Techniques for detecting cyber-attack scanners
A method and system for detecting and mitigation a cyber-attack scanner are provided. The method includes determining if a source network address designated in a received packet is suspicious as of a cyber-attack scanner, wherein the determination is based on a likelihood that the source address was previously frequently encountered; upon determining that the source network address is suspicious, determining diversity of destination network addresses sent by a source having the suspicious network address; and upon determining that the destination network addresses are diversified, generating an alarm indicating that a source network address is a cyber-attack scanner, wherein a cyber-attack scanner is a device to identify destination network addresses in a protected entity that be exploit for at least a cyber-attack scanner.
1 . A method for detecting a cyber-attack scanner, comprising:
determining if a source network address designated in a received packet is suspicious of being a cyber-attack scanner, wherein the determination is based on a likelihood that the source network address was previously frequently encountered, the likelihood being assessed using a Probabilistic Modified Bloom filter and wherein determining if the source network address is suspicious further comprises:
mapping the source network address to a vector of hash values, wherein each hash value in the vector of hash values points to a location in an array of counters of the Probabilistic Modified Bloom filter; and
incrementing, by an increment value, a counter value of each counter in the array pointed by a respective hash value, wherein the increment value is based on a current counter value and a preconfigured updating factor;
upon determining that the source network address is suspicious, determining diversity of destination network addresses sent by a source having the network address; and
upon determining that the destination network addresses are diversified, generating an alarm indicating that a source network address is a cyber-attack scanner, wherein a cyber-attack scanner is a device to identify destination network addresses in a protected entity that can be exploited for at least a cyber-attack.
2 . The method of claim 1 , further comprising:
prior to determining if the source network address is suspicious, checking if the source network address is included in a whitelist source network addresses; and
performing the method for source network addresses not included in the whitelist.
3 . The method of claim 1 , further comprising:
prior to determining if the source network address is suspicious, checking if the source network address is included in a blacklist of source network addresses; and
rejecting the source network address included in the blacklist.
4 . The method of claim 1 , further comprising:
comparing counter values of all counters being incremented to a threshold; and
issuing an indication that the source network address is suspicious when all counter values being incremented exceeding the threshold.
5 . The method of claim 1 , further comprising:
decrementing, by a decrement value, a counter value of each counter in the array not pointed by a respective hash value, wherein the decrement value is based on a current counter value and a preconfigured updating factor.
6 . The method of claim 1 , wherein each counter in the array is a floating-point counter.
7 . The method of claim 4 , wherein the counter value is a current probability estimate to hit the counter.
8 . The method of claim 1 , wherein determining diversity of destination network addresses further comprising:
temporary buffering tuples of source and destination network addresses;
computing a diversity score as a ratio of a number of unique destination addresses to a total of buffered tuples pertaining to the suspicious source network address; and
comparing the diversity score to a diversity threshold, wherein the destination network addresses are determined diversified when the diversity score exceeds a diversity threshold.
9 . The method of claim 8 , further comprising:
buffering tuples of source network addresses and destination network addresses in a circular buffer.
10 . The method of claim 1 , wherein generating the alarm indicating further comprises:
blocking the scanner based on the suspicious source network address; and
reporting the suspicious source network address to a mitigation tool.
11 . The method of claim 1 , wherein the cyber-attack is at least a distributed denial of service (DDOS) attack.
12 . A non-transitory computer readable medium having stored thereon instructions for a process for detecting a cyber-attack scanner, the process comprising:
determining if a source network address designated in a received packet is suspicious of being a cyber-attack scanner, wherein the determination is based on a likelihood that the source network address was previously frequently encountered, the likelihood being assessed using a Probabilistic Modified Bloom filter and wherein determining if the source network address is suspicious further comprises:
mapping the source network address to a vector of hash values, wherein each hash value in the vector of hash values points to a location in an array of counters of the Probabilistic Modified Bloom filter; and
incrementing, by an increment value, a counter value of each counter in the array pointed by a respective hash value, wherein the increment value is based on a current counter value and a preconfigured updating factor;
upon determining that the source network address is suspicious, determining diversity of destination network addresses sent by a source having the network address; and
upon determining that the destination network addresses are diversified, generating an alarm indicating that a source network address is a cyber-attack scanner, wherein a cyber-attack scanner is a device to identify destination network addresses in a protected entity that can be exploited for at least a cyber-attack.
13 . A system for detecting a cyber-attack scanner, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
determine if a source network address designated in a received packet is suspicious of being a cyber-attack scanner, wherein the determination is based on a likelihood that the source network address was previously frequently encountered, the likelihood being assessed using a Probabilistic Modified Bloom filter;
upon determining that the source network address is suspicious, determine diversity of destination network addresses sent by a source having the network address; and
upon determination that the destination network addresses are diversified, generate an alarm indicating that a source network address is a cyber-attack scanner, wherein a cyber-attack scanner is a device to identify destination network addresses in a protected entity that can be exploited for at least a cyber-attack;
wherein the system is further configured to:
map the source network address to a vector of hash values, wherein each hash value in the vector of hash values point to a location in an array of counters of the Probabilistic Modified Bloom filter; and
increment, by an increment value, a counter value of each counter in the array pointed by a respective hash value, wherein the increment value is based on a current counter value and a preconfigured updating factor.
14 . The system of claim 13 , wherein the system is further configured to:
prior to determining if the source network address is suspicious, check if the source network address is included in a whitelist source network addresses; and
perform the operations for which the system is configured per claim 13 for source network addresses not included in the whitelist.
15 . The system of claim 13 , wherein the system is further configured to:
prior to determining if the source network address is suspicious, check if the source network address is included in a blacklist of source network addresses; and
reject the source network address included in the blacklist.
16 . The system of claim 13 , wherein the system is further configured to:
compare counter values of all counters being incremented to a threshold; and
issue an indication that the source network address is suspicious when all counter values being incremented exceeding the threshold.
17 . The system of claim 13 , wherein the system is further configured to:
decrement, by a decrement value, a counter value of each counter in the array not pointed by a respective hash value, wherein the decrement value is based on a current counter value and a preconfigured updating factor.
18 . The system of claim 17 , wherein each counter in the array is a floating-point counter, and the array of counters is included in a Probabilistic Modified Bloom filter.
19 . The system of claim 18 , wherein the counter value is a current probability estimate to hit the counter.
20 . The system of claim 14 , wherein the system is further configured to:
temporarily buffer tuples of source and destination network addresses;
compute a diversity score as a ratio of a number of unique destination addresses to a total of buffered destination addresses pertaining to the suspicious source network address; and
compare the diversity score to a diversity threshold, wherein the destination network addresses are determined diversified when the diversity score exceeds a diversity threshold.
21 . The system of claim 20 , wherein the system is further configured to:
buffer tuples of source network addresses and destination network addresses in a circular buffer.
22 . The system of claim 13 , wherein the system is further configured to:
block the scanner based on the suspicious source network address; and
report the suspicious source network address to a mitigation tool.
23 . The system of claim 13 , wherein the cyber-attack is at least a distributed denial of service (DDOS) attack.