# Modeling Intruder Reconnaissance Behavior through State Diagrams to Support Defensive Deception
## 1 Introduction  
Network security is a broad term that includes mechanisms designed to protect the devices, users, and applications on computer networks and the integrity, confidentiality, and availability of data. Due to the importance of computer networks in recent years, network security mechanisms have become indispensable for any system. Usually, carrying out an attack consists of the following steps. Initially, the intruder tries to gather as much information about the target system as possible from sources such as the target's website, search engines, social media, or publicly available sources (e.g., Shodan). This stage is called passive reconnaissance and the intruder identifies the IP addresses of the hosts of the target infrastructure. The next step is to investigate what services are running on these hosts. This is achieved by using port scanning reconnaissance and this stage is called active reconnaissance because the intruder interacts with the target's machines. The intruder will then try to gain access to the target machine by exploiting vulnerabilities that may exist in some of the services. After that, they will try to escalate their privileges and install persistent remote access mechanisms. Subsequently, the intruder will perform active reconnaissance in the internal network to which he has gained access by using the host as a starting point (lateral movement). As we can observe, the first step always requires gathering information on the target to identify weak points of the targeted system. Therefore, the active reconnaissance stage is quite important and is repeated several times during an attack. Active information gathering consists of two main elements: host discovery and port scanning. Host discovery is the process that identifies what hosts are running in a network. Host discovery in network scanning is often the first step used by intruders before they execute an attack. Port scanning is the process of identifying port availability by sending connection requests to a target computer and recording which ports respond and how. Determining which ports are in use enables intruders to determine which applications and services are active on the target machine. From there, as described in [1], an intruder can check for vulnerabilities and begin to plan an attack. Other techniques that intruders may use such as banner scanning and OS fingerprinting are based on the interpretation of the results obtained by host discovery and port scanning and the relevant activity can actually be modeled through the same approach. Host discovery and port scanning reconnaissance can be achieved through a number of available protocols, such as ICMP, TCP, and UDP, depending on the target's environment, such as the existence of a firewall. Details on the implementation of the above reconnaissance techniques are analyzed in Section 3. As reconnaissance is the first step of most attack plans, it is highly significant to provide tools and methodologies aiming at the fast and accurate detection of it, along with the mitigation of it or the minimization of the obtained knowledge for the intruder. There are numerous efforts in the literature that discuss network security detection and mitigation mechanisms that include, among others, the reconnaissance step of the attack. However, research efforts focusing solely on reconnaissance are very limited in number. The present paper focuses on the reconnaissance step of network attacks and mainly on modeling the process. The proposed methodology provides a robust and detailed representation of the intruders' activity during the reconnaissance step of an attack according to the structure of the network and the intruder's knowledge methodology (potentially incomplete). The proposed approach uses hierarchical state diagrams to represent possible intruders' actions/decisions, producing a set of different paths that the intruder may follow.