A statistical approach for fingerprinting probing activities

Proceedings - 2013 International Conference on Availability, Reliability and Security, ARES 2013

Volumn , Issue , 2013, Pages 21-30

  Bou Harb, Elias ^a   Debbabi, Mourad ^a   Assi, Chadi ^a  

^a Dept of Electrical and Computer Engineering   (Canada)

Author keywords

Cyber Security Capability; Probing; Scanning

Indexed keywords

CHANGE-POINT DETECTION PROBLEMS; CYBER SECURITY; PROBABILISTIC DISTRIBUTION; PROBING; SCANNING DETECTION SYSTEM; SCANNING TECHNIQUES; STATISTICAL APPROACH; STATISTICAL TECHNIQUES;

MACHINERY; PROBABILITY DISTRIBUTIONS; SCANNING;

SECURITY OF DATA;

EID: 84892383995     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ARES.2013.9     Document Type: Conference Paper

References (47)

1. Techcrunch. Hack Attack: Sony Confirms PlayStation Network Outage Caused By 'External Intrusion'. http: //tinyurl.com/6cbcldv.
2. Forbes. Citibank Reveals One Percent Of Credit Card Accounts Exposed In Hacker Intrusion. http://tinyurl. com/7jxgxqz.
3. The Wall Street Journal. Hackers Targeted Twitter User Data. http://tinyurl.com/a9tkbn5.
4. ABC news. Major US Newspapers Allege Chinese Hack Attack. http://tinyurl.com/bekao8k.
5. Computer World. Google: Phishers stole e-mail from U.S. officials, others. http://tinyurl.com/cav4rwj.
6. The Next Web. Senate website, CIA.gov reportedly hacked. http://tinyurl.com/7y8dv5b.
7. ArsRechnica. Facebook Computers Compromised. http: //tinyurl.com/cwmvxrv.
8. National Security Council. http://www.whitehouse.gov/ cybersecurity.
9. S. Panjwani, S. Tan, K.M. Jarrin, and M. Cukier. An experimental evaluation to determine if port scans are precursors to an attack. In Dependable Systems and Networks, 2005. DSN 2005. Proceedings. International Conference on, pages 602-611, june-1 july 2005.
10. A. Dainotti, A. King, K. Claffy, F. Papale, and A. Pescap. Analysis of a "/0" Stealth Scan from a Botnet. In Internet Measurement Conference (IMC), Nov 2012.
11. Internet Storm Center. Reports of a Distributed Injection Scan. http://isc.sans.edu/diary.html?storyid=14251.
12. Emmanuele Zambon &Damiano Bolzoni. Network Intrusion Detection Systems. http://www.blackhat.com/ presentations/bh-usa-06/BH-US-06-Zambon.pdf.
13. M.H. Bhuyan, DK Bhattacharyya, and JK Kalita. Surveying port scans and their detection methodologies. The Computer Journal, 54(10):1565-1581, 2010.
14. C.-K. Peng, S. V. Buldyrev, S. Havlin, M. Simons, H. E. Stanley, and A. L. Goldberger. Mosaic organization of dna nucleotides. Phys. Rev. E, 49:1685-1689, Feb 1994.
15. U. Harder, M.W. Johnson, J.T. Bradley, and W.J. Knottenbelt. Observing internet worm and virus attacks with a small network telescope. Electronic Notes in Theoretical Computer Science, 151(3):47-59, 2006.
16. K. Fukuda, T. Hirotsu, O. Akashi, and T. Sugawara. Correlation among piecewise unwanted traffic time series. In Global Telecommunications Conference, 2008. IEEE GLOBECOM 2008. IEEE, pages 1-5. IEEE, 2008.
17. G.F. Lyon. Nmap network scanning: The official nmap project guide to network discovery and security scanning author: Gordon fyodor l. 2009.
18. M. Little, P. McSharry, I. Moroz, and S. Roberts. Nonlinear, biophysically-informed speech pathology detection. In Acoustics, Speech and Signal Processing, 2006. ICASSP 2006 Proceedings., volume 2, page II.
19. Fing, the ultimate network toolkit. http://www. overlooksoft.com/fing.
20. S. Staniford, J.A. Hoagland, and J.M. McAlerney. Practical automated detection of stealthy portscans. Journal of Computer Security, 10(1/2):105-136, 2002.
21. Thomas Kailath. The divergence and bhattacharyya distance measures in signal selection. Communication Technology, IEEE Transactions on, 15(1):52-60, 1967.
22. Thomas Kailath. The divergence and bhattacharyya distance measures in signal selection. Communication Technology, IEEE Transactions on, 15(1):52-60, 1967.
23. J. MacQueen et al. Some methods for classification and analysis of multivariate observations. In Proceedings of the fifth Berkeley symposium on mathematical statistics and probability, volume 1, page 14. California, USA, 1967.
24. A.P. Dempster, N.M. Laird, and D.B. Rubin. Maximum likelihood from incomplete data via the em algorithm. Journal of the Royal Statistical Society. Series B (Methodological), pages 1-38, 1977.
25. jNetPcap. Sli Technologies. http://jnetpcap.com/ userguide.
26. M. Hall, E. Frank, G. Holmes, B. Pfahringer, P. Reutemann, and I.H. Witten. The weka data mining software: an update. ACM SIGKDD Explorations Newsletter, 11(1):10-18, 2009.
27. k-Means Clustering. http://www.mathworks.com/help/ stats/k-means- clustering.html.
28. Sushil Jajodia. Cyber Situational Awareness: Issues and Research. 2012.
29. Maurice George Kendall. Rank correlation methods. 1948.
30. Jerome H Friedman and Lawrence C Rafsky. Multivariate generalizations of the wald-wolfowitz and smirnov twosample tests. The Annals of Statistics, pages 697-717, 1979.
31. M. Bailey, E. Cooke, F. Jahanian, J. Nazario, D. Watson, et al. The internet motion sensor: A distributed blackhole monitoring system. In Proceedings of the 12th ISOC Symposium on Network and Distributed Systems Security (SNDSS), pages 167-179, 2005.
32. Yegneswaran, Vinod et al. On the design and use of internet sinks for network abuse monitoring. In Recent Advances in Intrusion Detection. 2004.
33. Eric Wustrow, Manish Karir, Michael Bailey, Farnam Jahanian, and Geoff Huston. Internet background radiation revisited. In Proceedings of the 10th annual conference on Internet measurement, pages 62-74. ACM, 2010.
34. Jayanthkumar Kannan, Jaeyeon Jung, Vern Paxson, and Can Emre Koksal. Semi-automated discovery of application session structure. In Proceedings of the 6th ACM SIGCOMM conference on Internet measurement, pages 119-132. ACM, 2006.
35. Yi Cao. Bhattacharyya Distance Measure for Pattern Recognition. http://tinyurl.com/bveualz.
36. Simone Fatichi. Mann-Kendall Test. http://tinyurl.com/ cstvpwa.
37. MathWorks. Run test for randomness. http://tinyurl.com/ d6gtykz.
38. David Moore, Colleen Shannon, Douglas J Brown, Geoffrey M Voelker, and Stefan Savage. Inferring internet denial-of-service activity. ACM Transactions on Computer Systems (TOCS), 24(2):115-139, 2006.
39. Daniel Roelker, Marc Norton and Jeremy Hewlett. sfportscan, 2004. http://projects.cs.luc.edu/comp412/dredd/ docs/software/readmes/sfportscan.
40. Snort. Available at: http://www.snort.org.
41. Valery Guralnik and Jaideep Srivastava. Event detection from time series data. In Proceedings of the fifth ACM SIGKDD international conference on Knowledge discovery and data mining, pages 33-42. ACM, 1999.
42. Ryan Prescott Adams and David J.C. MacKay. Bayesian online changepoint detection. Cambridge, UK, 2007.
43. Darren Bounds. Packit-Packet analysis and injection tool. http://linux.die.net/man/8/packit.
44. Vinod Yegneswaran, Paul Barford, and Vern Paxson. Using honeynets for internet situational awareness. In Proceedings of the Fourth Workshop on Hot Topics in Networks (HotNets IV), pages 17-22, 2005.
45. W. Zhang, S. Teng, and X. Fu. Scan attack detection based on distributed cooperative model. In Computer Supported Cooperative Work in Design, 2008. CSCWD 2008. 12th International Conference on, pages 743-748. IEEE, 2008.
46. M.H. Bhuyan, D.K. Bhattacharyya, and J.K. Kalita. Aocd: An adaptive outlier based coordinated scan detection approach. International Journal of Network Security, 14(6):339-351, 2012.
47. R. Baldoni, G. Di Luna, and L. Querzoni. Collaborative Detection of Coordinated Port Scans. Technical report, 2012. http://www.dis.uniroma1.it/? midlab; Last accessed: 20/2/2013.