# Presentation: 016067

## Exploring the Structure and Dynamics of Inter-Site Network Scanning

**Scott Campbell**
**NERSC/LBNL**

## Outline

**Abstract**
**Background.**
**How are we doing it?**
**Looking for scanning structure.**
**Measuring differences between structure and non-structure address groups.**

## Abstract

**We are looking at scanning from the perspective of multiple sites.  Using site agnostic tools, track the movement of individual scanners as they cross different address ranges.**
**By looking at which sites are being scanned by the same addresses, we can infer groupings of networks which seem to attract similar attackers.**
**Take measurements to see if sites within these scanning groups can be differentiated by behavior that they exhibit.**

## Background

**Passive network analysis can be broken out into three basic types:**
**Radiation**
**Telescope**
**Scanning analysis**
**Typically look at aggregate behavior over some time and address range.**
**We look for groupings of attack addresses across as large a spread of network ranges as we can find.**

## More Background

**Initial work was done in:**
**Collaborating Against Common Enemies, Sachin Katti, Balachander Krishnamurthy, Dina Katabi, Proc. of ACM SIGCOMM IMC 2005.**

## Send More Data

**Need scanning data!**
**Problems: political and technical**
**Political – address privacy issues for non-DOE labs.**
**Technical - Need platform agnostic method which can operate independently of local site policy.  **

## Data Gathering

**Use perl script to crunch connection logs.  All analysis will then be consistent and should work on non bro records as well.**
**Always filter local addresses and, if required, hash the scanners IP to provide loose anonymity.**
**Treat sites with multiple networks – like LBNL – as several discrete and unrelated networks.**

## Sample Record

**1181828234.934813 TRW  190.47.179.63 1 445 6.62012410163879**
**1181828236.141497 TRW  190.46.88.178 1 445 3.85341191291809**
**1181828236.558456 TRW  201.239.28.35 1 445 5.18057298660278**
**SCAN_TIMING 1 221.192.143.198 port:10020 time: 1181828237.807849 dt:8.53110194206238**
**1181828239.657777 TRW  200.104.187.83 1 445 8.33125901222229**
**1181828241.176143 TRW  201.215.177.141 1 445 10.296108007431**
**SCAN_TIMING 1 82.67.3.176 port:139 time: 1181828253.190993 dt:23.9289910793304**
**SCAN_TIMING 1 60.191.233.20 port:64025 time: 1181828261.923445 dt:32.7112550735474**
**Nice example of what not to do ...**

## Initial Structure Detection

**Three tests are conducted in looking at initial structure detection:**
**Network Overlap**
**Temporal Locality**
**Total Address Overlap**

## Network Overlap

- A

- B

**A ∩ B : ****Green Area**

**Overlap follows your intuition.  **
**It is measured against the smallest of the two sets since the magnitude of the overlap can be no bigger than the smallest area.**

## Network Overlap Example

| N1 | ----- |  |  |  |
| --- | --- | --- | --- | --- |
| N2 | O(N2, N1 ) | ----- |  |  |
| N3 | O(N3, N1 ) | O(N2, N2 ) | ----- |  |
| Nn | O(Nn, N1 ) | O(Nn, N2 ) | O(Nn, N3) | ----- |
|  | N1 | N2 | N3 | Nn |

**For the overall calculations, just do a “mileage map” style representation.  In the paper, the final overlap was calculated as a series of 24 hour periods and averaged.  **

## Network Overlap Data

- 1

- 21

- 1

- 21

- Index number indicates network

- > 10 %
- > 5 – 10 %
- > 0 – 5 %
- 0 %

## Temporal Locality

- 1
- 5

- Time

- 1
- 2
- 5

- 1
- 2
- 5

- 9

- 1
- 3
- 5

- 7

**Δt****3**

**Δt****2**

**Δt****1**

**IP Address**

**Take a series of time windows and see which groups of networks consistently identified the same scanner address.**
**In this example, for time window 3, IP address ‘a’ was seen by networks 1,2, and 5.**

- a

**b**

## Temporal Locality Results

## Total Address Overlap

**Here we have the same mechanism as the ‘Network Overlap’ section, except that there is no time window used.**
**We expect different results since any overlap will be magnified, abet at the cost of reduced resolution.**

## Total Overlap

- 1

- 21

- 1

- 21

- Index number indicates network

- > 10 %
- > 5 – 10 %
- > 0 – 5 %
- 0 %

## Results of Structure Search

**Of the three methods looked at, all agreed on a set of networks which tended to see the same set of attackers:**
**{2,3}, {2,5}, {7,8}, {2,3,5}, {2,3,5,7,8}**
**Note this is out of a total of 21 discrete networks.**

## So What?

**If you know who is most likely to be scanned together, you can share information more quickly.**
**Given that there is such a structure, what can we *****measure***** about it ...**

## What to Measure?

**There are a number of things that we measured:**
**Direction bias.**
**Scanning velocity.**
**Directed vs. Radiation like scanning.**

## Direction Bias

**Simple initial question: are scanners on the whole right or left handed?**
**Sort timestamps for identified scanners by the networks IP address: you end up with something like:**
**<t****1 ****, t****2 ****, t****3 ****, t****4 ****, t****5 ****, t****6****>**
**Just move along the sorted list – if the next numbers value is greater than the current, the scanner is moving toward the right.**

## Results

| Left | Right |
| --- | --- |
| 179858 (.464) | 207263 (.536) |

- Bias in Structure

| Minimum Instances | Left | Right |
| --- | --- | --- |
| 6 | 118 (.480) | 128 (.520) |
| 5 | 194 (.430) | 257 (.570) |
| 4 | 357 (.430) | 473 (.570) |
| 3 | 839 (.626) | 502 (.374) |

- Bias in Control

- If an address is in the structure list it is not allowed in the control group

## Scanning Velocity

**The measurements look at both internet and intranet velocities.**
***Internet***** velocity is approximated by taking the distance between the first addresses in each of the networks and dividing by the difference in the initial contact time.**
***Intranet***** velocity is approximated by taking the total number of hosts that a scanner touches and dividing by the time between the first and last connections.**

## Internet Velocity

- Velocity units: hosts/sec
- The spike for NUM is at 254 which is extremely common.
- Numbers are lower than initially expected, but consistent with other observers values

## Inter vs Intranet Velocity

- Velocity calculated for a single pair of class B networks: NET2 and NET3 (LBNL address space)
- Climbing internet velocity a byproduct of small delta t values dominating behavior.
- Spike lands exactly where distance between nets divided by 24 hours.  Represents continuously scanning systems or period > 24 hours.

## Velocity Assumptions

**Interesting problem: It is not always clear when an address’ scanning begins and ends.**
**We assume the closest possible time is a match so if an address is scanning networks A and B at times T****A1****, T****A2**** and T****B1****, the time difference would be |T****B1**** – T****A2****|.**
**This may introduce a systematic error.**

## Directed vs. Radiation Scanning

- Directed Scanning

- Radiation Scanning

**TRW Threshold**

**Scan Threshold**

**Scanning Count**

**Radiation destination is randomly derived.  Directed scanning focuses on a specific network.  Radiation candidates count as TRW but not scanners.**

## Data Representation

**Data is complex, but by plotting ratio of radiation/directed over time.  **
**Structures which are stable will continue over time.**
**Networks 2, 3 and 5 (mislabeled 4!) are part of the observed structure.  **
**Networks 7 and 8 do not have TRW data associated with them so they are not included.**

## Radiation vs. Direct Scanning

## Future Work

**Expand scope of analysis to a more diverse collection of networks.**
**Re-evaluate analysis based on feedback from this run.**
**Better communication and organization of data and results.**
**Sharing of data with other researchers.**