Automated Classification of Port-Scans from Distributed Sensors

Kikuchi, Hiroaki; Fukuno, Naoya; Kobori, Tomohiro; Terada, Masato; Tangtisanon, Pikulkaew

doi:10.1109/aina.2008.73

Cited by 2 publications

(2 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A decision tree was used in [10] to classify port scans observed by a Darknet (i.e., a set of passive sensors). [1] used Principal Component Analysis for characterizing the traffic collected by the Leurre.com project and presented the characteristics of the attacker activities for the first seven principle components.…”

Section: Related Workmentioning

confidence: 99%

Distinguishing between Web Attacks and Vulnerability Scans Based on Behavioral Characteristics

Goševa-Popstojanova

Dimitrijevikj

2014

2014 28th International Conference on Advanced Information Networking and Applications Workshops

View full text Add to dashboard Cite

The number of vulnerabilities and reported attacks on Web systems are showing increasing trends, which clearly illustrate the need for better understanding of malicious cyber activities. In this paper we use clustering to classify attacker activities aimed at Web systems. The empirical analysis is based on four datasets, each in duration of several months, collected by high-interaction honeypots. The results show that behavioral clustering analysis can be used to distinguish between attack sessions and vulnerability scan sessions. However, the performance heavily depends on the dataset. Furthermore, the results show that attacks differ from vulnerability scans in a small number of features (i.e., session characteristics). Specifically, for each dataset, the best feature selection method (in terms of the high probability of detection and low probability of false alarm) selects only three features and results into three to four clusters, significantly improving the performance of clustering compared to the case when all features are used. The best subset of features and the extent of the improvement, however, also depend on the dataset.

show abstract

Section: Related Workmentioning

confidence: 99%

Distinguishing between Web Attacks and Vulnerability Scans Based on Behavioral Characteristics

Goševa-Popstojanova

Dimitrijevikj

2014

2014 28th International Conference on Advanced Information Networking and Applications Workshops

View full text Add to dashboard Cite

show abstract

“…That work was focused on distinguishing among three types of attacks using the Kmeans clustering algorithm. A decision tree was used in [15] to classify port scans observed by a Darknet (i.e., passive sensors) to three classes: random, periodic, and intensive. Two recent papers were focused on clustering system events collected during execution of sample malware programs, with a goal to automatically categorize the malware into groups that reflect similar classes of behaviors [2], [4].…”

Section: Related Workmentioning

confidence: 99%

Classification of Malicious Web Sessions

Goševa-Popstojanova

Anastasovski

Pantev

2012

2012 21st International Conference on Computer Communications and Networks (ICCCN)

View full text Add to dashboard Cite

The ever increasing number of vulnerabilities and reported attacks on Web systems clearly illustrate the need for better understanding of malicious cyber activities, which will allow better protection, detection, and service recovery in the cyberspace. In this paper we use three supervised machine learning methods, Support Vector Machines (SVM), and decision trees based J48 and PART, to classify attacker activities aimed at Web systems. The empirical analysis is based on four datasets, each in duration of four to five months, collected by high-interaction honeypots. Malicious Web sessions are characterized with forty three different features (i.e., session attributes) extracted from Web server logs. Our results show that the supervised learning methods can be used to efficiently distinguish attack sessions from vulnerability scan sessions, with very high probability of detection and very low probability of false alarms. Furthermore, we follow the principle of Occam's razor, that is, we seek for the simplest possible model that can successfully classify malicious Web sessions. Our results show that attacks differ from vulnerability scans only in a small number of features (i.e., session attributes). In particular, depending on the data set, classification of malicious activities can be performed using from four to six features without significantly affecting learners' performance compared to when all 43 features are used. Decision tree based methods J48 and PART perform better than SVM across all datasets.

show abstract

Automated Classification of Port-Scans from Distributed Sensors

Cited by 2 publications

References 7 publications

Distinguishing between Web Attacks and Vulnerability Scans Based on Behavioral Characteristics

Distinguishing between Web Attacks and Vulnerability Scans Based on Behavioral Characteristics

Classification of Malicious Web Sessions

Contact Info

Product

Resources

About