PatternCognitionandReconstructionUsingAssociativeMemory.docVIP

Network Scan Visualization Using Associative Memory ABSTRACT Network scan pattern has been studied to monitor the network activity in order to detect potential attacks. Currently a variety of tools exist on network scan pattern visualization, comparison and clustering. Almost most of them use the raw captured network scan dataset. However, the raw scan data may contain noise and distortion that make the pattern comparison difficult to interpret accurately. Machine learning method, in particular, associative memory, has proven to be convenient and efficient in pattern cognition and reconstruction. Therefore, in this article we demonstrate a network scan pattern cognition and reconstruction system using the associative memory model. Keywords: information visualization, security visualization, network scans, associative memory, pattern cognition, pattern reconstruction INTRODUCTION Network attack incidents have rapidly increased in recent years. More and more researchers are putting effort to develop systems for monitoring, analyzing and capturing network attacks. Network scanning has become a common incident. Scanning a network is the very first step in a network attack attempt. A network receives millions of the hostile probes everyday. Most of the probes will do network scans. In order to find the possible attacking object – a computer on the network, the attacker sends connection requests to every network address or IP address and listens for replies. There are a variety of scanning methods, such as ping sweeping, port knocking, OS finger-printing, and fire-walking. By analyzing source IP addresses and packet arrival timing data patterns retrieved from the network scans, we may be able to identify the attackers choice of tools, physical platform and/or network location. Therefore, to identify the network scan data patterns would help in identifying malicious activities and enhancing the network security. Because most of the network scans yield raw captu