Detecting network reconnaissance by tracking intranet dark-net communications
A method and system for detecting network reconnaissance is disclosed wherein network traffic can be parsed into unidirectional flows that correspond to sessions. A learning module may categorize computing entities inside the network into assets and generate asset data to monitor the computing entities. If one or more computing entities address a flow to an address of a host that no longer exists, ghost asset data may be recorded and updated in the asset data. When a computing entity inside the network contacts an object in the dark-net, the computing entity may be recorded a potential mapper. When the computing entity tries to contact a number of objects in the dark-net, such that a computed threshold is exceeded, the computing entity is identified a malicious entity performing network reconnaissance.
1. A system for detecting network reconnaissance in a network having a plurality of host entities, comprising:
a computer processor to execute a set of program code instructions;
a memory to hold the program code instructions, in which the program code instructions comprises program code to:
monitor traffic within an organization's internal network, the internal network communicating with an external network through a network border device;
parse packets sent by hosts within the internal network;
analyze packets to identify messages sent by a host within the internal network to an Internet Protocol (IP) address that is not currently being used, wherein a malicious host is identified by determining when the host within the internal network surpasses a threshold of a number of times the host within the internal network does not receive a response from an unused IP address after the host pings the unused IP address;
generate asset data based at least in part on a successful reciprocal communication between host entities in the internal network;
generate dark-net connection attempt data for the plurality of host entities; and
generate report data if a number of attempts by one of the hosts to connect to dark-net objects surpasses the threshold.
2. The system of claim 1 , wherein the program code further generates asset data based at least in part on a number of failed connection attempts to a same address inside the internal network.
3. The system of claim 1 , wherein the program code generates potential mapper data if the threshold is not surpassed.
4. The system of claim 3 , wherein all attempts to connect to dark-net objects is updated in a database as dark-net connection attempt data.
5. The system of claim 4 , wherein the program code uses the potential mapper data and the dark-net connection attempt data to determine whether the threshold has been passed.
6. The system of claim 1 , wherein the program code waits for an interval of time while generating the asset data.
7. The system of claim 1 , wherein the dark-net connection attempt data older than a specified interval of time is expired.
8. The system of claim 1 , wherein generating dark-net connection attempt data for the plurality of host entities further comprises checking whether packets in a flow dataset are addressed to addresses not in the asset data.
9. A computer-implemented method for detecting network reconnaissance in a network having a plurality of host entities, comprising:
monitoring traffic within an organization's internal network, the internal network communicating with an external network through a network border device;
analyzing packets to identify message messages sent by a host within the internal network to an Internet Protocol (IP) address that is not currently being used, wherein a malicious host is identified by determining whether the host within the internal network surpasses a threshold of a number of times the host within the internal network does not receive a response from an unused IP address after the host pings the unused IP address;
generating asset data that is based at least in part on a successful reciprocal communication between hosts entities in the internal network, the asset data generated by checking whether communication between hosts is successful;
generating dark-net connection attempt data for the plurality of host entities; and
generating report data if a number of attempts by one of the hosts to connect to dark-net objects surpasses the threshold.
10. The method of claim 9 , wherein generating asset data further comprises generating asset data based at least in part on a number of failed connection attempts to a same address inside the internal network.
11. The method of claim 9 , wherein generating report data further comprises generating potential mapper data if the threshold is not surpassed.
12. The method of claim 11 , wherein all attempts to connect to Dark-net objects is updated in a database as dark-net connection attempt data.
13. The method of claim 12 , wherein generating dark-net connection attempt data further comprises using the potential mapper data and the dark-net connection attempt data to determine whether the threshold has been passed.
14. The method of claim 9 , wherein the dark-net connection attempt data older than a specified interval of time is expired.
15. The method of claim 9 , wherein generating dark-net connection attempt data for the plurality of host entities comprises checking whether packets in a flow dataset are addressed to addresses not in the asset data.
16. A computer program product embodied on a non-transitory computer readable medium, the non-transitory computer readable medium having stored thereon a sequence of instructions which, when executed by a processor causes the processor to execute a method for accessing data corresponding to detecting network reconnaissance in a network having a plurality of host entities, comprising:
monitoring traffic within an organization's internal network, the internal network communicating with an external network through a network border device
analyzing packets to identify message messages sent by a host within the internal network to an internet protocol (IP) address that is not currently being used, wherein a malicious host is identified by determining whether the host within the internal network surpasses a threshold of a number of times the host within the internal network does not receive a response from an unused IP address after the host pings the unused IP address;
generating asset data that is based at least in part on a successful reciprocal communication between hosts entities in the internal network, the asset data generated by checking whether communication between hosts is successful;
generating dark-net connection attempt data for the plurality of host entities; and
generating report data if a number of attempts by one of the hosts to connect to dark-net objects surpasses the threshold.
17. The computer program product of claim 16 , wherein generating asset data further comprises generating asset data based at least in part on a number of failed connection attempts to a same address inside the internal network.
18. The computer program product of claim 16 , wherein generating dark-net connection attempt data further comprises generating potential mapper data if the threshold is not surpassed.
19. The computer program product of claim 18 , wherein all attempts to connect to Dark-net objects is updated in a database as dark-net connection attempt data.
20. The computer program product of claim 19 , wherein generating dark-net connection attempt data further comprises using the potential mapper data and the dark-net connection attempt data to determine whether the threshold has been passed.