Monitoring Network Telescopes and Inferring Anomalous Traffic Through the Prediction of Probing Rates - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Article Dans Une Revue IEEE Transactions on Network and Service Management Année : 2022

Monitoring Network Telescopes and Inferring Anomalous Traffic Through the Prediction of Probing Rates

Résumé

Network reconnaissance is the first step preceding a cyber-attack. Hence, monitoring the probing activities is im- perative to help security practitioners enhancing their awareness about Internet’s large-scale events or peculiar events targeting their network. In this paper, we present a framework for an improved and efficient monitoring of the probing activi- ties targeting network telescopes. Particularly, we model the probing rates which are a good indicator for measuring the cyber-security risk targeting network services. The approach consists of first inferring groups of network ports sharing similar probing characteristics through a new affinity metric capturing both temporal and semantic similarities between ports. Then, sequences of probing rates targeting similar ports are used as inputs to stacked Long Short-Term Memory (LSTM) neural networks to predict probing rates 1 hour and 1 day in advance. Finally, we describe two monitoring indicators that use the prediction models to infer anomalous probing traffic and to raise early threat warnings. We show that LSTM networks can accurately predict probing rates, outperforming the non- stationary autoregressive model, and we demonstrate that the monitoring indicators are efficient in assessing the cyber-security risk related to vulnerability disclosure
Fichier principal
Vignette du fichier
FINAL VERSION.PDF (1.04 Mo) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03933462 , version 1 (10-01-2023)

Identifiants

Citer

Mehdi Zakroum, Jerome Francois, Isabelle Chrisment, Mounir Ghogho. Monitoring Network Telescopes and Inferring Anomalous Traffic Through the Prediction of Probing Rates. IEEE Transactions on Network and Service Management, 2022, pp.1-1. ⟨10.1109/TNSM.2022.3183497⟩. ⟨hal-03933462⟩
83 Consultations
139 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More