Abstract:Adversaries perform port scanning to discover accessible and vulnerable hosts as a prelude to cyber havoc. A darknet is a cyberattack observation network to capture these scanning activities through reachable yet unused IP addresses. However, the enormous amount of packets and superposition of diverse scanning strategies prevent extracting significant insights from the aggregate traffic. Some coordinated scanners disperse probe packets whose TCP/IP header follows a unique pattern to determine whether the received packets are valid responses to their probes or are part of other background traffic. We call such a pattern a fingerprint. For example, a probe packet from a Mirai-infected host satisfies a pattern whereby the destination IP address equals the sequence number. A fingerprint indicates that the source host has been involved in a particular scanning campaign. Although some fingerprints have been discovered and known to the public, there are and will be more undiscovered ones. We intend to unveil these fingerprints. Our preliminary work automatically identified flexible fingerprints but overlooked low-rate and coordinated scanners. In this work, we improved the fingerprint identifier, enabling it to detect these stealth scans. Moreover, we revealed the scans’ objectives by investigating destination port sets. We associated fingerprints with threat intelligence and verified their reliability. Our approach identified all well-known and eight unknown fingerprints on one month’s worth of darknet data collected from about three-hundred thousand unused IP addresses. We disclosed the fingerprints of the Mozi botnet and destination port sets that were previously unreported.

Remote OS Detection Based on TCP/IP Stack Fingerprinting

Remote OS Identification Based on TCP Options

Design and Implementation of a Datagrams Retransmission Timeout Based OS Fingerprinting Technique

Port Scanning Techniques and Analysis of Attack and Defense

Os Fingerprinting and Tethering Detection in Mobile Networks

Detection and Response of Low-Rate TCP-targeted Denial of Service Attacks

Detecting Coordinated Internet-Wide Scanning by TCP/IP Header Fingerprint

Study on os fingerprinting and nat/tethering based on dns log analysis

Network Intrusion Detection Method Based on Rough Set Theory

Detect Malicious Attacks from Entire TCP Communication Process

Detecting Remote Access Trojans Through External Control at Area Network Borders

Retransmission-based TCP Fingerprints for Fine-grain IoV Edge Devices Identification

Exploiting Cross-Layer Vulnerabilities: Off-Path Attacks on the TCP/IP Protocol Suite

Detecting SYN Flooding Agents under Any Type of IP Spoofing

A Fingerprinting Method Based on SSL

A Hypothesis Testing Based Scalable TCP Scan Detection.

Detection of Trojan Covert Communication Based on Client Honeypot

An Intruder Locating System Based on Network Intrusion Detection

A Method of IP Traceback Against DDoS Attack

Understanding and Detecting Remote Infection on Linux-based IoT Devices

Design and Implementation of OSPF Vulnerability Analysis and Detection System