# Modeling Intruder Reconnaissance Behavior through State Diagrams to Support Defensive Deception
## 2 Related Work  
There are not any efforts in the literature that attempt to directly model the reconnaissance activity and provide a state-of-the-art comparison for the present paper. The most relevant domain that can provide useful input to our work is reconnaissance detection, as it is based on modeling the actual behavior of the intruder we target. Various approaches exist in the literature regarding the detection of the existence of an intruder during host discovery and port scanning operations. These are analyzed in the present section, but no direct comparison is feasible. [PERSON] in [2] discussed approaches for the detection of port scans using IP header data. Through their work, they provided a knowledge basis for port scanning, such as scan types, scan techniques, and hiding scanner identity methods. In addition, different port scanning detection approaches were tested and detection via IP header data was proposed as the optimal solution. [PERSON] et al. in [3] proposed a Rule-Based Network Intrusion Detection System for port scanning with efficient port scan detection rules using snort. Through their work, they provided a basis for port scanning attacks and additionally, they proposed a rule-based network IDS which examines ongoing traffic, transactions, activity, or behavior for matches with known patterns of events specific to known attacks. [PERSON] et al. in [4] provided a review of port scanning techniques. Specifically, they analyzed the most important techniques used by TCP port scanners. [PERSON] et al. in [5] introduced a novel mathematical model that describes the port scanning progress of an intruder and intrusion detection by a defender. Their work further describes a set of emulation experiments that was conducted with a virtual test bed and used to validate the model. [PERSON] et al. in [6] proposed port scanning detection based on network anomalies. Specifically, they reviewed the type of network anomalies (produced by port scans), the main types of port scans, and the peculiarities of the implementation of various types of scans. These data were used to construct a mathematical model and an algorithm for detecting anomalies caused by port scanning. [PERSON] et al. in [7] provided a survey for port scans and their detection methodologies. Through their work, they introduced port scanning technologies and presented a variety of port scanning detection approaches. [PERSON] et al. in [8] presented a classification of network scanning and illustrated how complex and varied this activity is. The presented classification extends previous well-known definitions of scanning traffic in a manner that reflects this complexity. [PERSON] et al. in [9] proposed the detection and characterization of port scan attacks. They analyzed and characterized port scanning traffic by defining a set of heuristics and applying them to the network trace data. They were able to isolate suspicious packets and group them into sets of scans. In addition, these sets were further analyzed to extract the properties of the port scanning traffic and to collect relevant statistics. [PERSON] et al. in [10] provided a rule-based approach for port scanning detection. Their work presented a method for detecting port scanning attacks using rule-based state diagram techniques. Specifically, a set of rules corresponding with the appropriate thresh olds was designed for intrusion decisions. Additionally, the experimental results under real environments showed that port scanning patterns were detected in real time successfully. [PERSON] et al. in [11] provided a comparative review of attacker behavior forecasting methods. The goal of their work was to analyze existing techniques such as (a) techniques based on attack graph analyses, (b) techniques based on the hidden Markov model, (c) techniques based on fuzzy inference, and (d) techniques based on attributing cyber attacks using intelligent data mining techniques, including neural networks, statistics, and so on.