NDLI: Towards Situational Awareness of Large-Scale Botnet Probing Events

Content Provider	IEEE Xplore Digital Library
Author	Zhichun Li Goyal, A. Yan Chen Paxson, V.
Copyright Year	2005
Abstract	Botnets dominate today's attack landscape. In this work, we investigate ways to analyze collections of malicious probing traffic in order to understand the significance of large-scale “botnet probes.” In such events, an entire collection of remote hosts together probes the address space monitored by a sensor in some sort of coordinated fashion. Our goal is to develop methodologies by which sites receiving such probes can infer-using purely local observation-information about the probing activity: What scanning strategies does the probing employ? Is this an attack that specifically targets the site, or is the site only incidentally probed as part of a larger, indiscriminant attack? Our analysis draws upon extensive honeynet data to explore the prevalence of different types of scanning, including properties, such as trend, uniformity, coordination, and darknet avoidance. In addition, we design schemes to extrapolate the global properties of scanning events (e.g., total population and target scope) as inferred from the limited local view of a honeynet. Cross-validating with data from DShield shows that our inferences exhibit promising accuracy.
Sponsorship	IEEE Signal Processing Society
Starting Page	175
Ending Page	188
Page Count	14
File Size	987644
File Format	PDF
ISSN	15566013
Volume Number	6
Issue Number	1
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2011-03-01
Publisher Place	U.S.A.
Access Restriction	One Nation One Subscription (ONOS)
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Grippers Protocols Probes Security IP networks Redundancy Testing statistical inference Botnet computer network security global property extrapolation honeynet scan strategy inference site security monitoring situational awareness
Content Type	Text
Resource Type	Article
Subject	Computer Networks and Communications Safety, Risk, Reliability and Quality

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Automating analysis of large-scale botnet probing events

Towards Realization of Large-Scale Botnet Probing Events

Realization of comprehensive Botnet inquisitive actions

Towards situational awareness of large-scale botnet probing events (2010).

Towards realization of large-scale botnet probing events.

A Large-Scale Empirical Study of Conficker

An Extraction Method of Situational Factors for Network Security Situational Awareness

Towards automating analysis of large-scale honeynet events.

The Internet Network Topology Probing Method Based on Classified Strategy

Towards Situational Awareness of Large-Scale Botnet Probing Events

Similar Documents

Automating analysis of large-scale botnet probing events

Towards Realization of Large-Scale Botnet Probing Events

Realization of comprehensive Botnet inquisitive actions

Towards situational awareness of large-scale botnet probing events (2010).

Towards realization of large-scale botnet probing events.

A Large-Scale Empirical Study of Conficker

An Extraction Method of Situational Factors for Network Security Situational Awareness

Towards automating analysis of large-scale honeynet events.

The Internet Network Topology Probing Method Based on Classified Strategy

Towards Situational Awareness of Large-Scale Botnet Probing Events