Estimation of Behavior of Scanners Based on ISDAS Distributed Sensors

  • Hiroaki Kikuchi
  • Masato Terada
  • Naoya Fukuno
  • Norihisa Doi
Part of the Lecture Notes in Computer Science book series (LNCS, volume 4804)


Given independent multiple access logs, we develop a mathematical model to identify the number of malicious hosts in the current Internet. In our model, the number of malicious hosts is formalized as a function taking two inputs, namely the duration of observation and the number of sensors. Under the assumption that malicious hosts with statically assigned global addresses perform random port scans to independent sensors uniformly distributed over the address space, our model gives the asymptotic number of malicious source addresses in two ways. Firstly, it gives the cumulative number of unique source addresses in terms of the duration of observation. Secondly, it estimates the cumulative number of unique source addresses in terms of the number of sensors.

To evaluate the proposed method, we apply the mathematical model to actual data packets observed by ISDAS distributed sensors over a one-year duration from September 2004, and check the accuracy of identification of the number of malicious hosts.


Active Address Address Space Malicious Code Source Address Network Address Translation 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Terada, M., Takada, S., Doi, N.: Network Worm Analysis System. IPSJ Journal 46(8), 2014–2024 (2005) (in Japanese)Google Scholar
  2. 2.
    Kikuchi, H., Terada, M.: How Many Scanners are in the Internet? In: IWSM 2000. LNCS, Springer, Heidelberg (2001)Google Scholar
  3. 3.
    Jung, J., Paxson, V., Berger, A.W., Balakrishnan, H.: Fast Portscan Detection Using Sequential Hypothesis Testing. In: S&P 2004. Proc. of the 2004 IEEE Symposium on Security and Privacy (2004)Google Scholar
  4. 4.
  5. 5.
    Number of Hosts advertised in the DNS, Internet Domain Survey (July 2005),–07
  6. 6.
    Moore, D., Paxson, V., Savage, S., Shannon, C., Staniford, S., Weaver, N.: Inside the Slammer Worm. IEEE Security & Privacy, pp. 33–39 (July 2003)Google Scholar
  7. 7.
    Shannon, C., Moore, D.: The spread of the Witty worm. IEEE Security & Privacy 2(4), 46–50 (2004)CrossRefGoogle Scholar
  8. 8.
    Changchun Zou, C., Gong, W., Towsley, D.: Code Red Worm Propagation Modeling and Analysis. In: ACM CCS 2002 (November 2002)Google Scholar
  9. 9.
    Moore, D., Shannon, C., Voelker, G., Savage, S.: Network telescopes: technical report, Cooperative Association for Internet Data Analysis (CAIDA) (July 2004)Google Scholar
  10. 10.
    Kumar, A., Paxson, V., Weaver, N.: Exploiting Underlying Structure for Detailed Reconstruction of an Internet-scale Event. In: ACM Internet Measurement Conference (IMC 2005), pp. 351–364 (2005)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2007

Authors and Affiliations

  • Hiroaki Kikuchi
    • 1
  • Masato Terada
    • 2
  • Naoya Fukuno
    • 1
  • Norihisa Doi
    • 3
  1. 1.School of Information Technology, Tokai University, 1117 Kitakaname, Hiratsuka, Kangawa, 259-1292Japan
  2. 2.Hitachi, Ltd. Hitachi Incident Response Team (HIRT), 890 Kashimada, Kawasaki, Kanagawa, 212-8567Japan
  3. 3.Dept. of Info. and System Engineering, Facility of Science and Engineering, Chuo University, 1-13-27 Kasuga, Bunkyo, Tokyo, 112-8551Japan

Personalised recommendations