Abstract
Detecting adversaries and their intentions during the intelligence gathering step of the attack lifecycle will provide defenders with a strategic advantage. During this step, network scanning tools are a primary resource used by attackers to discover hosts and enumerate services. Tool capabilities and their intent vary and range from scanning for specific services and specific vulnerabilities to large-scale information extraction. By detecting specific tools used during scanning, a defender can infer, to a certain extent, the intentions of an attacker and react accordingly by invoking defenses like dynamic redirection, service blocking, and customized and adaptive honeypots. This paper describes the GEM (Generate, Examine, and Match) system, which implements an automated pipeline mechanism to create rules for intelligence gathering tools. GEM starts by running and collecting data for the tools. It then extracts signatures using differential packet analysis, and finally, it creates Suricata intrusion detection system rules. We tested the system against several scanning tools available on the Kali Linux operating system, totaling 54 configurations. Our analysis shows that the GEM can generate rules for all of the tool configurations. All plaintext configurations can be uniquely identified, and all but six of the 21 encryption configurations can be uniquely identified.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Acosta, J.C., Medina, S., Ellis, J., Clarke, L., Rivas, V., Newcomb, A.: Network data curation toolkit: cybersecurity data collection, aided-labeling, and rule generation. In: MILCOM 2021 IEEE Military Communications Conference (MILCOM), pp. 849–854. IEEE (2021)
Ahrenholz, J., Danilov, C., Henderson, T.R., Kim, J.H.: Core: a real-time network emulator. In: IEEE Military Communications Conference (MILCOM), pp. 1–7. IEEE (2008)
Fallahi, N., Sami, A., Tajbakhsh, M.: Automated flow-based rule generation for network intrusion detection systems. In: 2016 24th Iranian Conference on Electrical Engineering (ICEE), pp. 1948–1953. IEEE (2016)
Fisher, J.: directory-list. https://github.com/daviddias/node-dirbuster/blob/master/lists/directory-list-2.3-small.txt. Accessed 15 Jun 2022
Graham, R.D.: MASSCAN: mass IP port scanner. https://github.com/robertdavidgraham/masscan. Accessed 15 Jun 2022
Jajodia, S., Ghosh, A.K., Swarup, V., Wang, C., Wang, X.S.: Moving Target Defense: Creating Asymmetric Uncertainty for Cyber Threats, vol. 54. Springer, New York (2011). https://doi.org/10.1007/978-1-4614-0977-9
Merkel, D.: Docker: lightweight Linux containers for consistent development and deployment. Linux J. 2014(239), 2 (2014)
Nmap.org: Ncat - Netcat for the 21st Century. https://nmap.org/ncat/. Accessed 15 Jun 2022
Offensive Security: Kali Tools. https://www.kali.org/tools/. Accessed 15 Jun 2022
Open Information Security Foundation (OISF): Suricata. https://suricata.io/. Accessed 15 Jun 2022
Oracle: VirtualBox. https://www.virtualbox.org/. Accessed 15 Jun 2022
The Zeek Project: Zeek. https://zeek.org/. Accessed 15 Jun 2022
Inc Proofpoint: Emerging Threats Rule Documentation Wiki. https://doc.emergingthreats.net/. Accessed 17 Jun 2021
Python Software Foundation: difflib. https://docs.python.org/3/library/difflib.html. Accessed 15 Jun 2022
Sagala, A.: Automatic snort IDS rule generation based on honeypot log. In: 2015 7th International Conference on Information Technology and Electrical Engineering (ICITEE), pp. 576–580. IEEE (2015)
Sanders, M.: AutoPy. https://www.autopy.org/. Accessed 15 Jun 2022
Shiravi, A., Shiravi, H., Tavallaee, M., Ghorbani, A.A.: Toward develo** a systematic approach to generate benchmark datasets for intrusion detection. Comput. Secur. 31(3), 357–374 (2012)
Tenable: Nessus. https://www.tenable.com/. Accessed 15 Jun 2022
The Pallets Projects: **ja2. https://palletsprojects.com/p/**ja/. Accessed 15 Jun 2022
The Wireshark Team: Dumpcap. https://www.wireshark.org/docs/man-pages/dumpcap.html. Accessed 15 Jun 2022
The Wireshark Team: TShark. https://www.wireshark.org/docs/man-pages/tshark.html. Accessed 15 Jun 2022
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Acosta, J.C., Akbar, M., Hossain, M.S., Rivas, V. (2023). Automatic Data Generation and Rule Creation for Network Scanning Tools. In: Arai, K. (eds) Proceedings of the Future Technologies Conference (FTC) 2023, Volume 2. FTC 2023. Lecture Notes in Networks and Systems, vol 814. Springer, Cham. https://doi.org/10.1007/978-3-031-47451-4_38
Download citation
DOI: https://doi.org/10.1007/978-3-031-47451-4_38
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-47450-7
Online ISBN: 978-3-031-47451-4
eBook Packages: Intelligent Technologies and RoboticsIntelligent Technologies and Robotics (R0)