A view of the EM algorithm that justifies incremental, sparse, and other variants
Proceedings of the NATO Advanced Study Institute on Learning in graphical models
ACM Computing Surveys (CSUR)
SNMP,SNMPV2,Snmpv3,and RMON 1 and 2
SNMP,SNMPV2,Snmpv3,and RMON 1 and 2
Practical automated detection of stealthy portscans
Journal of Computer Security
Passive visual fingerprinting of network attack tools
Proceedings of the 2004 ACM workshop on Visualization and data mining for computer security
Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning
Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning
The WEKA data mining software: an update
ACM SIGKDD Explorations Newsletter
Survey of SNMP performance analysis studies
International Journal of Network Management
Observing Internet Worm and Virus Attacks with a Small Network Telescope
Electronic Notes in Theoretical Computer Science (ENTCS)
Internet background radiation revisited
IMC '10 Proceedings of the 10th ACM SIGCOMM conference on Internet measurement
Data Mining: Concepts, Models, Methods, and Algorithms
Data Mining: Concepts, Models, Methods, and Algorithms
Distributed denial of service is a scalability problem
ACM SIGCOMM Computer Communication Review
A network activity classification schema and its application to scan detection
IEEE/ACM Transactions on Networking (TON)
IEEE Transactions on Information Theory
Before we knew it: an empirical study of zero-day attacks in the real world
Proceedings of the 2012 ACM conference on Computer and communications security
Analysis of a "/0" stealth scan from a botnet
Proceedings of the 2012 ACM conference on Internet measurement conference
Investigating the dark cyberspace: Profiling, threat-based analysis and correlation
CRISIS '12 Proceedings of the 2012 7th International Conference on Risks and Security of Internet and Systems (CRiSIS)
| Hi-index | 0.00 |
We present in this paper an approach that is composed of two techniques that respectively tackle the issues of detecting corporate cyber scanning and clustering distributed reconnaissance activity. The first employed technique is based on a non-attribution anomaly detection approach that focuses on what is being scanned rather than who is performing the scanning. The second technique adopts a statistical time series approach that is rendered by observing the correlation status of a traffic signal to perform the identification and clustering. To empirically validate both techniques, we utilize and examine two real network traffic datasets and implement two experimental environments. The first dataset comprises of unsolicited one-way telescope/darknet traffic while the second dataset has been captured in our lab through a customized setup. The results show, on one hand, that for a class C network with 250 active hosts and 5 monitored servers, the training period of the proposed detection technique required a stabilization time of less than 1 s and a state memory of 80 bytes. Moreover, in comparison with Snort's sfPortscan technique, it was able to detect 4215 unique scans and yielded zero false negative. On the other hand, the proposed clustering technique is able to correctly identify and cluster the scanning machines with high accuracy even in the presence of legitimate traffic. We further validate this clustering technique by formulating the presented scenario as a machine learning problem. Specifically, we compare our proposed technique with an unsupervised data clustering technique that adopts the k-means and the expectation maximization approach. The results authenticate our clustering technique rendering it feasible for adoption.