How Dangerous Is Internet Scanning?

Raftopoulos, Elias; Glatz, Eduard; Dimitropoulos, Xenofontas; Dainotti, Alberto

doi:10.1007/978-3-319-17172-2_11

Cited by 10 publications

(2 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This method fails in cases of active adversaries alternating between successful and failed connections to evade detection. Raftopoulos et al [43] conduct a study that shows the dangers of the benign-looking port scanning activity on the internet. Ring et al [44] propose a feature-based approach to build both supervised and unsupervised models to detect slow port scans.…”

Section: Port Scanning Detectionmentioning

confidence: 99%

PORTFILER: Port-Level Network Profiling for Self-Propagating Malware Detection

Ongun¹,

Spohngellert²,

Miller³

et al. 2021

Preprint

View full text Add to dashboard Cite

Recent self-propagating malware (SPM) campaigns compromised hundred of thousands of victim machines on the Internet. It is challenging to detect these attacks in their early stages, as adversaries utilize common network services, use novel techniques, and can evade existing detection mechanisms. We propose PORTFILER (PORT-Level Network Traffic ProFILER), a new machine learning system applied to network traffic for detecting SPM attacks. PORTFILER extracts port-level features from the Zeek connection logs collected at a border of a monitored network, applies anomaly detection techniques to identify suspicious events, and ranks the alerts across ports for investigation by the Security Operations Center (SOC). We propose a novel ensemble methodology for aggregating individual models in PORTFILER that increases resilience against several evasion strategies compared to standard ML baselines. We extensively evaluate PORTFILER on traffic collected from two university networks, and show that it can detect SPM attacks with different patterns, such as WannaCry and Mirai, and performs well under evasion. Ranking across ports achieves precision over 0.94 and false positive rates below 8 × 10 −4 in the top 100 highly ranked alerts. When deployed on the university networks, PORTFILER detected anomalous SPM-like activity on one of the campus networks, confirmed by the university SOC as malicious. PORTFILER also detected a Mirai attack recreated on the two university networks with higher precision and recall than deeplearning based autoencoder methods.

show abstract

Section: Port Scanning Detectionmentioning

confidence: 99%

PORTFILER: Port-Level Network Profiling for Self-Propagating Malware Detection

Ongun¹,

Spohngellert²,

Miller³

et al. 2021

Preprint

View full text Add to dashboard Cite

show abstract

“…Said et al [159] propose detection of the Mirai using syntactic and behavioral analysis combining binary-level features with dynamic analysis on the host. Raftopoulos et al [146] conduct a study that shows the dangers of the benign-looking port scanning activity on the internet. Ring et al [152] propose a feature-based approach to build both supervised and unsupervised models to detect slow port scans.…”

Section: Related Workmentioning

confidence: 99%