We are given a darknet dataset. The aim of the project is to build a cyber-security capability that permits the inference (i.e., detection) of probing activites by analyzing the darknet IP space. We have to create a back-end which analyzes sources of IP addresses which are related to probing activites and list them by type of probing, rate, start/end times, etc.

I am able to write this dataset to a text file for source/destinations ips, size, etc. but what exactly are probing activites? What exactly am I suppose to be filtering or finding that I can write to the text file?

Can you please explain how to detect probing activities based off protocols or query responses? Using tshark

Thank you!