A Time Series Approach for Inferring Orchestrated Probing Campaigns by Analyzing Darknet Traffic

摘要: This paper aims at inferring probing campaigns by investigating dark net traffic. The latter events refer to a new phenomenon of reconnaissance activities that are distinguished their orchestration patterns. objective is provide systematic methodology infer, in prompt manner, whether or not the perceived packets belong an orchestrated campaign. Additionally, could be easily leveraged generate network traffic signatures facilitate capturing incoming as belonging same inferred Indeed, this would utilized for early cyber attack warning and notification well simplified analysis tracking such events. To realize goals, proposed approach models challenging task problem interpolating predicting time series with missing values. By initially employing trigonometric interpolation subsequently executing state space modeling conjunction time-varying window algorithm, able pinpoint only monitoring few flows. We empirically evaluate effectiveness model using 330 GB real data. comparing outcome previously validated work, results indeed demonstrate promptness accuracy approach.