A systematic approach for detecting and clustering distributed cyber scanning

摘要: We present in this paper an approach that is composed of two techniques respectively tackle the issues detecting corporate cyber scanning and clustering distributed reconnaissance activity. The first employed technique based on a non-attribution anomaly detection focuses what being scanned rather than who performing scanning. second adopts statistical time series rendered by observing correlation status traffic signal to perform identification clustering. To empirically validate both techniques, we utilize examine real network datasets implement experimental environments. dataset comprises unsolicited one-way telescope/darknet while has been captured our lab through customized setup. results show, one hand, for class C with 250 active hosts 5 monitored servers, training period proposed required stabilization less 1 s state memory 80 bytes. Moreover, comparison Snort's sfPortscan technique, it was able detect 4215 unique scans yielded zero false negative. On other correctly identify cluster machines high accuracy even presence legitimate traffic. further formulating presented scenario as machine learning problem. Specifically, compare unsupervised data k-means expectation maximization approach. authenticate rendering feasible adoption.