Knowledge discovery of port scans from darknet

Abstract

Abstract-Port scanning is widely used in Internet prior for attacks in order to identify accessible and potentially vulnerable hosts. In this work, we propose an approach that allows to discover port scanning behavior patterns and group properties of port scans. This approach is based on graph modelling and graph mining. It provides to security analysts relevant information of what services are jointly targeted, and the relationship of the scanned ports. This is helpful to assess the skills and strategy of the attacker. We applied our method to data collected from a large darknet data, i.e. a full /20 network where no machines or services are or have been hosted to study scanning activities. I. INTRODUCTIONComputers connected to a network use many services by mainly relying TCP/UDP protocols. Port or IP scanning (also known as sweeping) is one of the most common techniques by attackers to discover open ports in preamble of an attacker or an intrusion through those ones. Hence, scanning methods are part of network-based discovery techniques, still for emerging threats like Advanced Persistent Threats [5]. Therefore, an indepth understanding of scanning techniques is necessary for improving security: detection, prevention or forensics. There are three main types of scans: vertical, horizontal and block scans. Vertical scan is described as a single IP being tested on multiple ports. Horizontal scan is described as trying scan against a group of IPs for a single port. Block scan is a combination of both of them. All of them cannot.This paper aims at making a deeper and more sophisticated analysis of vertical scans by seeking the relationship of commonly scanned TCP ports. Our approach relies on building dependencies among those latter and extract the predominant roles of certain ports within sequence of consecutive targeted ports as well as extracting relationships among them, i.e. discover groups of commonly scanned ports. This can help the security analysts to guard against attacks and improve prevention and detection tools. For example, given the scans performed on the following successive ports 80, 591, 8008, 8080 and 443, we want to discover the relationship of commonly scanned ports with their dependencies, then the significant service ecosystem is that these ports are used for "HTTP" traffic. Thus, the analysts can update the web server security. We have validated the method on real data collected from a darknet in order to observe and understand (1) the behavior of different scans and (2) extract the "modi operandi" of targeted ports.In this paper, our contributions are as follows: 1) a graph-based model of port scans relationships, 2) a knowledge discovery methodology using graph mining techniques based on the proposed model,

Deep mining port scans from darknet

“…In van Riel and Irwin, the authors presented an animated 3‐D scatter plot visualization of port scanning on darknet data. Lagraa and François presented the discovery of vertical port scans from Darknet. They performed a deep analysis of port scan‐based attacks by proposing a graph model‐based approach to analyze/understand them.…”

“…The originality of our approach compared with the related works is that first, it focuses on a specific problem, which is a port scanning, by extending a previous work . We aim to provide a generic and automatic port scanning profiling approach over darknet data.…”

“…Which are the group of ports commonly targeted? In another way, the time series of distinct source IP addresses per destination port is a better indicator than packet rates …”

“…The present work is an extension of our previous work by defining a port similarity, automatic port tagging, and performing a deep mining over darknet data.…”

An evolutionary hybrid search heuristic for monitor placement in communication networks

“…Here, a swift reaction on threats in communication infrastructures is crucial for proper operation of networks, e.g., as shown in case of distributed denial of service attacks (Lagraa and Francois 2017). Detecting a possible threat early, e.g., a spreading malware, unauthorized access to resources, or malfunction of individual devices in a network, helps to mitigate or prevent negative impact on network performance or reduces downtime of services.…”