How Dangerous Is Internet Scanning? - A Measurement Study of the Aftermath of an Internet-Wide Scan
How Dangerous Is Internet Scanning? - A Measurement Study of the Aftermath of an Internet-Wide Scan
复制标题
互联网扫描有多危险？
DOI：
10.1007/978-3-319-17172-2_11
复制
发表时间：
2015
期刊：
影响因子：
--
通讯作者：
A. Dainotti
中科院分区：
文献类型：
--
作者：
Elias Raftopoulos;E. Glatz;X. Dimitropoulos;A. Dainotti
互联网扫描是一种事实上的背景交通噪音，不清楚它是否构成危险的威胁，即，被扫描的主机会发生什么？扫描的成功率是多少？以及该问题是否值得投入大量精力和金钱来缓解，例如，通过过滤不需要的流量在这项工作中，我们首先考虑到互联网扫描的角度来看，扫描repliers使用一个独特的组合的数据集，使我们能够估计有多少主机回答扫描仪，以及他们是否随后在一个实际的网络攻击。为了包含我们的分析，我们专注于一个特定的有趣的扫描事件，这是由Sality僵尸网络在2011年2月期间精心策划的，它扫描了整个IPv4地址空间。通过分析未采样的NetFlow记录，我们发现2%的被扫描主机实际上回复了扫描器。此外，通过将扫描回复与来自同一网络的IDS警报相关联，我们发现，响应器随后发生了重大的利用活动，最终导致估计有8%的响应器受损。这些观察结果表明，互联网扫描是危险的：在我们的大学网络中，至少有142个被扫描的主机最终受到损害。在世界范围内，响应研究事件而受到损害的主机数量可能要大得多。
Internet scanning is a de facto background traffic noise that is not clear if it poses a dangerous threat, i.e., what happens to scanned hosts? what is the success rate of scanning? and whether the problem is worth investing significant effort and money on mitigating it, e.g., by filtering unwanted traffic? In this work we take a first look into Internet scanning from the point of view of scan repliers using a unique combination of data sets which allows us to estimate how many hosts replied to scanners and whether they were subsequently attacked in an actual network. To contain our analysis, we focus on a specific interesting scanning event that was orchestrated by the Sality botnet during February 2011 which scanned the entire IPv4 address space. By analyzing unsampled NetFlow records, we show that 2 % of the scanned hosts actually replied to the scanners. Moreover, by correlating scan replies with IDS alerts from the same network, we show that significant exploitation activity followed towards the repliers, which eventually led to an estimated 8 % of compromised repliers. These observations suggest that Internet scanning is dangerous: in our university network, at least 142 scanned hosts were eventually compromised. World-wide, the number of hosts that were compromised in response to the studied event is likely much larger.