Network forensic system for port scanning attack

Kaushik, Atul Kant; Pilli, Emmanuel S.; Joshi, Rohit

doi:10.1109/iadcc.2010.5422935

Cited by 17 publications

(6 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…• Perimeter monitoring logs: Logs can reveal scanning attempts (Kaushik et al 2010) on layer 3 and 4 from a certain IP range and/or botnet which significantly exceed the usual noise (Li et al 2009…”

Section: Reconnaissance Artifactsmentioning

confidence: 99%

Under false flag: using technical artifacts for cyber attack attribution

Skopik

Pahi

2020

Cybersecur

View full text Add to dashboard Cite

The attribution of cyber attacks is often neglected. The consensus still is that little can be done to prosecute the perpetrators-and unfortunately, this might be right in many cases. What is however only of limited interest for the private industry is in the center of interest for nation states. Investigating if an attack was carried out in the name of a nation state is a crucial task for secret services. Many methods, tools and processes exist for network-and computer forensics that allow the collection of traces and evidences. They are the basis to associate adversarial actions to threat actors. However, a serious problem which has not got the appropriate attention from research yet, are false flag campaigns, cyber attacks which apply covert tactics to deceive or misguide attribution attempts-either to hide traces or to blame others. In this paper we provide an overview of prominent attack techniques along the cyber kill chain. We investigate traces left by attack techniques and which questions in course of the attribution process are answered by investigating these traces. Eventually, we assess how easily traces can be spoofed and rate their relevancy with respect to identifying false flag campaigns.

show abstract

Section: Reconnaissance Artifactsmentioning

confidence: 99%

Under false flag: using technical artifacts for cyber attack attribution

Skopik

Pahi

2020

Cybersecur

View full text Add to dashboard Cite

show abstract

“…al. [3] proposes network forensic system architecture to perform investigation of network attack, proposed architecture composed of three modules-Capturing module, Analysis Module and Presentation module. Capturing module is responsible to captures the packets from network interface card and mark the packets that are relevant for further analysis.…”

Section: Literature Reviewmentioning

confidence: 99%

A Network Forensic Framework for Port Scan Attack based on Efficient Packet Capturing

Makwana¹,

Tomar²

2019

IJITEE

View full text Add to dashboard Cite

In the last two decades the networks become larger in scale, more complex in structure and more diversified in traffic. Which generate huge amount of network packets such as TCP, UDP and HTTP etc. Log files are repository for captured packets and play a vital role in investigation. However, a significant and obvious limitation of current packet logging is that, data storage volume increases rapidly depending on factors such as network bandwidth and the number of points in the network that need to be tapped. Forensic investigator needs to back up these recorded data to free up recording media and to preserve the data for future analysis. The objective of the proposed work is to build a network forensics framework that precisely scrutinizes only the relevant packets .In this work, a network forensic framework is developed subjected to port scanning attack to mitigate evidence gathering challenges faced by forensic investigator. It captures and processes only fine-grained evidences present in the network traffic stream. Moreover, in the captured relevant log, attack specific discovery is carried out to mine the exact packets utilized to execute the network attack. Hypotheses being developed to validate each machine against attack specific criteria’s. Only those machine who full fill the criteria will be scrutinizes for further analysis. To test and validate the effectiveness of the proposed framework two scenario have been developed, It is observed that developed system preciously securitizes the attack patterns and improved decrement in the log size is observed for both scenario developed that is about 93.12% and 95.65% respectively. It is also observed that only 6.09% and 1.93% of total traffic being scrutinized for NULL, FIN and XMAS attack in scenario 1 and 2 respectively. Similarly 19.88% and 13.42% packets of total packets are scrutinized for TCP Connect and SYN (Half open) scanning variant in scenario 1 and 2 respectively

show abstract

“…However, high data rate of network traffic creates difficulties for network forensics in the capture and preservation of all network packets [10]. Kaushik, through scanning ports, found that attackers could find potential loopholes and then use these vulnerabilities to attack hosts [11]. Roussev et al outlined a method of collecting relevant data by utilizing latency-optimized target acquisition (LOTA) whereby the data is collected sequentially without the need for continually seeking to locate data [12].…”

Section: Related Workmentioning

confidence: 99%

Network Forensics Method Based on Evidence Graph and Vulnerability Reasoning

Chang

Peng

et al. 2016

Future Internet

View full text Add to dashboard Cite

As the Internet becomes larger in scale, more complex in structure and more diversified in traffic, the number of crimes that utilize computer technologies is also increasing at a phenomenal rate. To react to the increasing number of computer crimes, the field of computer and network forensics has emerged. The general purpose of network forensics is to find malicious users or activities by gathering and dissecting firm evidences about computer crimes, e.g., hacking. However, due to the large volume of Internet traffic, not all the traffic captured and analyzed is valuable for investigation or confirmation. After analyzing some existing network forensics methods to identify common shortcomings, we propose in this paper a new network forensics method that uses a combination of network vulnerability and network evidence graph. In our proposed method, we use vulnerability evidence and reasoning algorithm to reconstruct attack scenarios and then backtrack the network packets to find the original evidences. Our proposed method can reconstruct attack scenarios effectively and then identify multi-staged attacks through evidential reasoning. Results of experiments show that the evidence graph constructed using our method is more complete and credible while possessing the reasoning capability.

show abstract

Network forensic system for port scanning attack

Cited by 17 publications

References 4 publications

Under false flag: using technical artifacts for cyber attack attribution

Under false flag: using technical artifacts for cyber attack attribution

A Network Forensic Framework for Port Scan Attack based on Efficient Packet Capturing

Network Forensics Method Based on Evidence Graph and Vulnerability Reasoning

Contact Info

Product

Resources

About