On detecting and clustering distributed cyber scanning

摘要: This paper proposes an approach that is composed of two techniques respectively tackle the issues detecting corporate cyber scanning and clustering distributed reconnaissance activity. The first employed technique based on a non-attribution anomaly detection focuses what being scanned rather than who performing scanning. second adopts statistical time series rendered by observing correlation status traffic signal to perform identification clustering. To empirically validate both techniques, we experiment with real network datasets implement proof-of-concept environments. dataset comprises unsolicited one-way telescope/darknet while has been captured in our lab through customized setup. results show, one hand, for class C 250 active hosts 5 monitored servers, proposed technique's training period required stabilization less 1 state memory 80 bytes. Moreover, comparison Snort's sfPortscan technique, it was able detect 4215 unique scans yielded zero false negative. On other correctly identify cluster machines high accuracy even presence legitimate traffic.