DETECTING NETWORK RECONNAISSANCE BY TRACKING INTRANET DARK-NET COMMUNICATIONS

摘要

A method and system for detecting network reconnaissance is disclosed wherein network traffic can be parsed into unidirectional flows that correspond to sessions. A learning module may categorize computing entities inside the network into assets and generate asset data to monitor the computing entities. If one or more computing entities address a flow to an address of a host that no longer exists, ghost asset data may be recorded and updated in the asset data. When a computing entity inside the network contacts an object in the dark-net, the computing entity may be recorded a potential mapper. When the computing entity tries to contact a number of objects in the dark-net, such that a computed threshold is exceeded, the computing entity is identified a malicious entity performing network reconnaissance.

主权项

1. A system for detecting network reconnaissance in a network having a plurality of host entities, comprising:
a flow pre-processor engine having a parsing module that receives packets in an internal network and generates one or more flow datasets that correspond to one or more sessions; a learning module having a validation unit that generates asset data based at least in part on a successful reciprocal communication between host entities in the network; and, a detection module having a correlation unit that generates dark-net connection attempt data for the plurality of host entities and a reporting unit that generates report data if a number of attempts by one of the hosts to connect to dark-net objects surpasses a threshold.