Skip to Main content Skip to Navigation
New interface

Modeling and Recognizing Network Scanning Activities with Finite Mixture Models and Hidden Markov Models

Giulia de Santis 1 
1 RESIST - Resilience and Elasticity for Security and ScalabiliTy of dynamic networked systems
Inria Nancy - Grand Est, LORIA - NSS - Department of Networks, Systems and Services
Abstract : The work accomplished in this PhD consisted in building stochastic models of ZMap and Shodan, respectively, two Internet-wide scanners. More in detail, packets originated by each of the two considered scanners have been collected by the High Security Lab hosted in Inria, and have been used to learn Hidden Markov Models (HMMs). The rst part of the work consisted in modeling intensity of the two considered scanners. We investigated if the intensity of ZMap varies with respect to the targeted service, and if the intensities of the two scanners are comparable. Results showed that the answer to the first question is positive (i.e., intensity of ZMap varied with respect to the targeted ports), whereas the answer to the second question is negative. In other words, we obtained a model for each set of logs. The following part of the work consisted in investigating other two features of the same scanners: their spatial and temporal movements, respectively. More in detail, we created datasets containing logs of one single execution of ZMap and Shodan, respectively. Then, we computed di erences of IP addresses consecutively targeted by the same scanner (i.e., in each sample), and of the corresponding timestamps. The former have been used to model spatial movements, whereas the latter temporal ones. Once the Hidden Markov Models are available, they have been applied to detect scanners from other sets of logs. In both cases, our models are not able to detect the targeted service, but they correctly detect the scanner that originates new logs, with an accuracy of 95% when exploiting spatial movements, and of 98% when using temporal movements
Complete list of metadata

Cited literature [87 references]  Display  Hide  Download
Contributor : Thèses UL Connect in order to contact the contributor
Submitted on : Thursday, March 21, 2019 - 3:06:17 PM
Last modification on : Friday, February 4, 2022 - 3:30:42 AM
Long-term archiving on: : Saturday, June 22, 2019 - 3:17:51 PM


Files produced by the author(s)


  • HAL Id : tel-02075680, version 1


Giulia de Santis. Modeling and Recognizing Network Scanning Activities with Finite Mixture Models and Hidden Markov Models. Modeling and Simulation. Université de Lorraine, 2018. English. ⟨NNT : 2018LORR0201⟩. ⟨tel-02075680⟩



Record views


Files downloads