Merit Network Telescope: Processing and Initial Insights from Nearly 20 Years of Darknet Traffic for Cybersecurity Research

TL;DR

This study analyzes nearly 20 years of darknet traffic data collected by a large network telescope to uncover long-term cybersecurity trends, threat activity patterns, and traffic dynamics, using a scalable, multi-level processing methodology.

Contribution

It introduces a scalable, multi-level processing pipeline for long-term darknet traffic analysis and provides initial insights into global threat activity over two decades.

Findings

Identification of long-term traffic trends and spikes

Detection of Internet-wide scanning events

Insights into DoS campaign patterns

Abstract

This paper presents an initial longitudinal analysis of unsolicited Internet traffic collected between 2005 and 2025 by one of the largest and most persistent network telescopes in the United States, operated by Merit Network. The dataset provides a unique view into global threat activity as observed through scanning and backscatter traffic, key indicators of large-scale probing behavior, data outages, and ongoing denial-of-service (DoS) campaigns. To process this extensive archive, coarse-to-fine methodology is adopted in which general insights are first extracted through a resource-efficient metadata sub-pipeline, followed by a more detailed packet header sub-pipeline for finer-grained analysis. The methodology establishes two sub-pipelines to enable scalable processing of nearly two decades of telescope data and supports multi-level exploration of traffic dynamics. Initial insights highlight long-term trends and recurring traffic spikes, some attributable to Internet-wide scanning events and others likely linked to DoS activities.We present general observations spanning 2006-2024, with a focused analysis of traffic characteristics during 2024.