  Expanding the scientific tools available to protect computer networks can be
aided by a deeper understanding of the underlying statistical distributions of
network traffic and their potential geometric interpretations. Analyses of
large scale network observations provide a unique window into studying those
underlying statistics. Newly developed GraphBLAS hypersparse matrices and D4M
associative array technologies enable the efficient anonymized analysis of
network traffic on the scale of trillions of events. This work analyzes over
100,000,000,000 anonymized packets from the largest Internet telescope (CAIDA)
and over 10,000,000 anonymized sources from the largest commercial honeyfarm
(GreyNoise). Neither CAIDA nor GreyNoise actively emit Internet traffic and
provide distinct observations of unsolicited Internet traffic (primarily
botnets and scanners). Analysis of these observations confirms the previously
observed Cauchy-like distributions describing temporal correlations between
Internet sources. The Gull lighthouse problem is a well-known geometric
characterization of the standard Cauchy distribution and motivates a potential
geometric interpretation for Internet observations. This work generalizes the
Gull lighthouse problem to accommodate larger classes of coastlines, deriving a
closed-form solution for the resulting probability distributions, stating and
examining the inverse problem of identifying an appropriate coastline given a
continuous probability distribution, identifying a geometric heuristic for
solving this problem computationally, and applying that heuristic to examine
the temporal geometry of different subsets of network observations. Application
of this method to the CAIDA and GreyNoise data reveals a several orders of
magnitude difference between known benign and other traffic which can lead to
potentially novel ways to protect networks.
