1. Remote Identification of Port Scan Toolchains
- Author
-
Ghiëtte, Vincent, Blenn, N., Dörr, C., Badra, Mohamad, Pau, Giovanni, and Vassiliou, Vasos
- Subjects
threat intelligence ,Exploit ,port scan ,Network packet ,Network security ,business.industry ,Computer science ,020206 networking & telecommunications ,02 engineering and technology ,Adversary ,Computer security ,computer.software_genre ,Port (computer networking) ,Identification (information) ,Port mirroring ,020204 information systems ,0202 electrical engineering, electronic engineering, information engineering ,business ,Host (network) ,computer ,Computer network - Abstract
Port scans are typically at the begin of a chain of events that will lead to the attack and exploitation of a host over a network. Since building an effective defense relies on information what kind of threat an organization is facing, threat intelligence outlining an actor’s modus operandi is a critical ingredient for network security. In this paper, we describe characteristic patterns in port scan packets that can be used to identify the tool chain used by an adversary. In an empirical analysis of scan traffic received by two /16 networks, we find that common open source port scan tools are adopted differently by communities across the globe, and that groups specializing to use a particular tool have also specialized to exploit particular services.
- Published
- 2016
- Full Text
- View/download PDF