Visible to the public A predictive zero-day network defense using long-term port-scan recording

TitleA predictive zero-day network defense using long-term port-scan recording
Publication TypeConference Paper
Year of Publication2015
AuthorsKao, Chia-Nan, Chang, Yung-Cheng, Huang, Nen-Fu, Salim S, I, Liao, I.-Ju, Liu, Rong-Tai, Hung, Hsien-Wei
Conference Name2015 IEEE Conference on Communications and Network Security (CNS)
Keywordscomposability, Computer architecture, Computer hacking, defense, Malware, Market research, Metrics, Ports (Computers), pubcrawl, Reconnaissance, resilience, Resiliency, Servers, Zero day attacks
AbstractZero-day attack is a critical network attack. The zero-day attack period (ZDAP) is the period from the release of malware/exploit until a patch becomes available. IDS/IPS cannot effectively block zero-day attacks because they use pattern-based signatures in general. This paper proposes a Prophetic Defender (PD) by which ZDAP can be minimized. Prior to actual attack, hackers scan networks to identify hosts with vulnerable ports. If this port scanning can be detected early, zero-day attacks will become detectable. PD architecture makes use of a honeypot-based pseudo server deployed to detect malicious port scans. A port-scanning honeypot was operated by us in 6 years from 2009 to 2015. By analyzing the 6-year port-scanning log data, we understand that PD is effective for detecting and blocking zero-day attacks. The block rate of the proposed architecture is 98.5%.
DOI10.1109/CNS.2015.7346890
Citation Keykao_predictive_2015