Estimation of behavior of scanners based on ISDAS distributed sensors

Authors:
Hiroaki Kikuchi;Masato Terada;Naoya Fukuno;Norihisa Doi
Affiliations:
School of Information Technology, Tokai University, Hiratsuka, Kangawa, Japan;Hitachi, Ltd. Hitachi Incident Response Team, Kawasaki, Kanagawa, Japan;School of Information Technology, Tokai University, Hiratsuka, Kangawa, Japan;Dept. of Info. and System Engineering, Facility of Science and Engineering, Chuo University, Tokyo, Japan
Venue:
OTM'07 Proceedings of the 2007 OTM confederated international conference on On the move to meaningful internet systems: CoopIS, DOA, ODBASE, GADA, and IS - Volume Part II
Year:
2007

Citing 4
Cited 0

Code red worm propagation modeling and analysis

Proceedings of the 9th ACM conference on Computer and communications security
Inside the Slammer Worm

IEEE Security and Privacy
The Spread of the Witty Worm

IEEE Security and Privacy
Exploiting underlying structure for detailed reconstruction of an internet-scale event

IMC '05 Proceedings of the 5th ACM SIGCOMM conference on Internet Measurement

Quantified Score

Hi-index	0.00

Visualization

Abstract

Given independent multiple access logs, we develop a mathematical model to identify the number of malicious hosts in the current Internet. In our model, the number of malicious hosts is formalized as a function taking two inputs, namely the duration of observation and the number of sensors. Under the assumption that malicious hosts with statically assigned global addresses perform random port scans to independent sensors uniformly distributed over the address space, our model gives the asymptotic number of malicious source addresses in two ways. Firstly, it gives the cumulative number of unique source addresses in terms of the duration of observation. Secondly, it estimates the cumulative number of unique source addresses in terms of the number of sensors. To evaluate the proposed method, we apply the mathematical model to actual data packets observed by ISDAS distributed sensors over a one-year duration from September 2004, and check the accuracy of identification of the number of malicious hosts.