ShoVAT: Shodan‐based vulnerability assessment tool for Internet‐facing services

Genge, Béla; Enăchescu, Călin

doi:10.1002/sec.1262

Cited by 82 publications

(39 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There are diverse algorithms ranging from simple keyword matching to similarity analysis. To detect vulnerabilities like Heartbleed and Poodle, Shodan and Censys find the OpenSSL version information from the collected traffic and match it with the relevant vulnerability information for analysis [17][18].…”

Section: Technology For Analyzing Security Vulnerability Informationmentioning

confidence: 99%

The Internet-Connected Device Vulnerability Information Management System in IoT Environment

Kim¹

2019

IJITBD

View full text Add to dashboard Cite

Recently, the performance of wireless communication and small devices has greatly improved. As these technologies and environments change, there is a growing number of services that utilize various types of IoT devices. Devices such as small sensors and CCTVs that were used offline are being connected to the Internet. However, a large number of IoT devices use an open-source with no security function. In addition, network equipment such as switches and gateways, which have been used for a long time, is also used with many vulnerabilities because users do not have regular updates. Such weak devices are connected to the Internet and operating, making them vulnerable to malicious attackers. In this paper, we propose a system for collecting Internet-connected device information and identifying and managing vulnerability information by utilizing Internet-Wide Scan technology.

show abstract

Section: Technology For Analyzing Security Vulnerability Informationmentioning

confidence: 99%

The Internet-Connected Device Vulnerability Information Management System in IoT Environment

Kim¹

2019

IJITBD

View full text Add to dashboard Cite

show abstract

“…Shovat [21] is a passive vulnerability analysis tool developed by Petru Maior University in Romania with the Shodan engine. Shovat takes the output of traditional Shodan queries and performs an in-depth analysis of service-specific data, such as service banners.…”

Section: Preliminary Research Related To Internet-wide Scanningmentioning

confidence: 99%

An Intelligent Improvement of Internet-Wide Scan Engine for Fast Discovery of Vulnerable IoT Devices

Kim¹,

Kim²,

Jang³

2018

Symmetry

View full text Add to dashboard Cite

Since 2016, Mirai and Persirai malware have infected hundreds of thousands of Internet of Things (IoT) devices and created a massive IoT botnet, which caused distributed denial of service (DDoS) attacks. IoT malware targets vulnerable IoT devices, which are vulnerable to security risks. Techniques are needed to prevent IoT devices from being exploited by attackers. However, unlike high-performance PCs, IoT devices are lightweight, low-power, and low-cost, having performance limitations regarding processing and memory, which makes it difficult to install security and anti-malware programs. Recently, several studies have been attempted to quickly search for vulnerable internet-connected devices to solve this real issue. Issues yet to be studied still exist regarding these types of internet-wide scan technologies, such as filtering by security devices and a shortage of collected operating system (OS) information. This paper proposes an intelligent internet-wide scan model that improves IP state scanning with advanced internet protocol (IP) randomization, reactive protocol (port) scanning, and OS fingerprinting scanning, applying k* algorithm in order to find vulnerable IoT devices. Additionally, we describe the experiment's results compared to the existing internet-wide scan technologies, such as ZMap and Shodan. As a result, the proposed model experimentally shows improved performance. Although we improved the ZMap, the throughput per minute (TPM) performance is similar to ZMap without degrading the IP scan throughput and the performance of generating a single IP address is about 118% better than ZMap. In the protocol scan performance experiments, it is about 129% better than the Censys based ZMap, and the performance of OS fingerprinting is better than ZMap, with about 50% accuracy.

show abstract

“…6, this results in significant changes of routing decisions in the two domains. To start with, flows 2, 7, 12 are migrated to Link9, flow 6 is migrated to Link10, while flows 1, 3,8,9,11 are migrated to Link11. Next, we create two disturbances in the network topology.…”

Section: B Multi-domain Scenariomentioning

confidence: 99%

“…This will provide the building blocks for novel infrastructural paradigms, and will facilitate innovative applications such as robust voltage control, renewable energy programs, and electric vehicles. Despite these clear advantages, however, the pervasive integration of commodity off the shelf ICT hardware and software will also expose ICS to new threats [1], [2], [3]. These may have a significant impact on the functioning of critical infrastructures, e.g., the power grid, and may lead to the failure of services, to economic and, possibly, to human losses.…”

Section: Introductionmentioning

confidence: 99%

A hierarchical control plane for software-defined networks-based industrial control systems

Genge

Haller

2016

2016 IFIP Networking Conference (IFIP Networking) and Workshops

View full text Add to dashboard Cite

Modern Industrial Control Systems (ICS) integrate advanced solutions from the field of traditional IP networks, i.e., Software-Defined Networks (SDN), in order to increase the security and resilience of communication infrastructures. Despite their clear advantages, such solutions also expose ICS to common cyber threats that may have a dramatic impact on the functioning of critical infrastructures, e.g., the power grid. As a response to these issues, this work develops a novel hierarchical SDN control plane for ICS. The approach builds on the features of a novel SDN controller named OptimalFlow that redesigns the network according to the solutions delivered by an integer linear programming (ILP) optimization problem. The developed ILP problem encapsulates a shortest path routing objective and harmonizes ICS flow requirements including quality of service, security of communications, and reliability. OptimalFlow exposes two communication interfaces to enable a hierarchical control plane. Its northbound interface reduces a complete switch infrastructure to an emulated (software) switch, while its southbound interface connects to an OpenFlow controller to enable the monitoring and control of real/emulated switches. Extensive experimental and numerical results demonstrate the effectiveness of the developed scheme.

show abstract

ShoVAT: Shodan‐based vulnerability assessment tool for Internet‐facing services

Cited by 82 publications

References 15 publications

The Internet-Connected Device Vulnerability Information Management System in IoT Environment

The Internet-Connected Device Vulnerability Information Management System in IoT Environment

An Intelligent Improvement of Internet-Wide Scan Engine for Fast Discovery of Vulnerable IoT Devices

A hierarchical control plane for software-defined networks-based industrial control systems

Contact Info

Product

Resources

About