Modeling and Recognizing Network Scanning Activities with Finite Mixture Models and Hidden Markov Models

Giulia de Santis 1
1 RESIST - Resilience and Elasticity for Security and ScalabiliTy of dynamic networked systems
Inria Nancy - Grand Est, LORIA - NSS - Department of Networks, Systems and Services
Abstract : The work accomplished in this PhD consisted in building stochastic models of ZMap and Shodan, respectively, two Internet-wide scanners. More in detail, packets originated by each of the two considered scanners have been collected by the High Security Lab hosted in Inria, and have been used to learn Hidden Markov Models (HMMs). The rst part of the work consisted in modeling intensity of the two considered scanners. We investigated if the intensity of ZMap varies with respect to the targeted service, and if the intensities of the two scanners are comparable. Results showed that the answer to the first question is positive (i.e., intensity of ZMap varied with respect to the targeted ports), whereas the answer to the second question is negative. In other words, we obtained a model for each set of logs. The following part of the work consisted in investigating other two features of the same scanners: their spatial and temporal movements, respectively. More in detail, we created datasets containing logs of one single execution of ZMap and Shodan, respectively. Then, we computed di erences of IP addresses consecutively targeted by the same scanner (i.e., in each sample), and of the corresponding timestamps. The former have been used to model spatial movements, whereas the latter temporal ones. Once the Hidden Markov Models are available, they have been applied to detect scanners from other sets of logs. In both cases, our models are not able to detect the targeted service, but they correctly detect the scanner that originates new logs, with an accuracy of 95% when exploiting spatial movements, and of 98% when using temporal movements
Complete list of metadatas

Cited literature [50 references]  Display  Hide  Download

https://hal.univ-lorraine.fr/tel-02075680
Contributor : Thèses Ul <>
Submitted on : Thursday, March 21, 2019 - 3:06:17 PM
Last modification on : Friday, April 26, 2019 - 8:43:37 AM
Long-term archiving on : Saturday, June 22, 2019 - 3:17:51 PM

File

DDOC_T_2018_0201_DE_SANTIS.pdf
Files produced by the author(s)

Identifiers

  • HAL Id : tel-02075680, version 1

Citation

Giulia de Santis. Modeling and Recognizing Network Scanning Activities with Finite Mixture Models and Hidden Markov Models. Modeling and Simulation. Université de Lorraine, 2018. English. ⟨NNT : 2018LORR0201⟩. ⟨tel-02075680⟩

Share

Metrics

Record views

50

Files downloads

104