Scanning the Scanners

Richter, Philipp; Berger, Arno

doi:10.1145/3355369.3355595

Cited by 47 publications

(4 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This mechanism results in the possibility of multiple routing paths between two nodes. For example, there are two routing paths from Node 1 to Node 3, [1,3] and [1,2,3]. A similar situation exists from Node 2 to Node 8, as indicated by the dashed arrows in Fig.…”

Section: Multipath Routing and Repeat Nodesmentioning

confidence: 89%

Stop-probability-based network topology discovery method

Yuguang,

Zhiyong,

Wei

et al. 2024

IEICE Trans. Commun.

View full text Add to dashboard Cite

Using a limited number of probes has always been a focus in interface-level network topology probing to discover complete network topologies. Stop-set-based network topology probing methods significantly reduce the number of probes sent but suffer from the side effect of incomplete topology information discovery. This study proposes an optimized probing method based on stop probabilities (SPs) that builds on existing stop-set-based network topology discovery methods to address the issue of incomplete topology information owing to multipath routing. The statistics of repeat nodes (RNs) and multipath routing on the Internet are analyzed and combined with the principles of stop-set-based probing methods, highlighting that stopping probing at the first RN compromises the completeness of topology discovery. To address this issue, SPs are introduced to adjust the stopping strategy upon encountering RNs during probing. A method is designed for generating SPs that achieves high completeness and low cost based on the distribution of the number of RNs. Simulation experiments demonstrate that the proposed stop-probability-based probing method almost completely discovers network nodes and links across different regions and times over a two-year period, while significantly reducing probing redundancy. In addition, the proposed approach balances and optimizes the trade-off between complete topology discovery and reduced probing costs compared with existing topology probing methods. Building on this, the factors influencing the probing cost of the proposed method and methods to further reduce the number of probes while ensuring completeness are analyzed. The proposed method yields universally applicable SPs in the current Internet environment.

show abstract

Section: Multipath Routing and Repeat Nodesmentioning

confidence: 89%

Stop-probability-based network topology discovery method

Yuguang,

Zhiyong,

Wei

et al. 2024

IEICE Trans. Commun.

View full text Add to dashboard Cite

show abstract

“…Network telescopes. Network telescopes [4]- [9] are an unsolicited traffic measurement approach that captures incoming traffic to otherwise unused address space within a larger network segment. These typically cover between a /8 and /24 of IPv4 address space.…”

Section: Honeypots and Network Telescopesmentioning

confidence: 99%

SoK: A Data-driven View on Methods to Detect Reflective Amplification DDoS Attacks Using Honeypots

Nawrocki¹,

Kristoff²,

Hiesgen³

et al. 2023

Preprint

View full text Add to dashboard Cite

In this paper, we revisit the use of honeypots for detecting reflective amplification attacks. These measurement tools require careful design of both data collection and data analysis including cautious threshold inference. We survey common amplification honeypot platforms as well as the underlying methods to infer attack detection thresholds and to extract knowledge from the data. By systematically exploring the threshold space, we find most honeypot platforms produce comparable results despite their different configurations. Moreover, by applying data from a large-scale honeypot deployment, network telescopes, and a real-world baseline obtained from a leading DDoS mitigation provider, we question the fundamental assumption of honeypot research that convergence of observations can imply their completeness. Conclusively we derive guidance on precise, reproducible honeypot research, and present open challenges.

show abstract

“…To combat reconnaissance attacks, researchers have developed methods, such as tracking port scanners on the IP backbone [136], detecting subtle port scanning via interactive visualization [154], disrupting reconnaissance attacks via address mutation [64], constructing distributed network telescope to capture scanners [121], and optimizing backscatter [45] technique for scan detection in massive IPv6 address space [46]. However, according to [57], [34], only a few enterprises have practically adopted robust defensive measures.…”

Section: A Reconnaissance Attacksmentioning

confidence: 99%