Monitoring Network Telescopes and Inferring Anomalous Traffic Through the Prediction of Probing Rates

Abstract

Network reconnaissance is the first step preceding a cyber-attack. Hence, monitoring the probing activities is imperative to help security practitioners enhancing their awareness about Internet's large-scale events or peculiar events targeting their network. In this paper, we present a framework for an improved and efficient monitoring of the probing activities targeting network telescopes. Particularly, we model the probing rates which are a good indicator for measuring the cyber-security risk targeting network services. The approach consists of first inferring groups of network ports sharing similar probing characteristics through a new affinity metric capturing both temporal and semantic similarities between ports. Then, sequences of probing rates targeting similar ports are used as inputs to stacked Long Short-Term Memory (LSTM) neural networks to predict probing rates 1 hour and 1 day in advance. Finally, we describe two monitoring indicators that use the prediction models to infer anomalous probing traffic and to raise early threat warnings. We show that LSTM networks can accurately predict probing rates, outperforming the nonstationary autoregressive model, and we demonstrate that the monitoring indicators are efficient in assessing the cyber-security risk related to vulnerability disclosure.

Detection of Sparse Anomalies in High-Dimensional Network Telescope Signals

“…Another family of methods rely on traffic prediction to detect anomalies. E.g., Zakroum et al [31] infer anomalies on network telescope traffic by predicting probing rates. They present a framework to monitor probing activities targeting network telescopes using Long Short-Term Memory deep learning networks to infer anomalous probing traffic and to raise early threat warnings.…”