Internet-Wide Scanners Classification using Gaussian Mixture and Hidden Markov Models

Internet-wide scanners are heavily used for malicious activities. This work models, from the scanned system point of view, spatial and temporal movements of Network Scanning Activities (NSAs), related to the difference of successive scanned IP addresses and timestamps, respectively. Based on real logs of incoming IP packets collected from a darknet, Hidden Markov Models (HMMs) are used to assess what scanning tool is operating. The proposed methodology, using only one of the aforementioned features of the scanning tool, is able to fingerprint what network scanner originated the perceived darknet traffic.