Smart Internet Probing: Scanning Using Adaptive Machine Learning

Sarabi, Armin; Jin, Kun; Liu, Mingyan

doi:10.1002/9781119723950.ch21

Cited by 3 publications

(5 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…When minimizing Internet scanning's impact on available Internet resources, we show GPS is two orders of magnitude more precise than exhaustive probing. Third, when scanning popular ports, we compare GPS's accuracy and bandwidth with the XGBoost scanner [36]. GPS saves up to 28 times, and on average 2.3 times, the bandwidth required to achieve the same coverage of services.…”

Section: Discussionmentioning

confidence: 99%

“…Classifiers. Sarabi et al [36] approach intelligent Internet-wide scanning as a classification problem-in which each port value is a class-and use an XGBoost classifier [18] to predict whether an IP will respond on one of 20 popular ports. Their work finds that the strongest predictor of a service is the presence of other services on the same host.…”

Section: Prior Workmentioning

confidence: 99%

“…GPS's objective is to maximize finding services across all ports. This differs from prior Internet scanning systems [36] that maximize the total "fraction of services" found (Equation 1): the number of services found by the system relative to the number of IPs that are found in a "ground truth" set (i.e., a baseline for the true number of services on port 𝑝, obtained by a 100% scan). This metric is biased towards discovering services on popular ports where services are more dense (e.g., 5% of all services across all 65K ports live on the top 10 ports) and disincentives finding services on uncommon ports, which are understudied and more likely to be vulnerable [25].…”

Section: Gps Objectivementioning

confidence: 99%

“…As introduced in Section 2, Sarabi et al [36] use a state-of-the-art XGBoost classifier [18] to predict responsive IPs for a given port. Unfortunately, the classifier cannot be deployed across all 65K ports due to (1) its prohibitively expensive runtime and (2) the lack of 10 million IP address samples across 99.99% of all 65K ports to train robust models [36]. Nevertheless, we benchmark GPS against the XGBoost since it is the closest related work.…”

Section: Gps Vs Machine Learningmentioning

confidence: 99%

“…We show that as services become harder to predict, the bandwidth required to find new services increases: finding 96% of services across all ports uses only 10 times less bandwidth compared to exhaustively scanning. When scanning only popular ports, GPS's algorithm uses up to 28 times less bandwidth than the state-of-the-art ML-based solution [36]. On a single CPU core, GPS computes predictions five times faster than if prior work was extended to predict services across all ports.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Predicting IPv4 services across all ports

Izhikevich

Teixeira

Durumeric

2022

Proceedings of the ACM SIGCOMM 2022 Conference

View full text Add to dashboard Cite

Internet-wide scanning is commonly used to understand the topology and security of the Internet. However, IPv4 Internet scans have been limited to scanning only a subset of services-exhaustively scanning all IPv4 services is too costly and no existing bandwidthsaving frameworks are designed to scan IPv4 addresses across all ports. In this work we introduce GPS, a system that efficiently discovers Internet services across all ports. GPS runs a predictive framework that learns from extremely small sample sizes and is highly parallelizable, allowing it to quickly find patterns between services across all 65K ports and a myriad of features. GPS computes service predictions in 13 minutes (four orders of magnitude faster than prior work) and finds 92.5% of services across all ports with 131× less bandwidth, and 204× more precision, compared to exhaustive scanning. GPS is the first work to show that, given at least two responsive IP addresses on a port to train from, predicting the majority of services across all ports is possible and practical.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Prior Workmentioning

confidence: 99%

Section: Gps Objectivementioning

confidence: 99%

Section: Gps Vs Machine Learningmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Predicting IPv4 services across all ports

Izhikevich

Teixeira

Durumeric

2022

Proceedings of the ACM SIGCOMM 2022 Conference

View full text Add to dashboard Cite

show abstract

Which Doors Are Open: Reinforcement Learning-based Internet-wide Port Scanning

Song,

He,

Zhao

et al. 2023

2023 IEEE/ACM 31st International Symposium on Quality of Service (IWQoS)

View full text Add to dashboard Cite

Malware Analysis and Classification Using Machine Learning Models

Swadeep,

Arockiasamy,

Perumal

2023

Advances in Systems Analysis, Software Engineering, and High Performance Computing

View full text Add to dashboard Cite

In modern times, it has become common practice for major corporations to utilize computers for storing data. Unfortunately, the frequency of malware attacks has increased, which facilitates unauthorized individuals' access to private information. Analyzing malware has become a critical task in safeguarding information systems against malicious attacks. Therefore, machine learning techniques have become an effective tool for automating investigations using static and dynamic analysis, combining malware with similar behavior into separate families based on proximity. Deep learning techniques improve the accuracy of malware variant detection and classification by building neural networks with more potentially different layers. This research aims to address this issue by training machine learning models using various algorithms on a dataset obtained by performing static and dynamic analysis on both malicious and benign samples. The resulting models were then combined to produce superior results compared to those obtained from a single model, which can be seen in the results.

show abstract

Smart Internet Probing: Scanning Using Adaptive Machine Learning

Cited by 3 publications

References 21 publications

Predicting IPv4 services across all ports

Predicting IPv4 services across all ports

Which Doors Are Open: Reinforcement Learning-based Internet-wide Port Scanning

Malware Analysis and Classification Using Machine Learning Models

Contact Info

Product

Resources

About