Characterization of Malicious Overlay Networks on the Internet

A set of correlated malicious agents may form a malicious overlay network (MON) based on an existing network, and a logical link between any two malicious nodes can be established in the overlay dispensing with direct substrate connection between these nodes. In terms of topology complexity, MONs can be divided into simple MONs and complex MONs. A simple MON's topology is statistically consistent while a complex MON is not, which makes them own much different features. In this paper we try to characterize different MONs based on several widely used network measurements since the characterization of MONs may help to defend against MON attacks.