Authors:
Chansu Han
1
;
Akira Tanaka
1
;
Jun’ichi Takeuchi
2
;
Takeshi Takahashi
1
;
Tomohiro Morikawa
3
and
Tsung-Nan Lin
4
Affiliations:
1
National Institute of Information and Communications Technology, Tokyo, Japan
;
2
Kyushu University, Fukuoka, Japan
;
3
University of Hyogo, Hyogo, Japan
;
4
National Taiwan University, Taipei, Taiwan, Republic of China
Keyword(s):
Darknet Analysis, Scanning Campaign, Tracing, Non-Negative Matrix Factorization.
Abstract:
The darknet is an unused IP address space that can be an effective resource for observing and analyzing global indiscriminate scanning attacks. Scanning traffic on the darknet has expanded dramatically in recent years and numerous constant scans for investigative purposes have been observed. This is problematic because the investigative scans identified by naive rules account for about 60% of the total observed traffic. In earlier work, we detected malware-caused indiscriminate scanning for attack purposes from darknet data by means of anomaly detection methods, but the large amount of activity from investigation-purpose indiscriminate scans led to false positives. We have therefore developed a new method for tracing scanning campaigns. By distinguishing whether the campaign being traced is for attack or investigation purposes, we aim to reduce the number of false positives and improve anomaly detection accuracy. We also intend to clarify the actual state of constant scanner groups b
y tracing them. In this work, we describe the proposed method, implement a prototype, and conduct experiments on real darknet data to investigate the feasibility of tracing scanning campaigns.
(More)