Modeling of IP Scanning Activities with Hidden Markov Models: Darknet Case Study

Modeling of IP Scanning Activities with Hidden Markov Models: Darknet Case Study
复制标题

使用隐马尔可夫模型对 IP 扫描活动进行建模：暗网案例研究

DOI：
--
复制
发表时间：
2016
期刊：
International Conference on New Technologies, Mobility and Security
影响因子：
--
通讯作者：
O. Festor
O. Festor
中科院分区：
--
文献类型：
--
作者：
Giulia De Santis;Abdelkader Lahmadi;J. François;O. Festor

文献摘要

被引文献

相似文献

我们提出了一种基于隐马尔可夫模型（HMM）的方法来对暗网监控的扫描活动进行建模。扫描活动的 HMM 是基于一个时间窗口内扫描的 IP 地址的数量构建的，并使用泊松分布的混合进行拟合。我们的方法应用于从暗网收集并由两个大型扫描仪 ZMap 和 Shodan 生成的真实数据轨迹。我们证明所构建的模型能够表征其扫描活动。
We propose a methodology based on Hidden Markov Models (HMMs) to model scanning activities monitored by a darknet. The HMMs of scanning activities are built on the basis of the number of scanned IP addresses within a time window and fitted using mixtures of Poisson distributions. Our methodology is applied on real data traces collected from a darknet and generated by two large scale scanners, ZMap and Shodan. We demonstrated that the built models are able to characterize their scanning activities.