Reconnaissance Attack Research Articles

IPv6 addressing scheme to enhance the performance by mitigating reconnaissance attack

AbstractIn resource‐constrained networks, IPv6 addresses are assigned to devices using SLAAC‐based EUI‐64, which generates unique addresses. However, the constant interface identifier (IID) across networks makes it vulnerable to reconnaissance attacks like location tracking, network activity correlation, address scanning, etc. This research work introduces a new addressing strategy that utilizes the Elegant Pairing function to guarantee the generation of nonpredictable unique IPv6 addresses, thereby mitigating different types of reconnaissance attacks. The proposed scheme achieves 100% address success rate (ASR) based on experimental evaluation while effectively thwarting reconnaissance attacks. Importantly, it achieves security enhancements without additional communication overhead and energy consumption.

A hybrid cyber defense framework for reconnaissance attack in industrial control systems

The convergence of information technology (IT) and operation technology (OT) has made Industrial Control Systems (ICS) a popular target for cyberattacks in recent years. Unlike traditional networks, enhancing availability is the ICS network's top priority rather than confidentiality in the CIA scheme. We propose a bio-inspired adaptive defense framework based on dissimilar redundancy, diversity, and adaptive defense strategies to achieve this aim. The proposed mechanism mixed optimal network shuffling and cyber deception techniques to maximise the time attackers spend on the decoys. Besides, to provide an extra layer of protection for system availability, we introduce dual heterogeneous subnets in the proposed framework that could be regenerated once compromised. We evaluate the performance of the proposed defense framework in a typical industrial manufacturing network using an SDN-based platform and test the defense framework in various scenarios. Compared with previous research, the simulation shows a considerable improvement in defense performance in the adaptive defense mode.

The data preprocessing in improving the classification quality of network intrusion detection systems

Stream-based intrusion detection is a growing problem in computer network security environments. Many previous researches have applied machine learning as a method to detect attacks in network intrusion detection systems. However, these methods still have limitations of low accuracy and high false alarm rate. To improve the quality of classification, this paper proposes two solutions in the data preprocessing stage, that is, the solution of feature selection and resampling of the training dataset before they are used for training the classifiers. This is based on the fact that there is a lot of class imbalanced data in the training dataset used for network intrusion detection systems, as well as that there are many features in the dataset that are irrelevant to the classification goal, this reduces the quality of classification and increases the computation time. The data after preprocessing by the proposed algorithms is used to train the classifiers using different machine learning algorithms including: Decision Trees, Naive Bayes, Logistic Regression, Support Vector Machines, k Nearest Neighbor and Artificial Neural Network. The training and testing results on the UNSW-NB15 dataset show that: as with the Reconnaissance attack type, the proposed feature selection solution for F-Measure achieves 96.31%, an increase of 19.64%; the proposed oversampling solution for F-Measure achieves 6.99%, an increase of 3.17% and the proposed undersampling solution for F-Measure achieves 94.65%, an increase of 11.42%.

Evaluating Common Reconnaissance Tools and Techniques for Information Gathering

A reconnaissance attack is a commonly overlooked step in penetration testing but a critical step that could help increase the effectiveness of an attack on a target. However, it is a common attack faced by companies and institutions, among others. It enables the attacker or penetration tester to gain valuable information on the target and select the best tools and methods that would make the attack successful. This study aims to identify and review existing state-of-the-art methodology for reconnaissance attacks based on certain techniques and evaluation metrics which will be beneficial to professional, ethical hackers in selecting the best-fit tool for a successful reconnaissance attack and enlighten organizations and the general public of the potential harm of a successful reconnaissance attack. This study explored seven online databases, which include Springer, Elsevier, Wiley, IEEE, ACM, ArXiv and Google Scholar. A total of 1306 publications were retrieved. Several screening criteria were executed to select relevant articles. Finally, 19 articles were identified for in-depth analysis. A quantitative evaluation was conducted on the selected articles using two search strategies: Techniques and source. A Quantitative Analysis (QA) was conducted on the selected articles and the outcome based on existing reconnaissance tools shows that 95.2% of the tools allowed experts to gather information by running their necessary command from the command line. While 4.8% of the tools do not provide a command-line interface allowing users to launch it from the command line interface while specifying some parameters to customize how it runs. 61.9% of the tools are network-based as they can be used to gather about the target's network infrastructure such as protocols, ports, DNS, IP address, hosts and the general network architecture. At the same time, 28.5% could be classified as hybrid as they allow the attacker to gather system-based and network-based information. This study concludes with findings that show that some of the tools operate in a different capacity; the best-fit tool is massively dependent on the attacker or penetration tester and the scenario's situations. Therefore, a tool should be selected based on the user's preference and the attack style.

Generating Adversarial Examples Against Machine Learning-Based Intrusion Detector in Industrial Control Systems

Deploying machine learning (ML)-based intrusion detection systems (IDS) is an effective way to improve the security of industrial control systems (ICS). However, ML models themselves are vulnerable to adversarial examples, generated by deliberately adding subtle perturbation to the input sample that some people are not aware of, causing the model to give a false output with high confidence. In this article, our goal is to investigate the possibility of stealthy cyber attacks towards IDS, including injection attack, function code attack and reconnaissance attack, and enhance its robustness to adversarial attack. However, adversarial algorithms are subject to communication protocol and legal range of data in ICS, unlike only limited by the distance between original samples and newly generated samples in image domain. We propose two strategies - optimal solution attack and GAN attack - oriented to flexibility and volume of data, formulating an optimization problem to find stealthy attacks, where the former is appropriate for not too large and more flexible samples while the latter provides a more efficient solution for larger and not too flexible samples. Finally, we conduct experiments on a semi-physical ICS testbed with a high detection performance ensemble ML-based detector to show the effectiveness of our attacks. The results indicate that new samples of reconnaissance and function code attack produced by both optimal solution and GAN algorithm possess 80 percent higher probability to evade the detector, still maintaining the same attack effect. In the meantime, we adopt adversarial training as a method to defend against adversarial attack. After training on the mixture of orginal dataset and newly generated samples, the detector becomes more robust to adversarial examples.

Automatic Port Scanner

In a computer network, an attack is an attempt to destroy or steal unauthorized information or make use of information as an asset. One of the attacks is a reconnaissance attack considered as the first step of a computer attack. This type of attack is mostly done by a black hat, an expert in the programmer, by scanning the internal network devices and gather vulnerability information. In this paper, shows the identification of open ports and services through the network and available IP on the network are possible to attack.

SEUI-64, bits an IPv6 addressing strategy to mitigate reconnaissance attacks

It has been widely assumed by the research community that the network reconnaissance attacks in IPv6 networks are unfeasible because they would take tremendous effort to perform address scanning of 264 hosts in an IPv6 subnet. However, recent research has revealed feasibility of these attacks by investigating a number of native IPv6 networks. The research concluded that an intelligent attacker could easily reduce the target search space by predicting the network host addressing schemes when performing the scanning. This indeed enhances security concerns and undermines the chances of IPv6 being deployed. This paper outlines the IPv6 addressing strategies currently used and proposes a new strategy to mitigate reconnaissance attacks. The new strategy is evaluated against some reconnaissance attack approaches and compared with some recent IPv6 addressing strategies. The experimental results confirm the effectiveness and validation of the addressing strategy in terms of the mitigation of reconnaissance attacks.

Metrics for V&V of cyber defenses

There is a need for a disciplined approach for evaluating a cyber defense prior to its introduction into an operational environment. This is necessary to assess whether the benefits of the defense will be worth its costs and risks. A traditional V&V workflow is adapted for this purpose. The considerations it must take into account are described, as is the collection and presentation of pertinent metrics. An example of this workflow is given for a cyber defense against a "reconnaissance attack" that threatens information integrity and confidentiality.

Cyber Defense of Space-based Assets: Verifying and Validating Defensive Designs and Implementations

The evolving nature of a malicious and persistent threat is unlike traditional environmental hazards to space flight missions, such as radiation. Consequently, engineering mission systems to be resilient to this new generation of threats may require extending or modifying traditional systems engineering processes and paradigms so as to effectively address the more dynamic behavior and characteristics of the intelligent adversary. This paper steps through a live deployment of a common reconnaissance attack on mission systems that have been deemed “secure” by traditional means, e.g., via compliance to the canonical IT Security Plan. The observations and lessons learned from studying a live attack in a mission context enabled us to identify and map out those critical areas that must be addressed in future systems engineering efforts. Particularly those that aim to build more resilient mission systems to the cyber adversary. In short, the simple reconnaissance demonstration presented here illustrates how a collection of “secure” machines can be assembled into an insecure system requiring that we explore cyber-defensive testing facilities, methodologies, toolsets, and how these can be linked to testing goals.

Reconnaissance Attack on IPv6 to IPv4 Tunneling

Internet Protocol version 6 (IPv6) is created to occupy the insufficient current Internet addresses. Consequently this significant contribution offers huge number of Internet addresses. Besides, the security also has been improved to challenge today threats in competent on IPv6 network. As alternative, an automatic tunneling was introduced along with other transition mechanisms to ensure smooth implementation on existing network. However, it’s believed that the implementation of automatic tunneling has altered the form of the IPv4 threats. Then the gained information from this mechanism is exploited to attempt the target network. As a concern, this paper thoroughly describes on potential of reconnaissance attack reach through automatic tunneling named 6to4 Tunneling. The preference development tools and networking defense mechanism suite, is setup to conduct proposed attack method under 6to4 tunnel testbed environment. As a result, the attacking method is feasible to attempt and 6to4 tunnel showed their influence on the achievement of DoS attack in current internet.