Detecting anomolous network activity based on scheduled dark network addresses

1. A method comprising:

dynamically assigning, by a server, network addresses selected from a plurality of network addresses to network devices of a network based on a schedule, wherein the schedule represents a given network address of the plurality of network addresses and a time during which the given network address is to remain unassigned and in a dark address space; and

based on the schedule, detecting an anomalous behavior associated with the network.

2. The method of claim 1 , wherein detecting the anomalous behavior comprises:

detecting an attempted communication with the given network address during the time which the given network address is to remain unassigned and in the dark address space.

3. The method of claim 2 , wherein detecting the attempted communication comprises identifying a source network address associated with the attempted communication, and wherein the method further comprises performing network intrusion analysis based on the source network address.

4. The method of claim 3 , wherein performing network intrusion analysis comprises identifying a network threat based on the source network address and a pattern of network activity.

5. The method of claim 1 , further comprising:

by the server, generating the schedule.

6. The method of claim 1 , wherein detecting the anomalous behavior comprises:

detecting a behavior associated with a security intrusion or a network misconfiguration.

7. The method of claim 1 , further comprising:

generating the schedule; and

communicating data to the server representing the schedule.

8. An article comprising a non-transitory machine readable storage medium to store instructions that, when executed by a machine, cause the machine to:

schedule time slots for which associated addresses of a network are to be removed from a pool of available network addresses assigned by a dynamic host configuration protocol (DHCP) server and be within an unassigned dark address space; and

identify problems associated with the network based on the scheduling of the time slots and observed communications over the network.

9. The article of claim 8 , wherein the instructions, when executed by the machine, cause the machine to vary the scheduling of the time slots with respect to time.

10. The article of claim 8 , wherein the instructions, when executed by the machine, cause the machine to flag communications over the network associated with attempted communications with network addresses that are removed from the pool and are within the dark address space due to the scheduling of the time slots.

11. The article of claim 8 , wherein the instructions, when executed by the machine, cause the machine to:

determine a list of source addresses associated with attempted communications with network addresses that are removed from the pool and are within the dark address space due to the scheduling of the time slots; and

order the source addresses in the list such that a source address of the source addresses associated with a relatively larger number of attempted accesses has a higher priority than a source address of the source addresses associated with a relatively smaller number of attempted accesses.

12. The article of claim 8 , wherein the instructions, when executed by the machine, cause the machine to apply machine learning based on communications over the network associated with attempted communications with network addresses that are removed from the pool and are within the dark address space due to the scheduling of the time slots to identify a network security threat.

13. The article of claim 8 , wherein the instructions, when executed by the machine, cause the machine to identify a source IP address associated with an attempted communication to a network address of the network addresses that are removed from the pool and are within the dark address space due to the scheduling of the time slots.

14. The article of claim 8 , wherein the instructions, when executed by the machine, cause the machine to communicate data representing the scheduling of the time slots to the DHCP server.

15. The article of claim 8 , wherein the instructions, when executed by the machine, cause the machine to use the scheduling of the time slots and a log representing the observed communications over the network to classify the problems.

16. The article of claim 8 , wherein the instructions, when executed by the machine, cause the machine to identify a misconfigured network device based on the schedule and the observed communications over the network.

17. A system comprising:

a processor; and

a memory to store instructions that, when executed by the processor, cause the processor to:

dynamically assign Internet Protocol (IP) addresses of an IP address space to devices of a network; and

designate parts of the IP address space as being dark during designated times such that at a given designated time of the designated times, a given IP address of the IP address space is dark and is unavailable for dynamic assignment to any of the devices, and at a second time other than the given designated time, the given IP address is available for the dynamic assignment to the devices.

18. The system of claim 17 , wherein the memory stores instructions that, when executed, cause the processor to use a dynamic host configuration protocol (DHCP) server to dynamically assign the IP addresses.

19. The system of claim 17 , wherein the instructions, when executed by the processor, cause the processor to publish a schedule representing the parts of the IP address space.

20. The system of claim 17 , wherein the instructions, when executed by the processor, cause the processor to vary over time the parts of the IP address space.