# Modeling Intruder Reconnaissance Behavior through State Diagrams to Support Defensive Deception
## 3 Background  
Port scanning is a method for determining which ports are active on a computer system. Ports can be assigned to services and they are numbered from 0 to 65,535, but certain ranges are more frequently used. Ports 0 to 1023 are identified as the \"well-known ports\", or standard ports, and have been assigned to specific services by the Internet Assigned Numbers Authority (IANA). Running a port scan on a network reveals which ports are open and listening (receiving information), as well as the presence of security devices such as firewalls that are present between the intruder and the target. Intruders may be driven by different motivations to conduct port scanning. The set of IP addresses and ports (sockets) that are probed in a scan is called a scan's footprint. Three types of footprint are commonly distinguished:  
* Horizontal scans focus on probing two or more hosts for one specific port. This type of scan footprint is common when an intruder has knowledge of how to exploit a particular vulnerability and is in search of a vulnerable host. * Vertical scans focus on probing one host for a larger set of ports. This occurs when an intruder's interest is mapping all potential vulnerabilities of one particular host. * Block scans are both horizontal and vertical, probing a large number of ports on more than one host. On the basis of how port scanning is performed, port scan techniques can be classified into two main categories:  
* Single source port scans, where the intruder can scan the network in a one-to-many model;
* Distributed port scans, where information gathering is performed using either a many-to-one or a many-to-many model. Scan techniques  
Host discovery reconnaissance is distinguished into three different types, namely ICMP, TCP, and UDP. ICMP or Ping scanning aims to map which hosts are active by sending an ICMP Echo Request (ICMP Type 8) to each host. Hosts that are up and running may respond with an ICMP Echo Reply (ICMP Type 0). However, there are cases of operating systems that by default ignore ICMP echo requests. The ICMP protocol also specifies Timestamp Request (ICMP Type 13), Information Request (ICMP Type 15), and Address Mask Request (ICMP Type 17) packets. While the ostensible purpose for these queries is to learn information such as address masks and current times, they can easily be used for host discovery. TCP host discovery can be performed by using TCP packets with an SYN or ACK flag set. In both cases, the goal of the intruder is not to conclude whether the port is open or closed, but to detect a RST or SYN/ACK response that reveals whether the host is available and responsive. Another host discovery option is the UDP ping, which sends a UDP packet to the given ports. On the one hand, if a host is up and available, a closed port should elicit an ICMP Port Unreachable packet in return. On the other hand, for an open port, most services simply ignore the empty packet and fail to return any response. Other types of ICMP errors, such as host/network unreachable or TTL exceeded, are indicative of a host which is down or unreachable. Additionally, there are several techniques for port scanning and they vary depending on the protocol used. The main categories are the following:  
* TCP scan: Through this scan, the intruder attempts to find open ports related to the TCP protocol. Scans consisting of probes that attempt the full TCP three-way handshake are called full TCP connection scans. As regards TCP SYN scans or half-open scanning, only the first packet of the TCP three-way handshake, a segment with the TCP SYN flag set, is sent. A TCP Stealth scan is a type of port scanning designed to be undetected by auditing tools. Through this scan, TCP packets are sent to the destination host with stealth flags, such as NULL, FIN, URG, and PSH. * UDP scan: Through this scan, the intruder attempts to find open ports related to the UDP protocol. However, UDP is a connectionless protocol and can be easily blocked; thus, it is usually not preferred by intruders.