Abstract:As the precursor of cyber-attacks, the campaigns of scanning groups are able to reflect the attack target and attack trend to a great extent, which provide highly valuable threat intelligence for cyber defenders to understand the current cyber security situation. However, how to identify scanning groups in the context of limited information, especially in the absence of relevant threat intelligence, remains a challenging problem. In this paper, we utilize the honeynet as the unique data source to propose a scanning group identification system, Scanner-Hunter, which focuses on identifying scanning groups targeting ICS devices. To better characterize scanning patterns, a novel traffic representation scheme for scanning traffic is proposed, which is composed of a set of feature vectors to describe all the ICS request packets. On this basis, we propose a novel self-expanding multi-class classification (SEMCC) model and the IP prefix judgment, which are deliberately integrated to cope with sophisticated scanning groups. Take the Modbus protocol as an example, we implement a prototype of Scanner-Hunter, and use six years of real-world honeynet datasets to evaluate its performance. The experimental results illustrate its effectiveness and superior performance compared with some popular machine learning methods and existing SOTA scanning group identification methods. In addition, Scanner-Hunter is further leveraged to investigate the group distribution and maliciousness of 506 unknown scanners, and some suspicious attack groups with APT characteristics are analyzed. Furthermore, accurate scanning group information will contribute to revealing potential attack organizations and supporting decision making to prevent or interrupt cyber-attacks in time.

Scan Correlation -- Revealing distributed scan campaigns

Coordinated Web Scan Detection Based on Hierarchical Correlation

Combining cross-correlation and fuzzy classification to detect distributed denial-of-service attacks

Port Scanning Techniques and Analysis of Attack and Defense

Efficient Attack Correlation and Identification of Attack Scenarios based on Network-Motifs

Detecting Coordinated Internet-Wide Scanning by TCP/IP Header Fingerprint

Port Scan Behavior Diagnosis by Clustering

Aggressive Internet-Wide Scanners: Network Impact and Longitudinal Characterization

A Hypothesis Testing Based Scalable TCP Scan Detection.

Scanner-Hunter: An Effective ICS Scanning Group Identification System

Detection of Sparse Anomalies in High-Dimensional Network Telescope Signals

Alert Correlation by A Retrospective Method

Seeing the Attack Paths: Improved Flow Correlation Scheme in Stepping-Stone Intrusion

Mining Attack Correlation Scenarios Based On Multi-Agent System

An Adaptive Algorithm to Detect Port Scans

An Iterative and Toolchain-Based Approach to Automate Scanning and Mapping Computer Networks

Global Abnormal Correlation Analysis for DDoS Attack Detection

Intrusion Alerts Correlation Based Assessment of Network Security

An Algorithm of Alert Correlation Based on Address Correlation Graph in Distributed Intrusion Detection System

Detecting Distributed Network Traffic Anomaly with Network-Wide Correlation Analysis

An Anomaly Detection and Analysis Method for Network Traffic Based on Correlation Coefficient Matrix.