Passive NAT detection using HTTP access logs

摘要: Network devices performing Address Translation (NAT) overcome the problem of deficit IPv4 addresses as well introduce a vulnerability to network with possibly insecure configurations. Therefore detection unauthorized NAT is an important task in security domain. In this paper, novel passive algorithm proposed that identifies using statistical behavior analysis. We model hosts eight features extracted from HTTP access logs. These are collected within consecutive non-overlapping time windows covering last 24 hours. To classify whether host device or end (non-NAT device) pre-trained linear classifier used. Since labeled data for training purposes hard obtain, we also propose way how generate unlabeled traffic On basis our experimental evaluation, outperforms state-of-the-art solution represented by [3].