A Statistical Approach for Fingerprinting Probing Activities

摘要: Probing is often the primary stage of an intrusion attempt that enables attacker to remotely locate, target, and subsequently exploit vulnerable systems. This paper attempts investigate whether perceived traffic refers probing activities which exact scanning technique being employed perform probing. Further, this work strives examine dimensions infer `machinery' scan, activity generated from a software tool or worm/bot net random follows certain predefined pattern. Motivated by recent cyber attacks were facilitated through probing, limited security intelligence related mentioned inferences lack accuracy provided detection systems, presents new approach fingerprint activity. The leverages number statistical techniques, probabilistic distribution methods observations in understand analyze activities. To prevent evasion, formulates matter as change point problem yielded motivating results. Evaluations performed using 55 GB real dark shows extracted exhibit promising can generate significant insights could be used for mitigation purposes.