Estimation of Increase of Scanners Based on ISDAS Distributed Sensors

スポンサーリンク

概要

• 論文の詳細を見る

• Given independent multiple access logs we develop a mathematical model to identify the number of malicious hosts in the current Internet. In our model the number of malicious hosts is formalized as a function taking two inputs namely the duration of observation and the number of sensors. Assuming that malicious hosts with statically assigned global addresses perform random port scans to independent sensors uniformly distributed over the address space our model gives the asymptotic number of malicious source addresses in two ways. Firstly it gives the cumulative number of unique source addresses in terms of the duration of observation. Secondly it estimates the cumulative number of unique source addresses in terms of the number of sensors. To evaluate the proposed method we apply the mathematical model to actual data packets observed by ISDAS distributed sensors over a one-year duration from September 2004 and check the accuracy of identification of the number of malicious hosts^*1.

• 一般社団法人情報処理学会の論文
• 2008-09-15

著者

• Hiroaki Kikuchi

  School of Information and Network Engineering, Tokai University

• Masato Terada

  Hitachi, Ltd. Hitachi Incident Response Team (HIRT)

• Masato Terada

  Hitachi Ltd. Hitachi Incident Response Team (hirt)

• Hiroaki Kikuchi

  Tokai University

• Naoya Fukuno

  School of Information Technology Tokai University

• Norihisa Doi

  Facility of Science and Engineering Chuo University

関連論文

• Principal Component Analysis of Port-scans for Reduction of Distributed Sensors
• Frequent Sequential Attack Patterns of Malware in Botnets
• Frequent Sequential Attack Patterns of Malware in Botnets
• Automated Port-scan Classification with Decision Tree and Distributed Sensors
• Estimation of Increase of Scanners Based on ISDAS Distributed Sensors
• Principal Component Analysis of Botnet Takeover
• Perfect Privacy-preserving Automated Trust Negotiation
• Mining Botnet Coordinated Attacks using Apriori-PrefixSpan Hybrid Algorithm (Preprint)

スポンサーリンク