Abstract:The cybersecurity landscape presents daunting challenges, particularly in the face of Denial of Service (DoS) attacks such as DoS Http Unbearable Load King (HULK) attacks and DoS GoldenEye attacks. These malicious tactics are designed to disrupt critical services by overwhelming web servers with malicious requests. In contrast to DoS attacks, there exists nefarious Operating System (OS) scanning, which exploits vulnerabilities in target systems. To provide further context, it is essential to clarify that NMAP, a widely utilized tool for identifying host OSes and vulnerabilities, is not inherently malicious but a dual-use tool with legitimate applications, such as asset inventory services in company networks. Additionally, Domain Name System (DNS) botnets can be incredibly damaging as they harness numerous compromised devices to inundate a target with malicious DNS traffic. This can disrupt online services, leading to downtime, financial losses, and reputational damage. Furthermore, DNS botnets can be used for other malicious activities like data exfiltration, spreading malware, or launching other cyberattacks, making them a versatile tool for cybercriminals. As attackers continually adapt and modify specific attributes to evade detection, our paper introduces an automated detection method that requires no expert input. This innovative approach identifies the distinct characteristics of DNS botnet attacks, DoS HULK attacks, DoS GoldenEye attacks, and OS-Scanning, explicitly using the NMAP tool, even when attackers alter their tactics. By harnessing a representative dataset, our proposed method ensures robust detection of such attacks against varying attack parameters or behavioral shifts. This heightened resilience significantly raises the bar for attackers attempting to conceal their malicious activities. Significantly, our approach delivered outstanding outcomes, with a mid 95% accuracy in categorizing NMAP OS scanning and DNS botnet attacks, and 100% for DoS HULK attacks and DoS GoldenEye attacks, proficiently discerning between malevolent and harmless network packets. Our code and the dataset are made publicly available.

Coordinated Web Scan Detection Based on Hierarchical Correlation

Scan Correlation -- Revealing distributed scan campaigns

Combining cross-correlation and fuzzy classification to detect distributed denial-of-service attacks

K-Means Clustering Analysis Based On Adaptive Weights For Malicious Code Detection

Scanner-Hunter: An Effective ICS Scanning Group Identification System

Group Testing Based Detection of Web Service DDoS Attackers.

A Coordinated Worm Detection Method Based on Local Nets

Detecting Coordinated Internet-Wide Scanning by TCP/IP Header Fingerprint

A Hierarchical Security Events Correlation Model for Real-time Cyber Threat Detection and Response

An alert correlating algorithm based on multi-step attack path graphs:MSACA

A Distributed Anomaly Detection Scheme Based on Correlation Awareness in WSN

MAAC: Novel Alert Correlation Method To Detect Multi-step Attack

Automated Network Incident Identification through Genetic Algorithm-Driven Feature Selection

Web Phishing Detection Based On Page Spatial Layout Similarity

<sc>Poirot</sc>: Causal Correlation Aided Semantic Analysis for Advanced Persistent Threat Detection

An Unsupervised-Learning Based Method for Detecting Groups of Malicious Web Crawlers in Internet

Mining Network Traffic with the k -Means Clustering Algorithm for Stepping-Stone Intrusion Detection

Port Scan Behavior Diagnosis by Clustering

A network intrusion detection method based on semantic Re-encoding and deep learning

A Cooperative Detection of DDoS attacks based on CNN-BiLSTM in SDN

Detection of excessive activities in time series of graphs