Skip to main content

Technical Reports: CMU-CyLab-07-004

Title:Distributed Evasive Scan Techniques and Countermeasures
Authors:Min Gyung Kang, Juan Caballero, Dawn Song
Publication Date:February 9, 2007

Abstract

Scan detection and suppression methods are an important means for preventing the disclosure of network information to attackers. However, despite the importance of limiting the information obtained by the attacker, and the wide availability of such scan detection methods, there has been very little research on the evasive scan techniques, which can potentially be used by attackers to avoid detection. In this paper, we first present a novel classification of scan detection methods based on their amnesty policy, since attackers usually take advantage of such policies to evade scan detection methods. Then we propose two novel metrics to measure the resources that an attacker needs to complete a scan without being detected. Following, we introduce z-Scan, a novel evasive scan technique that uses distributed scanning, and show that it is extremely effective against TRW, one of the state-of-the-art scan detection methods. Finally, we investigate possible countermeasures including hybrid scan detection methods and informationhiding techniques. We provide theoretical analysis, as well as simulation results, to quantitatively measure the effectiveness of the evasive scan techniques and the countermeasures.

Full Report: CMU-CyLab-07-004