Detecting scanners: Empirical assessment on a 3G network

International Journal of Network Security

Volumn 9, Issue 2, 2009, Pages 143-155

  Falletta, Vincenzo ^a   Ricciato, Fabio ^a  

^a Forschungszentrum Telekommunikation Wien ^*  (Austria)

Author keywords

Anomaly detection; Mobile networks; Scanning detection

Indexed keywords

3G MOBILE NETWORK; ANOMALY DETECTION; EMPIRICAL ASSESSMENT; MALICIOUS AGENT; PASSIVE TRAFFIC MONITORING; PEER TO PEER; REAL TRAFFIC; SELF-PROPAGATING;

3G MOBILE COMMUNICATION SYSTEMS; PEER TO PEER NETWORKS; WIRELESS NETWORKS;

SCANNING;

EID: 67650339498     PISSN: 1816353X     EISSN: 18163548     Source Type: Journal    
DOI: None     Document Type: Article

References (25)

1. M. Allman, V. Paxson, and J. Terrell, "A brief history of scanning," Proceedings of Internet Measurement Conference (IMC07), pp. 77-82, San Diego, California, USA, Oct. 2007.
2. J. Bannister, P. Mather, and S. Coope, Convergence Technologies for 3G Networks, Wiley, 2004.
3. S. A. Baset and H. Schulzrinne, "An analysis of the Skype peer-to-peer internet telephony protocol," Proceedings of INFOCOM'06, pp. 1-11, Barcelona, Spain, Apr. 2006.
4. D. J. Burroughs, L. F. Wilson, and G. V. Cybenko, "Analysis of distributed intrusion detection systems using Bayesian methods," Proceedings of IEEE International Performance Computing and Communication Conference, pp. 329-334, Apr. 2002.
5. DARWIN home page. http://userver.ftw.at/~ricciato/darwin
6. J. P. Egan, Signal Detection Theory and ROC Analysis, Academic Press, 1975.
7. Endace Measurement Systems. http://www.endace.com
8. D. Frincke, Intrusion Detection, IOS Press, ISBN 1586032542, 2002.
9. C. Gates, J. J. McNutt, J. B. Kadane, and M. I. Kellner, "Scan detection on very large networks using logistic regression modeling,' Proceedings of the 11th IEEE Symposium on Computers and Communications (ISCC'06), pp. 402-408, 2006.
10. Y. Gu, A. McCallum, and D. Towsley, "Detecting anomalies in network traffic using maximum entropy estimation," Proceedings of the Internet Measurement Conference (IMC'05), pp. 345-350, Berkeley, CA, Oct. 2005.
11. J. Jung, V. Paxson, A. W. Berger, and H. Balakrishnan, "Fast portscan detection using sequential hypothesis testing," Proceedings of the IEEE Symposium on Security and Privacy, pp. 211-225, May 2004.
12. E. Hasenleithner and F. Ricciato, Observations at Short Time-Scales from the Edge of a Cellular Data Network, Technical Report FTW-TR-2007-001, Available online from [5], Jan. 2007.
13. A. Lakhina, M. Crovella, and C. Diot, "Mining anomalies using traffic feature distributions," Proceedings of SIGCOMM' 05, pp. 217-228, Philadelphia, USA, July 2005.
14. S. Northcutt and J. Novak, Network Intrusion Detection. Sams Publishing, 2002.
15. G. Portokalidis and H. Bos, "SweetBait: Zero-hour worm detection and containment using lowand high-interaction honeypots, Computer Networks, vol. 51, no. 5, pp. 1256-1274, Apr. 2007.
16. F. Ricciato, "Unwanted traffic in 3G networks," ACM Computer Communication Review, vol. 36, no. 2, pp. 53-56, Apr. 2006
17. F. Ricciato, P. Svoboda, E. Hasenleithner, and W. Fleischer, "On the impact of unwanted traffic onto a 3G network," Proceedings of 2nd International workshop on Security, Privacy and Trust in Pervasive and Ubiquitous Computing (SecPeru'06), pp. 49-56, Lyon, France, June 2006.
18. S. E. Schechter, J. Jung, and A. W. Berger, "Fast detection of scanning worm infections," Proceedings of the 7th International Symposium on Recent Advances in Intrusion Detection, pp. 59-81, French Riviera, France, Sep. 2004.
19. G. Simon, H. Xiong, E. Eilertson, and V. Kumar, "Scan detection: A data mining approach," Proceedings of 2006 SIAM conference on Data Mining, pp. 118-129, Apr. 2006.
20. S. Singh, C. Estan, G. Varghese, and S. Savage, "Automated worm fingerprinting", Proceedings of the 6th Conference on Symposium on Operating Systems Design & Implementation, pp. 45-60, San Francisco, CA, Dec. 2004.
21. SNORT homepage. http://www.snort.org
22. A. Sridharan, T. Ye, and S. Bhattacharyya, "Connectionless port scan detection on the backbone," Proceedings of Malware workshop, held in conjunction with IPCCC, pp. 567-576, Pheonix, AZ. Apr. 2006.
23. J. Twycross, and M. M. Williamson, "Implementing and testing a virus throttle", Proceedings of USENIX Security Symposium, pp. 285-294, Washington D.C., USA, Aug. 2003.
24. D. Watson, "Honeynets: A tool for counterintelligence in online security," Network Security, vol. 2007, no. 1, pp. 4-8, Jan. 2007.
25. H. Yang, F. Ricciato, S. Lu, and L. Zhang, "Securing a wireless world," Proceedings of the IEEE Special Issue on Cryptography and Security Issues, vol. 94, no. 2, Feb. 2006.