Scanner hunter: understanding HTTP scanning traffic

摘要: This paper focuses on detecting and studying HTTP scanners, which are malicious entities that explore a website selectively for "opportunities" can potentially be used subsequent intrusion attempts. Interestingly, there is practically no prior work the detection of these entities, different from web crawlers or machines performing network-level reconnaissance activities such as port scanning. Detecting scanners challenging they stealthy often only probe few key places website, so finding them needle-in-the-haystack problem. At same time, pose serious risk because perform first, exploratory step to provide seed information may allow hackers compromise website. Our makes two main contributions. First, we propose Scanner Hunter, arguably first method detect efficiently. The novelty success lies in use community structure, an appropriately constructed bipartite graph, order expose groups scanners. rationale aggregated behavior identifying easier than attempting profile label IP addresses individually. Hunter achieves impressive 96.5% precision, roughly twice high precision Machine Learning-based methods reference. Second, extensive study effort understand: (a) their spatial temporal properties, (b) techniques tools by (c) types resources looking for, provides hints what penetration attempt target. We six months worth traffic logs collected 2012 University campus, websites hosted received over 1.9 billion requests 12.8 million IPs. found number non-trivial with 4,000 IPs engaging this type activity per week. will hopefully raise awareness regarding problem while at time promising technique basis mitigating posed