Automated Port-scan Classification with Decision Tree and Distributed Sensors

スポンサーリンク

概要

• 論文の詳細を見る

• Computer worms randomly perform port scans to find vulnerable hosts to intrude over the Internet. Malicious software varies its port-scan strategy, e.g., some hosts intensively perform scans on a particular target and some hosts scan uniformly over IP address blocks. In this paper, we propose a new automated worm classification scheme from distributed observations. Our proposed scheme can detect some statistics of behavior with a simple decision tree consisting of some nodes to classify source addresses with optimal threshold values. The choice of thresholds is automated to minimize the entropy gain of the classification. Once a tree has been constructed, the classification can be done very quickly and accurately. In this paper, we analyze a set of source addresses observed by the distributed 30 sensors in ISDAS for a year in order to clarify a primary statistics of worms. Based on the statistical characteristics, we present the proposed classification and show the performance of the proposed scheme.

• Information and Media Technologies 編集運営会議の論文

著者

• Terada Masato

  Hitachi Incident Response Team (hirt) Hitachi Ltd.

• Kikuchi Hiroaki

  School Of Science And Technology Tokai University

• Fukuno Naoya

  School of Information Technology, Tokai University

• Kobori Tomohiro

  School of Information Technology, Tokai University

• Pikulkaew Tangtisanon

  Faculty of Engineering, King Mongkut's Institute of Technology Ladkrabang

• Kikuchi Hiroaki

  School of Information Technology, Tokai University

• Kikuchi Hiroaki

  School of Information and Network Engineering, Tokai University

• Pikulkaew Tangtisanon

  Faculty of Engineering, King Mongkut's Institute of Technology Ladkrabang

関連論文

• Frequent Sequential Attack Patterns of Malware in Botnets
• Principal Component Analysis of Botnet Takeover
• Estimation of Increase of Scanners Based on ISDAS Distributed Sensors
• Analysis on the Sequential Behavior of Malware Attacks
• Principal Component Analysis of Botnet Takeover
• Perfect Privacy-preserving Automated Trust Negotiation
• Time Zone Correlation Analysis of Malware/Bot Downloads
• Automated Port-scan Classification with Decision Tree and Distributed Sensors
• Mining Botnet Coordinated Attacks using Apriori-PrefixSpan Hybrid Algorithm
• Mining Botnet Coordinated Attacks using Apriori-PrefixSpan Hybrid Algorithm
• Estimation of Increase of Scanners Based on ISDAS Distributed Sensors
• Time Zone Analysis on IIJ Network Traffic for Malicious Botnet Activities

もっと見る 閉じる

スポンサーリンク