Passive Remote Source NAT Detection Using Behavior Statistics Derived from NetFlow

Abstract

Network Address Translation (NAT) is a technique commonly employed in today's computer networks. NAT allows multiple devices to hide behind a single IP address. From a network management and security point of view, NAT may not be desirable or permitted as it allows rogue and unattended network access. In order to detect rogue NAT devices, we propose a novel passive remote source NAT detection approach based on behavior statistics derived from NetFlow. Our approach utilizes 9 distinct features that can directly be derived from Net-Flow records. Furthermore, our approach does not require IP address information, but is capable of operating on anonymous identifiers. Hence, our approach is very privacy friendly. Our approach requires only a 120 seconds sample of NetFlow records to detect NAT traffic within the sample with a lower-bound accuracy of 89.35%. Furthermore, our approach is capable of operating in real-time.

Supervised Learning-Based Fast, Stealthy, and Active NAT Device Identification Using Port Response Patterns

“…Their algorithm exhibited an accuracy of 75%. Abt et al [10] proposed a C4.5 DT algorithm based on flow information such as the IP addresses and port numbers of sender and receiver, protocol, and number of bytes and packets exchanged on an IP address. The method resulted in an accuracy of 89%.…”

“…In [8], a method to detect NATDs and the NATHs behind them by using IP TTLs and HTTP user-agent strings is proposed. Methods to identify NATDs and NATHs using machine learning techniques based on packet sequences are proposed in [9][10][11][12]. Most of these passive methods presented their NATD identification methods as parts of techniques for counting the NATHs behind an NATD.…”

Enhancing Network Security: Host Trustworthiness Estimation

“…To the best of our knowledge, there is a lack of literature on flow-based host identification. There is literature on user identification [13] and on means for passive OS fingerprinting or NAT detection [11,1], though. Further, we consider to implement some results of host classification research, such as detecting type of the host [9].…”