# Modeling Intruder Reconnaissance Behavior through State Diagrams to Support Defensive Deception
## 2 Related Work
In addition, the attackers' profile specifications as well as the application of such specifications for the forecasting of the attack's future steps were analyzed. [PERSON] et al. in [12] proposed an attacker behavior analysis approach for a multi-stage attack detection system. Specifically, a hidden Markov model (HMM) was used in order to analyze and predict the attacker's behavior based on what was learned from observed alerts and intrusions. In addition, data mining was used to process alerts and generate the input for the HMM in order to calculate the required probability distribution. [PERSON] et al. in [13] proposed a detection mechanism of TCP SYN scanning using packet counts and neural networks. Specifically, their work investigated the effectiveness of using counts of various TCP control packets in detecting TCP SYN scanning on a single computer. Additionally, the behavioral characteristics of TCP control packets were aggregated to train a neural network with normal and port scanning data. [PERSON] et al. in [14] proposed a technique for network topology deception. Through their research, they analyzed a novel methodology based on the principles of military deception for deceiving malicious trace routes by changing the structure of a network. Moreover, they implemented a topology deception kernel module for a Linux router. The module inspects traffic at the network ingress and identifies inbound UDP trace route probes, for which it then generates spoofed replies to provide the illusion of any topology the deceiver chooses. [PERSON] et al. in [15] proposed an approach to defeat an intruder's fingerprinting effort through deception. In order to defeat OS fingerprinting, they manipulated outgoing traffic so that it resembles traffic generated by a host with a different operating system. Similarly, to defeat service fingerprinting, they modified the service banner by intercepting and manipulating certain packets before they leave the host or network. [PERSON] in [16] introduced a defense mechanism with the purpose of mitigating the benefits an attacker expects from scanning a targeted network. Specifically, this mechanism acts against scanning activity by continuously obfuscating the appearance of the targeted network through a combination of various simple mechanisms, such as traffic forging and random connection dropping. In addition, a method to penalize hosts sending suspicious traffic to the targeted network was proposed. [PERSON] et al. in [17] implemented tools for stealth port scans, such as NULL, FIN, Xmas and ACK, using ZMap, which is part of Censys search engine, and tested the vulnerability of devices in a university network using the implemented tools. As a result, it was observed that it is possible to identify basic information of the hosts, such as port states, services, configurations, and OSs. [PERSON] et al. in [18] presented a method for detecting slow port scans. Their method is mainly composed of two phases: (a) a feature collection phase that analyzes the network traffic and extracts the features needed to classify a certain IP as malicious or not and (b) a classification phase that divides the IPs into three groups based on the collected features: normal IPs, suspicious IPs, and scanner IPs. The IPs that are classified as suspicious are kept for a specified number of time windows for further examination to decide whether they belong to scanners or to legitimate users. The experimental results showed the effectiveness of this approach in correctly classifying IPs and detecting normal and slow port scanning attempts. [PERSON] et al. in [19] designed a system to detect port scan attempts and at the same time find out information about the machine from which the port scan attempts originate, such as the operating system or location. [PERSON] et al. in [20] proposed port scanning attack detection using supervised machine learning classifiers. Specifically, their study focused on detecting port scanning attacks by using different machine learning algorithms and comparing them to find the best one.