Victim Host Research Articles

Remote access trojan traffic early detection method based on Markov matrices and deep learning

Remote Access Trojan (RAT) allows the attacker to gain remote control of an infected system and steal data from it. Due to over-reliance on expert experience and statistical features, most feature-based RAT detection methods perform inefficiently and can only achieve high accuracy with network traffic collected over a long period of time. Byte-based RAT detection methods often use sequence truncation to process network traffic to meet the uniform-sized input requirements of convolutional neural networks (CNNs). However, the sequence truncation brings a negative impact on detection accuracy for some information loss. Towards effective and efficient RAT detection, we define the early stage from the damage degree caused on victim hosts and propose a new RAT traffic early detection method based on Markov matrices and deep learning (RATMD). In RATMD, the byte sequence of the TCP payloads of the TCP service packets collected in the early stage is represented by a byte transition probability matrix with a fixed size of 256 × 256, and the generated matrices are used to construct a detection model using a CNN architecture. Experiments are conducted on the network traffic of 58 benign applications and 61 RATs. Employing only the byte sequences derived from the TCP payloads of the TCP service packets in the traffic between the first TCP connection established by the application client and the third TCP service packet sent by the application server, RATMD achieves a detection accuracy of 95.5%.

MAGD: Minimal Attack Graph Generation Dynamically in Cyber Security

Cyber security faces challenges in detecting and mitigating complex attacks. Security solutions have employed Attack Graphs (AGs) for modeling multi-stage attacks, but traditional AGs suffer from scalability issues and may miss new vulnerabilities and attack paths. Also, traditional AGs construct the graph using information about previously known attacks. In this paper, we propose Minimal Attack Graph Generation Dynamically (MAGD), which leverages data from a deception system based on Honeypots to generate a minimal AG dynamically. In this paper, the AG has been constructed from real-time attacker’s behavior data directly. In addition, MAGD specifically focuses on modeling the attacker’s behavior at the host level, in contrast to traditional network-based AGs that encompass all possible attack paths at the network level. MAGD contains three custom algorithms to construct attacker behavior, generate a minimal AG, and continuously update the graph with new attack information. Complexity analyses demonstrate that MAGD’s generation process can accomplish within polynomial time. Our approach offers several advantages over traditional AGs, including the ability to model attackers’ real-time behavior, construct attackers’ action paths in the target host, and detect new vulnerabilities and attack paths in the victim host. Also, MAGD includes information about the effects of the actions in the target system. This information can be used for other security purposes. We demonstrate MAGD’s efficacy through a case study. MAGD provides a more effective way to detect and mitigate cyber threats by utilizing Honeypot data and proposed algorithms.

An Adaptive Distributed Denial of Service Attack Prevention Technique in a Distributed Environment.

Cyberattacks in the modern world are sophisticated and can be undetected in a dispersed setting. In a distributed setting, DoS and DDoS attacks cause resource unavailability. This has motivated the scientific community to suggest effective approaches in distributed contexts as a means of mitigating such attacks. Syn Flood is the most common sort of DDoS assault, up from 76% to 81% in Q2, according to Kaspersky's Q3 report. Direct and indirect approaches are also available for launching DDoS attacks. While in a DDoS attack, controlled traffic is transmitted indirectly through zombies to reflectors to compromise the target host, in a direct attack, controlled traffic is sent directly to zombies in order to assault the victim host. Reflectors are uncompromised systems that only send replies in response to a request. To mitigate such assaults, traffic shaping and pushback methods are utilised. The SYN Flood Attack Detection and Mitigation Technique (SFaDMT) is an adaptive heuristic-based method we employ to identify DDoS SYN flood assaults. This study suggested an effective strategy to identify and resist the SYN assault. A decision support mechanism served as the foundation for the suggested (SFaDMT) approach. The suggested model was simulated, analysed, and compared to the most recent method using the OMNET simulator. The outcome demonstrates how the suggested fix improved detection.

A Low-Overhead and High-Precision Attack Traceback Scheme with Combination Bloom Filters

Distributed denial of service attacks seriously threatens the availability of highly resilient software-defined networking systems, such as data center networks. A traceback scheme is an effective means of mitigating attacks by identifying the location of the attacker and the attacking path. However, traditional traceback schemes suffer from low traceability success rates, high packet header overheads, and high communication traffic overheads, in addition to the fact that logically centralized traceability schemes make the control plane a prime target for attacks. To overcome the above challenges, we propose the low-overhead and high-precision traceback scheme, which is divided into two stages: packet marking and path reconstruction. The first stage of the traceback scheme utilizes programmable switches in the data plane to selectively mark the actual physical path information that the packet was forwarded on. The marking method is adaptive to the path length, which utilizes a combined Bloom filter so that the packet length does not grow with the length of the attacking path. The proposed probabilistic packet marking algorithm effectively reduces the number of packets collected to reconstruct the attacking path. The second stage of the traceback scheme utilizes the distributed victim host to reconstruct the attacking path without the controller and locate the source of the attacker. Theoretical analysis and experimental results show that the proposed scheme ensures the high accuracy of tracing and minimizes the traffic overhead and storage overhead required for the traceback process.

A Delay-Based Machine Learning Model for DMA Attack Mitigation

Direct Memory Access (DMA) is a state-of-the-art technique to optimize the speed of memory access and to efficiently use processing power during data transfers between the main system and a peripheral device. However, this advanced feature opens security vulnerabilities of access compromise and to manipulate the main memory of the victim host machine. The paper outlines a lightweight process that creates resilience against DMA attacks minimal modification to the configuration of the DMA protocol. The proposed scheme performs device identification of the trusted PCIe devices that have DMA capabilities and constructs a database of profiling time to authenticate the trusted devices before they can access the system. The results show that the proposed scheme generates a unique identifier for trusted devices and authenticates the devices. Furthermore, a machine learning–based real-time authentication scheme is proposed that enables runtime authentication and share the results of the time required for training and respective accuracy.

The Impact of Ransomware on Individuals and Organizations in this Modern Era, Ways Forward

Ransomware is a severe security bottleneck and threat faced by individuals and organizations today in computer and information technology, and ransomware attacks are on the increase by the day. There is no infallible solution for protecting against Ransomware as the malware code uses metamorphic and polymorphic algorithms to generate different versions, thus evading signature detection. Ransomware also uses domain generator algorithms (DGA) to generate new domains for the command and control server (C&C), they constantly exploit new vulnerabilities, and they use various infection vectors. Thus, for an individual or organization to protect itself, an adaptive security architecture must constantly monitor the system to detect new ransomware infections at an early stage such that they block them before encryption of the files done. This approach is a defense in depth approach that supplements the network defenses such as patch management, anti-virus software, intrusion detection, firewalls, and content filtering. A framework for implementing the preempt and preventive security architecture model using open -source software was presented and the proposed framework is tested against the WannaCry and Petya Ransomware. The proposed framework was successfully able to alert of the ransomware attack and, it was even possible to prevent the Petya ransomware from executing on the victim host.

Oseltamevir Helps Cure COVID 19, Corona Pandemic Carried by Global Abortion/Contraception, Global Blood/Necrotic Tissue Environmental Pollution; Guaranteed Corona Elimination by Implementing Many Childbirth per Family [Earth Bus Fare/Ticket]; Contraception Reversal; Abolition of Global Contraception [One Child Policy, Small Family Norms], Abortion [Jumping off Cliff to Fly-Marred Science]<br/>—Retrospective Analysis

Over the past one year and three months, 150 out patients with COVID 19 have been treated with early initiation of Oseltamevir 75 mg × 2 [150 mg] twice daily, with azithromycin, cephalosporin [to give atypical bacterial cover, gram positive bacterial cover, respectively] enabling cure. Corona virus pandemic was enabled by global contraception/abortion [non evidence based non medical practice] with its blood/necrotic tissue environmental pollution-documented by rising environmental oestrogen/alpha feto protein/beta human chorionic gonadotropin. Global contraception abortion with its blood, necrotic tissue environmental pollution provides a rich environmental media for Corona virus-a fastidious organism to become pandemic, with recurrent mutations. Guaranteed elimination of this fastidious organism-corona virus [and other microbes like Ebola, Nipah…] by implementing many childbirths per mother [earth bus fare/ticket] as God ordained abolition of global contraception, abortion, one child policy/small family norms [jumping off cliff to fly-marred science] with its blood/necrotic tissue pollution, mandatory reversal of contraception. Steroids are deleterious in any viral infection, being immunosuppressants-secondary mucormycosis, other fungal [less virulent] infections can follow; corona virus itself can mutate, gain virulence, drug resistance; but prior contraception-destroying germ cells, prior abortion [destruction of tissue] in the victim host result in auto-immunity of corresponding gradations including fatal HLH [Hemophagocytic lymphohistiocytosis], cytokine storm, requiring immunomodulation with plasmapheresis, steroids, hydroxychloroquine without much avail. Vaccine is live attenuated virus administered to our tissue, to elicit antibody response to the future viral invasion; inhaled virus elicits autoimmunity of varied gradations, [including fatal HLH] in the victim host, secondary to prior abortions/contraception [varied destruction of tissue, germ cells in the victim host]; similar significant autoimmunity can be invoked in vaccine administered to tissue. Earth Bus Fare/ticket, many child birth per family as God ordained [with no menstrual blood pollution of mothers] leads to ozone generation, with ensuing unfailing monsoon rains, self sustaining ecology, zooming global economy, which increased longevity of life of parents, strengthened Earth’s magnet, absolute strong security preventing unmanned air vehicle robbery, non nuclear robotic war [remote control operations]. Whereas global abortion/contraception [one child policy, small family norms] [jumping off cliff to fly-marred science] with its blood/necrotic tissue environmental pollution results in inevitable emergence, drug resistance, [mutations] virulence of microbes including corona virus, ebola, nipah … inevitable ecological disasters namely-ozone depletion, tsunamis, hail storms, flash floods, tornadoes, oil fire, forest fire, … to name a few; global recession; early demise of contracepted/aborted parents.

Intrusion prevention with attack traceback and software-defined control plane for campus networks

As traditional networks, the software-defined campus network also suffers from intrusion attacks. Current solutions for intrusion prevention cannot meet the requirements of the campus network. Existing methods of attack traceback are either limited to specific protocols or incur high overhead. To protect the data center (DC) of the campus network from internal and external attacks, we propose an Intrusion Prevention System (IPS) based on the coordinated control between the detection engine, the attack traceback agent, and the software-defined control plane. Our solution includes a novel algorithm to infer the best switch port for defending different attacks of varied scales based on the inverse HSA (Header Space Analysis) and the global view of the software-defined controller. The proposed scheme can effectively and timely block the malicious traffic not only protecting victim hosts from attacks but also preventing the whole network from suffering unwanted transmission burden. The proposed IPS is deployed on the bypass of the DC switch and collects network traffic by port mirroring. Compared with the traditional serial deployment, the new design helps defend the DC internal attacks, reduce the probability of network congestion, and avoid the single point of failure. The experimental results show that the overhead of our IPS is very low, which enables it to meet the real-time requirements. The average defense time is between 10 and 14 ms for the data center internal attacks of different scales. For external attacks, the maximum defense time is about 76 ms for a large-scale network with 100 switches.

DeepRan: Attention-based BiLSTM and CRF for Ransomware Early Detection and Classification

Ransomware is a self-propagating malware encrypting file systems of the compromised computers to extort victims for financial gains. Hundreds of schools, hospitals, and local government municipalities have been disrupted by ransomware that already caused 12.1 days of system downtime on average (Siegel 2019). This study aims at developing a deep learning-based detector DeepRan for ransomware early detection and classification to prevent network-wide data encryption. DeepRan applies an attention-based bi-directional Long Short Term Memory (BiLSTM) with a fully connected (FC) layer to model normalcy of hosts in an operational enterprise system and detects abnormal activity from a large volume of ambient host logging data collected from bare metal servers. DeepRan also classifies abnormal activity as one of the candidate ransomware attacks by extending attention-based BiLSTM with a Conditional Random Fields (CRF) model. The Term Frequency-Inverse Document Frequency (TF-IDF) method is applied to extract semantic information from high dimensional host logging data. An incremental learning technique is used to extend the model’s existing knowledge to prevent DeepRan quality degradation over time. We develop a testbed of bare metal servers and collect normal host logs of two users for 63 days (IRB-approved). 17 ransomware attacks are executed on the victim hosts, and the infected host logging data is used for validating DeepRan. Experimental results present that DeepRan produces 99.87% detection accuracy (F1-score of 99.02%) for ransomware early detection. The detector also achieves 96.5% accuracy to classify abnormal events as one of 17 candidate ransomware families. The application of incremental learning is validated as an efficient technique to enhance model quality over time.

Evaluación de ataques DDoS y fuerza bruta utilizando entorno virtual Kali Linux como plataforma experimental.

La investigación se enfoca en la evaluación de ataques de denegación de servicios tipo SYN Flood y ataques de fuerza bruta, utilizando como plataforma de experimentación un entorno virtual de red que permita identificar cómo actúan dichos ataques en la saturación del ancho de banda y descubrir la contraseña del usuario administrador para poder ingresar a un sitio web con fines maliciosos. Para validar está investigación se desarrolló un mecanismo de detección y mitigación de los ataques en los hosts víctimas, a nivel de la capa de Internet del modelo TCP/IP con la formulación de reglas a nivel del firewall Iptables en Linux Centos 6.7.

Modeling and detection of the multi-stages of Advanced Persistent Threats attacks based on semi-supervised learning and complex networks characteristics

Advanced Persistent Threats (APT) present the most sophisticated types of attacks to modern networks which have proved to be very challenging to address. Using sophisticated attack techniques, attackers remotely control infected machines and exfiltrate sensitive information from organizations and governments. Security products deployed by enterprise networks based on traditional defenses often fail at detecting APT infections because of the dynamic nature of the APT attack process. To overcome the current limitations of attack network dynamics faced in APT studies, an innovative APT attack detection model based on a semi-supervised learning approach and complex networks characteristics is proposed in this paper. The entire targeted network is modeled as a small-world network and the evolving APT-Attack Network (APT-AN) as a scale-free network. Finite state machines are employed to model the state transitions of the nodes in the time domain in order to characterize the state changes during the APT attack process. The effectiveness of the model is demonstrated by applying it to real-world data from a large-scale enterprise network consisting of 17,684 hosts from the Los Alamos security lab. The proposed approach analyzes efficiently the large-scale dataset to reveal APT attack characteristics between the command and control center and the victim hosts. The final result is a ranked list of suspicious hosts participating in APT attack activities. The average detection precision of three APT stage is 90.5% in our proposed APT detection framework. The results show that the model can effectively detect the suspicious hosts at different stages of the APT attack process.

Autoimmune Thrombotic Thrombocytopenic Purpura, Disseminated Intravascular Coagulation, Haemophagocytic Lympho Histiocytosis—(Following Corona Virus Infection), Secondary to Fragmented Germ Cells {Liberal Global Abortions, Contraception—(Red Riverways, Blood Moon, Weakened Earth’s Magnet)} and Absence of Abstinence—Retrospective Analysis: Proof of Concept Study

Background: Autoimmunity has increased significantly, alarmingly secondary to global contraception, abortion, fragmenting germ cells; herewith three types of life threatening manifestations, are analysed. Case-1: 28-year-old afebrile lady, vegetarian, presented to emergency with impaired responsiveness, deep jaundice, menorrhagia of one day duration and she had been taking native treatment with leaves for primary infertility for the past five years; she had a few ecchymotic patches, investigations showed severe anaemia, thrombocytopenia, haemolytic jaundice, peripheral smear confirmed thrombotic thrombocytopenic purpura; she developed profound hematuria; she received treatment with intravenous immunoglobulin, fresh frozen plasma, platelet transfusions, packed red blood cells transfusions, plasmapheresis was planned; she improved gradually. In her sincere effort to conceive a baby, for the past five years, due to cultural ignorance which teaches only three days abstinence, instead of seven days abstinence after last menstrual periods, exposure of germ cells to raw endometrial surface, from 4th to 7th days of menstrual cycle, resulted in the cumulative autoimmunity-thrombotic thrombocytopenic purpura status. Case-2: 24-year-old lady who had undergone puerperal sterilisation, on the fourth day after last menstrual periods, presented, with unresponsiveness, to emergency, her investigations revealed prolonged prothrombin time, prolonged activated partial thromboplastin time, more than a minute, thrombocytopenia, reduced fibrinogen levels suggesting disseminated intravascular coagulation; her ultra sonogram abdomen showed, absence of gestational sac in the uterus; she received fresh frozen plasma transfusions, but succumbed within few hours. With puerperal sterilisation, [non evidence based medical practice], 20 million germ cells are fragmented to chromatid breaks, a-centric fragments, ring chromosomes, which get exposed to partly regenerated endometrial surface, on the fourth day after last menstrual periods, due to lack of awareness of abstinence upto seven days, initiating severe cumulative autoimmunity, resulting in fatal disseminated intravascular coagulation. Case-3: Fatal haemo-phagocytic lympho-histiocytosis-soaring autoimmunity, detected in the victim host of corona virus infection, correlated directly with extensive tissue damage produced in the victim host, by prior surgical abortions. Conclusion: Cases one and two followed absence of abstinence, with exposure of germ cells, to partly healed endometrial surface in the former culminating in thrombotic thrombocytopenic purpura; in the latter by exposure of fragmented 20 million germ cells [by contraception] to partly healed endometrial surface, culminating in fatal disseminated intravascular coagulation. In case three fatal autoimmune hemophagocytic lymphohistiocytosis followed corona virus infection, secondary to extensive tissue damage, of liberal global abortions. Red Russian riverways, is another evidence for global warming due to global aborted blood pollution, melting Perma-Frost crashing the Diesel tanks, with oil spill reflecting on aborted blood polluted river, turns bright red, similar to blood moon by abortion polluted air. Innumerable human lives with their iron of blood flowing within blood vessels, repelling magnet of earth, is mandatory to strengthen earth’s magnet. Arctic ozone hole closed this May, environmental pollution cleared, by absence of global abortions, contraception, and their ozone depleting blood pollution, due to lock down of corona virus pandemic.

Multiple‐Features‐Based Semisupervised Clustering DDoS Detection Method

DDoS attack stream from different agent host converged at victim host will become very large, which will lead to system halt or network congestion. Therefore, it is necessary to propose an effective method to detect the DDoS attack behavior from the massive data stream. In order to solve the problem that large numbers of labeled data are not provided in supervised learning method, and the relatively low detection accuracy and convergence speed of unsupervised k‐means algorithm, this paper presents a semisupervised clustering detection method using multiple features. In this detection method, we firstly select three features according to the characteristics of DDoS attacks to form detection feature vector. Then, Multiple‐Features‐Based Constrained‐K‐Means (MF‐CKM) algorithm is proposed based on semisupervised clustering. Finally, using MIT Laboratory Scenario (DDoS) 1.0 data set, we verify that the proposed method can improve the convergence speed and accuracy of the algorithm under the condition of using a small amount of labeled data sets.

Applying episode mining and pruning to identify malicious online attacks

A honeypot system can be deployed to decoy and record malicious intrusions over the Internet. However, events logged by a honeypot can rapidly accumulate an enormous amount of data, which an administrator will be unable to handle. The proposed system combines episode mining and pruning, and allows an administrator to identify suspected intrusions, and thus focus his energy on addressing them, instead of reading enormous amounts of raw data. An attack episode is composed of a series of events, and represents an Internet intrusion as a series of relevant events occurring to a victim host in a specific sequence. Due to the variety of internet attacks, this paper focuses on discovering attack episodes for the Server Message Block (SMB) protocol, which provides Microsoft Windows Network services. Experiments show that the proposed approach can locate suspicious episodes that are very likely novel attacks, from an immense amount of logged data.

Defense against SYN-flooding Attacks by using Game Theory

Connection Management phase of TCP is susceptible to a classic attack that is called SYN-flooding. In this attack, source sends many SYN packets to the victim computer, but does not complete three-way handshaking algorithms. This quickly consumes the resources allocated for communication in the under attack system and hence prevents it from serving other connection requests. This attack causes the victim host to populate its backlog queue with forged TCP connections. In other words it increases the number of legal connections rejected due to limited buffer space. In this paper, the under attack system are modeled by using queuing theory and then a game theoretic approach is employed to defend against SYNflooding attacks. The simulation results show that the proposed defense mechanism improves performance of the under attack system in terms of the ration of blocked connections and the buffer space occupied by attack requests.

English

Migration of DDOS attack is one the biggest challenge on the internet and lan networks. Many techniques has been proposed , including DDOS prevention, ipspoof etc., each of them has advantages and disadvantages. Source IP spoofing attacks are critical issues to the Internet.There has been active research on IP traceback technologies. However, the traceback from an end victim host to an end spoofing host has never yet been achieved, because of the insufficient traceback probes installed on each routing path. Recently a great number of prevention mechanism of a given detection and prevention have been developed, but it is difficult to trace the source ip of the attacker due to misconfiguration of network router or dynamic changes in the network. Also traditional methods are completely depends on network router. In order to overcome these problems, an improved iptraceback mechanism is introduced. Existing approach detect ip using offline CAIDA dataset which isn't suitable to dynamic networks. Experimental results show, proposed scheme performs well compare to traditional methods in terms of detection rate and time to detect source ip.

Flexible Deterministic Router and Interface Marking for IP Traceback

involves identifying the actual source of a packet across the Internet. By identifying the real source address in packets, network security system can smartly protect the victim hosts and mitigate the attacks. Packet marking is the most important method of source identification using IP traceback and there are many variations. In this paper, we propose a modification to our previous capable IP traceback scheme, Deterministic Router and Interface Marking (DRIM), to handle fragmented traffic as well. The modification introduces nominal additional bandwidth overhead, with no additional memory requirements and processing overhead on the DRIM-enabled interface and also reduces the problem of false positives. The proposed technique is compared with similar traceback techniques against various performance metrics and is found to be efficient.

Cloud computing-based forensic analysis for collaborative network security management system

Internet security problems remain a major challenge with many security concerns such as Internet worms, spam, and phishing attacks. Botnets, well-organized distributed network attacks, consist of a large number of bots that generate huge volumes of spam or launch Distributed Denial of Service (DDoS) attacks on victim hosts. New emerging botnet attacks degrade the status of Internet security further. To address these problems, a practical collaborative network security management system is proposed with an effective collaborative Unified Threat Management (UTM) and traffic probers. A distributed security overlay network with a centralized security center leverages a peer-to-peer communication protocol used in the UTMs collaborative module and connects them virtually to exchange network events and security rules. Security functions for the UTM are retrofitted to share security rules. In this paper, we propose a design and implementation of a cloud-based security center for network security forensic analysis. We propose using cloud storage to keep collected traffic data and then processing it with cloud computing platforms to find the malicious attacks. As a practical example, phishing attack forensic analysis is presented and the required computing and storage resources are evaluated based on real trace data. The cloud-based security center can instruct each collaborative UTM and prober to collect events and raw traffic, send them back for deep analysis, and generate new security rules. These new security rules are enforced by collaborative UTM and the feedback events of such rules are returned to the security center. By this type of close-loop control, the collaborative network security management system can identify and address new distributed attacks more quickly and effectively.

BrowserGuard: A Behavior-Based Solution to Drive-by-Download Attacks

Along with an increasing user population of various web applications, browser-based drive-by-download attacks soon become one of the most common security threats to the cyber community. A user using a vulnerable browser or browser plug-ins may become a victim of a drive-by-download attack right after visiting a vicious web site. The end result of such attacks is that an attacker can download and execute any code on the victim's host. This paper proposes a runtime, behavior-based solution, BrowserGuard, to protect a browser against drive-by-download attacks. BrowserGuard records the download scenario of every file that is loaded into a host through a browser. Then based on the download scenario, BrowserGuard blocks the execution of any file that is loaded into a host without the consent of a browser user. Due to its behavior-based detection nature, BrowserGuard does not need to analyze the source file of any web page or the run-time states of any script code, such as Javascript. BrowserGuard also does not need to maintain any exploit code samples and does not need to query the reputation value of any web site. We utilize the standard BHO mechanism of Windows to implement BrowserGuard on IE 7.0. Experimental results show that BrowserGuard has low performance overhead (less than 2.5%) and no false positives and false negatives for the web pages used in our experiments.

Allocation Schemes, Architectures, and Policies for Collaborative Port Scanning Attacks

Most network attackers perform port scanning individually, without synchronization, to find victim hosts. Such port scanning schemes suffer from two problems: first, there are too many duplicate scannings and too much contention among different port scanners; second, a complete port scanning takes a long time to finish. In this paper, we present a fast DHT-based collaborative port scanning scheme that aims to eliminate duplicate scanning, minimize contention, and significantly increase the scanning speed. In collaborative attacks, attackers communicate and collaborate with each other to launch much more powerful attacks. In the DHT-based collaborative port scanning scheme, attackers collaborate to search the network for ports that could be exposed to attacks. We propose different collaborative scanning strategies and analyze their advantages and disadvantages.We discuss the static, dynamic, and hybrid target selection and allocation schemes. We present the algorithm details and discuss the stop and revisit policy for the collaborative port scanners. We conduct experiments to evaluate the performance and overhead of the collaborative port scanning strategies. Experimental results suggest that the proposed collaborative port scanning system significantly increases the efficiency of port scanning and provide insights into many design and implementation issues.