Gray's anatomy: dissecting scanning activities using IP gray space analysis

摘要: In this paper, we study the scanning activities towards a large campus network using month-long netflow traffic trace. Based on novel notion of "gray" IP space (namely, collection addresses within our that are not assigned to any "active" host during certain period time), identify and extract potential outside scanners their associated activities. We then apply data mining machine learning techniques analyze patterns these classify them into few groups (e.g., focused hitters, random address scanners, blockwise scanners). The goal is infer strategies so as provide some assessment harmfulness - for example, whether observed simply part background radiation global or more targeted at network. This an on-going work; report preliminary, yet promising results obtained far.