on Inter-net scanning behavior. However, it’s very difficult to extract meaningful information from Darknet traffic including a large number of unlabeled packets. In recent years, some work has used NLP techniques for self-supervised learning to generate embeddings as a rich representation of the Darknet. However, we found that previous resulting embeddings are not general enough. This paper proposed a new traffic representation model called Darknet Traffic Representations using FastText (DarkFT) which trains contextualized representation from large-scale unlabeled data. The embedding features can be applied to semi-supervised and unsupervised tasks. We conduct experiments on a dataset collected by network telescopes located in Japan and get better accuracy compared with state-of-the-art NLP-based approaches, especially for unknown senders.