Multidimensional investigation of source port 0 probing

摘要: During November 2013, the operational cyber/network security community reported an unprecedented increase of traffic originating from source port 0. This event was deemed as malicious although its core aim and mechanism were obscured. paper investigates that using a multifaceted approach leverages three real network feeds we receive on daily basis, namely, darknet, passive DNS malware data. The goal is to analyze such perspectives those in order generate significant insights inferences could contribute disclosing inner details incident. extracts subsequently fingerprints received darknet By executing unsupervised machine learning techniques extracted traffic, disclose clusters activities share similar machinery. Further, by employing set statistical-based behavioral analytics, capture mechanisms clusters, including their strategies, nature. We consequently correlate sources with investigate maliciousness. Moreover, examine if are contaminated, execute correlation between data feeds. outcome reveals indeed reconnaissance/probing different horizontal scans utilizing packets TCP header length 0 or odd flag combinations. results well demonstrate 28% scanning host malicious/blacklisted domains they often used for spamming, phishing other fraud activities. Additionally, portrays bot probing infected 'Virus.Win32.Sality'. correlating various evidence, confirm specimen fact responsible part event. concur this work first attempt ever comprehend machinery unique hope consider it building block auxiliary analysis investigation.