Port Scanning Research Articles

Implementation of Intrusion Prevention System (IPS) as a Website-Based Server Security System and Mobile Application

Server is a center for providing services and storing data in a computer network. A server is managed by server administrator who has a duty of monitoring security server. While on duty, there are deficiencies in detecting attacks, the slow information about the attacks, and how to handle attacks on the server. In this research, a server security system was created by implementing an Intrusion Prevention System (IPS) based on website and mobile applications. Attack detection focuses on ICMP and TCP port attacks with the latency time when the system responds to an attack is 99,89 ms (very good). The attack handling system was successfully carried out using Iptables against the attacker's IP that detected by the Suricata system through the website and mobile applications, to be given action which is divided into Drop, Reject and Accept. Administrators can quickly take the necessary precautions after receiving an automatic notification when the server is under attack via Telegram with an average speed is 3.41second. The ping attack, port scanning and ping of death (DoS) attacks resulted in an increase in the performance load on the local server with the initial conditions of CPU performance ranging from 10-19%, increasing when a ping attack occurred to 21,6%, memory 41,7%, and disk 19,6%. Port scanning increased by 85,9% CPU, memory 41,9%, and disk 20,3%. Ping of death increased CPU 90,4%, memory 42,9%, and disk 20,8%. Based on the tests that have been done, an excessive increase is found in the ping of death attack which results in server performance increasing to 90,4%, if the attack occurs for a long time then the server condition will be hang (damaged).

Detecting Coordinated Internet-Wide Scanning by TCP/IP Header Fingerprint

Adversaries perform port scanning to discover accessible and vulnerable hosts as a prelude to cyber havoc. A darknet is a cyberattack observation network to capture these scanning activities through reachable yet unused IP addresses. However, the enormous amount of packets and superposition of diverse scanning strategies prevent extracting significant insights from the aggregate traffic. Some coordinated scanners disperse probe packets whose TCP/IP header follows a unique pattern to determine whether the received packets are valid responses to their probes or are part of other background traffic. We call such a pattern a fingerprint. For example, a probe packet from a Mirai-infected host satisfies a pattern whereby the destination IP address equals the sequence number. A fingerprint indicates that the source host has been involved in a particular scanning campaign. Although some fingerprints have been discovered and known to the public, there are and will be more undiscovered ones. We intend to unveil these fingerprints. Our preliminary work automatically identified flexible fingerprints but overlooked low-rate and coordinated scanners. In this work, we improved the fingerprint identifier, enabling it to detect these stealth scans. Moreover, we revealed the scans’ objectives by investigating destination port sets. We associated fingerprints with threat intelligence and verified their reliability. Our approach identified all well-known and eight unknown fingerprints on one month’s worth of darknet data collected from about three-hundred thousand unused IP addresses. We disclosed the fingerprints of the Mozi botnet and destination port sets that were previously unreported.

Detecting Network Scanning Through Monitoring and Manipulation of DNS Traffic

In this paper, we propose an approach for detecting internal and external network scanning attacks on enterprise networks. In our approach, an inline scan detection system (SDS) monitors the ingress and egress flows of an enterprise network subnet and detects scanning probes based on the correlation of flows with preceding DNS query/responses and reducing TTL values of DNS Resource Records (RR). Through rigorous evaluation, we show that our method is effective against both external and internal port scanners and network worms, its effectiveness is independent of scanning rate or technique, and its deployment incurs negligible overhead on DNS and network response times. While the idea of detecting scans by correlating network flows with preceding DNS query/responses has been proposed in the literature, this work extends the state-of-the-art by offering four contributions: 1) we show that without decreasing TTL values of RRs in DNS responses, attackers can piggyback on cached DNS records to bypass our detection; thus we incorporate a TTL reduction mechanism to enhance the effectiveness of this approach, especially against stealthy and adaptive scanners; 2) while prior works work against internal scanners, we use the relatively new extension of DNS protocol, ENDS0 Client Subnet (ECS) option, to expand this approach toward detecting external scanners; 3) we present a novel adaptive scanning technique, called DNS-cache-based scanning, that exploits local DNS cache to bypass prior detection methods, and shows that, while prior approaches fail to defeat this threat model, our approach is effective against this evolved threat model as well; and 4) contrary to existing work that focuses on defeating fast network scanning worms, this approach is effective against any scanning, including stealthy scanning that uses conservative timing profiles to evade detection.

Vulnerability Assessment for Applications Security Through Penetration Simulation and Testing

Cybersecurity threats and attacks are a critical concern for computing systems as general and specifically in web applications. There are many types and categories of cyberattacks on web applications. Many of these attacks are made possible due to existing vulnerabilities in the networking environments and platforms that host these web applications. So, the vulnerability assessment and attacks simulations on these networking platforms are of extreme importance to protect and secure the top web applications that play a prime role in our daily life. One of the widely used mechanisms to identify vulnerabilities and defend against different attacks on systems and networks is Penetration Testing. It allows us to simulate real-world attacks on a network or a single device to determine the susceptibility and impact of cybersecurity attacks. Pen testing aims to secure a system or network by performing a full-blown attack against it. Several techniques have been used for that, from port scanning, service, and operating system detection to network enumeration, creating specially crafted packets, and modifying software to exploit vulnerabilities. However, while it is used widely as a defensive technique, some attackers also employ it for malicious intentions utilizing available open-source penetration testing tools. Penetration testing on internal networks such as networks that connect IoT/sensors/web cameras, can be utilized to find vulnerabilities and fix them to secure the networks. In this research, we present a detailed discussion on penetration testing and its seven phases of action and provide a step-by-step procedure with instructions using various open-source tools to conduct penetration testing and vulnerability assessments of a network. We finally demonstrate the process and results of simulated attacks on our network within the testing environment. This research provides a comprehensive introduction to penetration testing and testbed through real-world attack simulation. The IT administrator or security enthusiast can utilize them to secure networks, devices, clients, servers, and applications while enhancing the overall organization’s security.

Network Forensic Serangan DoS pada Jaringan Cloud berdasarkan Generic Framework for Network Forensics (GFNF)

The attacks on cloud-based networks have increased and could lead to various disadvantages such as the inaccessibility of services until the loss of user’s trust. Owncloud is one cloud implementation that runs on a network with more than 200 million users. The aims of these researches are to find digital evidence from DoS attacks. Some DoS attacks are SSH brute force, SYN flood, ping of death, and port scanning on the Owncloud network and then finding the digital evidence such as the attacker's IP, time occurred of the attack, types of the attack, also the resource usage of CPU and RAM. This research uses Wireshark and Snort tools to analyze the network and the method of Generic Framework for Network Forensic (GFNF) as a framework during the simulation process until performing the evidence. The simulation was carried out for 1 minute with 30 trials for each attack. The results of this study found the attacker’s IP, time of the attack occurred, types of attack, and also the increase of the resource usage on CPU and RAM when an attack occurred. The found of results digital evidence such as the attacker's IP, the time occurred of attack, and the types of attack were visualized as a table and presented on the ELK Stack dashboard.

S-FoS: A secure workflow scheduling approach for performance optimization in SDN-based IoT-Fog networks

Fog computing aims to provide resources to cloud data centers at the network’s edge to support time-critical Internet of Things (IoT) applications with low-latency requirements. Protecting the IoT-Fog resources and the scheduling services from the treats is critical for executing the users’ requests in the IoT-Fog network. Proper scheduling algorithms are essential to fulfill the requirements of users’ applications properly and fully harness the potential of IoT-Fog resources. Software-Defined Networking (SDN) is a structure that decouples the control plane from the data plane, resulting in more flexible management. That eases the implementation of security mechanisms in the IoT-Fog networks. In SDN-based IoT-Fog networks, SDN switches and controllers can serve as fog gateways/cloud gateways. SDN switches and controllers, on the other hand, are more susceptible to a variety of assaults, making the SDN controller a bottleneck and thus easy to control plane saturation. IoT devices are inherently insecure, making the IoT-Fog network vulnerable to a variety of attacks. This paper presents S-FoS, an SDN-based security-aware workflow scheduler for IoT-Fog networks. The proposed approach defends scheduling services against distributed denial of service (DDoS) and port scanning assaults. S-FoS is a joint security and performance optimization approach that uses fuzzy-based anomaly detection algorithms to identify the source of attacks and block malicious requestors. It also uses a NSGA-III multi-objective scheduler optimization approach to consider load balancing and delay simultaneously. We show that the S-FoS outperforms state-of-the-art algorithms in IoT-based scenarios through comprehensive simulations. The experiments indicate that by varying the attack rates, the number of IoT devices, and the number of fog devices, the response time of S-FoS could be improved by 31% and 18%, and the network utilization of S-FoS could be improved by 9% and 4%, respectively, compared to the NSGA-II and MOPSO algorithms.

IMPLEMENTATION OF SOFTWARE APPLICATION FOR NETWORK PORT SCANNING IN ANDROID BASED OPERATING SYSTEMS

In this paper implementation of software application using linear algorithm for network port scanning in android based operating systems is made.

IMPLEMENTATION OF MODIFIED SCRIPT FOR LINUX BASED OPERATING SYSTEMS USING A LINEAR ALGORITHM FOR NETWORK PORT SCANNING

The Python programming language has various module libraries for network scanning of hosts. In this paper the performance and implementation of a modified script for Linux based operating systems using a linear algorithm for network port scanning is presented.

IMPLEMENTATION OF MODIFIED NETWORK PORT SCANNER FOR WINDOWS BASED OPERATING SYSTEMS

In this paper a modified network port scanner for Windows based operating systems implementing a linear algorithm is developed.

Implementation of intrusion prevention system (IPS) to analysis triad cia on network security attacks on web server

Computer networks are built to achieve the main goal of communicating with each other . During the transmission process, it is expected that information can be conveyed quickly, efficiently and safely. Network security serves to avoid damage or even data loss caused by attacker activities during the communication process. Security aspects that need to be maintained in data information are Confidentiality, Integrity and Availability. Intrusion Prevention System is a solution that can maintain network security from various attacks. The Intrusion Prevention System will act as a protector on the network by detecting and preventing suspicious traffic on nodes in a network. The Intrusion Prevention System in its implementation has several tools which are used in this study, namely Snort and IPTables. Testing is done by performing attacks on the Web Server. The attacks carried out are Port Scanning, DDoS attacks and Brute Force. The results of this study are based on the CIA Triad with the three attacks having different characteristics in terms of cause and effect. On the defense side, Port Scanning and Brute Force can be easily prevented by IPS, but in DDoS attacks there are differences in results between drop and reject rule. In a DDoS attack with an action drop rule, it can recover the web server in 160 seconds while the action reject rule can be restored at 145 seconds which normally can be recovered in a DDoS attack in 165 seconds. The IPS server can also reduce resources when there is a DDoS attack by 9.2% .

A Smart Internet-Wide Port Scan Approach for Improving IoT Security Under Dynamic WLAN Environments

The Internet of Things (IoT) has created acute network security concerns owing to their weak protocols and limited system resources. Vulnerable IoT devices increase the risk of compromising other devices connected to the network. Hence, vulnerability and risk assessments are necessary for IoT devices. Correspondingly, the Internet-wide port scan (IWPS) technique has garnered significant attention for its ability to discover and probe Internet-wide connected IoT devices. However, IWPS performance depends on the end wireless local area network (WLAN) state (e.g., congestion and signal-to-interference-plus-noise ratio). Scans oblivious to such dynamic WLAN factors can cause probe packet loss while increasing port-scan delays, which reduces the discovery rate, which misses the point of network security. Therefore, in this study, we propose a novel holistic approach to identifying WLAN environmental states based on round-trip time and probe-packet responses. To demonstrate the effectiveness of the proposed approach, we perform extensive experiments on real WLAN environments with various devices. The accuracy of the estimated states was validated at greater than 90% by analyzing the captured probe data at each WLAN.

On Sustained Zero Trust Conceptualization Security for Mobile Core Networks in 5G and Beyond

The rapid increase in data traffic is forcing mobile network operators to enhance and expand their network infrastructure to meet the new requirements of customers’ Service Level Agreements (SLA). Network Function Virtualization (NFV) provides abstractions of core network functions from the vendor-specific hardware. This allows the network functions to move around the cloud, providing better performance and scaling capabilities. However, deploying virtualized mobile core network in the cloud environment opens many security concerns not only regarding communication between the Radio Access Network (RAN) and the mobile core network but also within the core network itself. In this paper, we propose a framework called virtual Evolved Packet Core - virtual Software Defined Perimeter (vEPC-vSDP) to provide secure communications within the mobile core network by using an authentication-based approach. The SDP components are virtualized and placed within the virtualized core network to provide a zero-trust environment where only authenticated and authorized core network elements can have access to one another. The analysis of the proposed vEPC-vSDP framework confirms its ability to shield the core network traffic from both external and internal attacks. The vEPC-vSDP framework was implemented and tested against Denial of Service (DoS), Distributed Denial of Service (DDoS) and port scanning attacks to demonstrate the resilience of the proposed framework. The results show the capability of vEPC-vSDP to provide secure communication path to mobile core network elements.

A data plane security model of segmented routing based on SDP trust enhancement architecture

Segment routing (SR) technology is a new network functional technology derived from MPLS technology and based on SDN. Combining SR with software-defined perimeter (SDP), a new network security technology, is expected to solve the traditional problems such as data monitoring, denial of service, and new threats such as loop attack and label detection faced by SR data plane. Focusing on the security management of access devices in the SR data plane, first, this paper proposes an SR security model SbSR (SDP-based SR) based on SDP trust enhancement architecture, then, two-level SDP AH trust verification mechanism and 4 trust management mechanisms including initial trust value, trust evaluation, trust renewal, trust inheritance are designed. In the trust evaluation mechanism as the core of the model, System cloud grey model (1,1) weighted Markov prediction model is introduced to obtain real-time trust based on the historical behavior of device nodes, and 4 indexes, namely benign message ratio, loyal forwarding ratio, forwarding ratio stationarity coefficient, packet rate stationarity coefficient, are introduced to distinguish malicious devices from normal devices. Finally, the simulation test results of 5 security functions and security costs show that the proposed architecture can solve port scanning, traffic monitoring, topology detection, loop attack, and DoS attack of SR network data plane with an average access delay cost of 2.84 s for each new network agent, and realize multi-faceted protection of SR network data plane.

Link Security Situation Identification Method Based on the Ad Hoc Network of Medical Units.

In order to strengthen the management and security status monitoring of the internal network of medical units and make up for security vulnerabilities in time, an ad hoc network link security situation identification method is proposed. According to the architecture of the ad hoc network, it is analyzed that it has the advantages of strong persistence and its own protocol. Combined with the data of detection equipment and security log, the hierarchical acquisition model is used to obtain the situation elements such as port scanning attack and flood attack. The transmission rate factor, forwarding rate factor, dispersion factor, and node aggregation factor are regarded as eigenvectors. We determine the relationship between identity, difference, and opposition, identify the security situation through the description of the node state, and conduct quantitative processing to obtain the final identification result. The experimental results show that the weight value of this method is the same as the standard weight, which can identify the security situation level, obtain the specific situation value, and present a more intuitive identification result.

Knock, knock, log: Threat analysis, detection & mitigation of covert channels in syslog using port scans as cover

In this paper we perform a threat analysis for a covert Command and Control (C2) channel using port scans as cover and syslog as carrier for data infiltration. We describe a theoretical threat scenario in which an adversary makes use of known covert channels in TCP and DNS, and propose a novel method for hiding information in TCP ports scans and the resulting (sys)logs as a carrier for hidden messages. For forensic purposes, we provide details on Indicators-of-Compromise (IoC) as well as mitigating measures aiming at preventing the covert channel apriori. Moreover, we propose a novel detection scheme in order to identify and prevent such threats hidden in port scans and evaluate its effectiveness using datasets generated by a proof of concept implementation of the proposed covert channel based threat scenario.

Intrusion detection in cyber–physical environment using hybrid Naïve Bayes—Decision table and multi-objective evolutionary feature selection

Researchers are motivated to build effective Intrusion Detection Systems because of the implications of malicious actions in computing, communication, and cyber–physical systems (IDSs). In order to develop signature-based intrusion detection techniques that are suitable for use in cyber–physical environments, state-of-the-art supervised learning algorithms are devised. The main contribution of this research is the introduction of a signature-based intrusion detection model that is based on a hybrid Decision Table and Naive Bayes technique. In addition, the contribution of the suggested method is evaluated by comparing it to the existing literature in the field. In the preprocessing stage, Multi-Objective Evolutionary Feature Selection (MOEFS) feature selection has been used to select only five attack features from the recent CICIDS017 dataset. Keeping in view the class imbalance nature of CICIDS2017 dataset, adequate attack samples has been selected with more weightage to the attack classes having a smaller number of instances in the dataset. A hybrid of Decision Table and Naive Bayes models were combined to train and detect intrusions. Detection of botnets, port scans, Denial of Service (DoS)/Distributed Denial of Service (DDoS) attacks, such as Golden-Eye, Hulk, Slow httptest, slowloris, Heartbleed, Brute Force attacks, such as Patator (FTP), Patator (SSH), and Web attacks such as Infiltration, Web Brute Force, SQL Injection, and XSS, are all successfully detected by the proposed hybrid detection model. The proposed approach shows an accuracy of 96.8% using five features of CICIDS2017, which is higher than the accuracy of methods discussed in the literatures.

Realguard: A Lightweight Network Intrusion Detection System for IoT Gateways

Cyber security has become increasingly challenging due to the proliferation of the Internet of things (IoT), where a massive number of tiny, smart devices push trillion bytes of data to the Internet. However, these devices possess various security flaws resulting from the lack of defense mechanisms and hardware security support, therefore making them vulnerable to cyber attacks. In addition, IoT gateways provide very limited security features to detect such threats, especially the absence of intrusion detection methods powered by deep learning. Indeed, deep learning models require high computational power that exceeds the capacity of these gateways. In this paper, we introduce Realguard, an DNN-based network intrusion detection system (NIDS) directly operated on local gateways to protect IoT devices within the network. The superiority of our proposal is that it can accurately detect multiple cyber attacks in real time with a small computational footprint. This is achieved by a lightweight feature extraction mechanism and an efficient attack detection model powered by deep neural networks. Our evaluations on practical datasets indicate that Realguard could detect ten types of attacks (e.g., port scan, Botnet, and FTP-Patator) in real time with an average accuracy of 99.57%, whereas the best of our competitors is 98.85%. Furthermore, our proposal effectively operates on resource-constraint gateways (Raspberry PI) at a high packet processing rate reported about 10.600 packets per second.

Network Traffic Classification Using Feature Selections and two-tier stacked classifier

The datasets available for IDS performance evaluations are noisy and highly imbalanced. The noisiness of the dataset can be reduced with dataset pre-processing and feature selection approach. These datasets contain many records for some class labels (e.g., DoS, DDoS, Port Scan: majority attacks) and very few records for other class labels (e.g., U2R, R2L: minority attacks), making it imbalanced. Applying a single machine learning algorithm (classifier) on such datasets confuses the classifiers. The classifier becomes biased towards majority attack records and may fail to detect minority attacks. One possible solution to reduce these class imbalances of the dataset is to divide this dataset in terms of majority and minority attacks. The proposed approach divides the dataset into majority and minority groups to solve the issue raised by the imbalance dataset and uses two-tier classification approaches to classify majority and minority attacks. The CICIDS2017 dataset and NSL-KDD dataset are used for the evaluation of the proposed system. The proposed system gives an accuracy of 98.30% for the CICIDS 2017 dataset and 99.71% for the NSL-KDD dataset. The model’s performance is explored in terms of precision, accuracy, and F1 score, which has been observed to be superior to existing works in the field of intrusion detection.

RT-RCT: an online tool for real-time retrieval of connected things

In recent years, internet of things (IoT) represents a giant and a promoter area in innovation and engineering fields. IoT devices are spread in various fields and offer advanced services which assist their users to monitor and control objects remotely. IoT has a set of special characteristics such as dynamic, variety of data and huge scale which introduces a great challenge in the field of retrieval technologies, more precisely real-time retrieval. This paper addresses the issue of real-time retrieval of connected things and tries to propose an innovative solution which allows the retrieval of these things and their descriptive data. The paper proposes an on-line tool for real-time retrieval of connected things and their descriptive data based on network port scanning technique. The performance of this tool proves to be powerful under normal conditions, however more tests must be implemented in the aim to improve the proposed solution. The tool resulted from this work appears to be promising and can be used as a reference by network administrators and IT security managers for the development of new security mechanisms and security reinforcement.

IoT network traffic analysis: Opportunities and challenges for forensic investigators?

As IoT devices become more incorporated into our daily lives, their always on approach makes them an ideal source of evidence. While these devices should use encryption to protect sensitive information, in reality this is not always the case e.g. some expose sensitive data like credentials in cleartext. In this paper, we have conducted an extensive analysis on the communications channels of 32 IoT consumer devices. Our experiments consisted of four main parts; first we carried out a port scan to determine if any ports can be exploited and thus gain remote access. Second, we looked at whether any of the devices used encryption and if not what type of content was exposed. Third, we used the network traffic ‘metadata’ to identify the destination the data terminated. Finally, we examined the communication between the mobile app and the cloud to see if it can be easily exploited using a proxy server. Our findings show that the majority of devices have remote access unavailable. We found the Shannon entropy test a useful pre-test in identifying unencrypted content. Although many devices encrypted their data, we found several in particular smart cameras would send data in cleartext when they detected motion or during updates. We found the majority of data transverses to the US and stored on Amazon servers with most devices contacting multiple destination. Lastly, we discovered many of the IoT device's mobile apps can be easily exploited using a HTTP Proxy.