Measuring adversaries

Many concepts and techniques developed for general Internet measurement have counterparts in the domain of detecting and analyzing network attacks. The task is greatly complicated, however, by the fact that the object of study is adversarial: attackers do not wish to be "measured" and will take steps to thwart observation. We look at the far-ranging consequences of this different measurement environment: the analysis difficulties-some fundamental-that arise due to subtle ambiguities in the true semantics of observed traffic; new notions of "active measurement"; the highly challenging task of rapidly characterizing Internet-scale pheonmena such as global worm pandemics; the need for detailed application-level analysis and related policy and legal difficulties; attacks that target passive analysis tools; and the inherent "arms race" nature of the undertaking.