Loading...
Automated classification of port-scans from distributed sensors
Author(s)
Kikuchi, Hiroaki
Fukuno, Naoya
Kobori, Tomohiro
Terada, Masato
Pikulkaew, Tangtisanon
Date Issued
September 1, 2008
Type
Conference Paper
Abstract
Computer worms randomly perform port-scans to find vulnerable hosts to intrude over the Internet. Malicious software varies its port-scan strategy, e.g., some hosts intensively perform scans on a particular target and some hosts scan uniformly over IP address blocks. In this paper, we propose a new automated worm classification scheme from distributed observations. Our proposed scheme can detect some statistics of worm behavior with a simple decision tree consisting of some nodes to classify source addresses with optimal threshold values. The choice of thresholds is automated to minimize the entropy gain of classification. Once a tree is constructed, the classification can be done very quickly and accurately. In this paper, we analyze a set of source addresses observed by the distributed sensors in ISDAS observed with 30 sensors in one year in order to clarify a primary statistics of worms. Based on the statistical characteristics, we present the proposed classification and show the performance of the proposed scheme. © 2008 IEEE.
Citation
Proceedings International Conference on Advanced Information Networking and Applications AINA, 771-778, 2008