@conference {18649,
	title = {A Statistical Analysis of Attack Data to Separate Attacks},
	year = {2006},
	month = {2006/06//},
	pages = {383 - 392},
	abstract = {This paper analyzes malicious activity collected from a test-bed, consisting of two target computers dedicated solely to the purpose of being attacked, over a 109 day time period. We separated port scans, ICMP scans, and vulnerability scans from the malicious activity. In the remaining attack data, over 78\% (i.e., 3,677 attacks) targeted port 445, which was then statistically analyzed. The goal was to find the characteristics that most efficiently separate the attacks. First, we separated the attacks by analyzing their messages. Then we separated the attacks by clustering characteristics using the K-Means algorithm. The comparison between the analysis of the messages and the outcome of the K-Means algorithm showed that 1) the mean of the distributions of packets, bytes and message lengths over time are poor characteristics to separate attacks and 2) the number of bytes, the mean of the distribution of bytes and message lengths as a function of the number packets are the best characteristics for separating attacks},
	keywords = {attack data statistical analysis, attack separation, computer crime, Data analysis, data mining, ICMP scans, K-Means algorithm, pattern clustering, port scans, statistical analysis, vulnerability scans},
	doi = {10.1109/DSN.2006.9},
	author = {Michel Cukier and Berthier,R. and Panjwani,S. and Tan,S.}
}
@conference {18657,
	title = {An experimental evaluation to determine if port scans are precursors to an attack},
	year = {2005},
	month = {2005/07/01/june},
	pages = {602 - 611},
	abstract = {This paper describes an experimental approach to determine the correlation between port scans and attacks. Discussions in the security community often state that port scans should be considered as precursors to an attack. However, very few studies have been conducted to quantify the validity of this hypothesis. In this paper, attack data were collected using a test-bed dedicated to monitoring attackers. The data collected consist of port scans, ICMP scans, vulnerability scans, successful attacks and management traffic. Two experiments were performed to validate the hypothesis of linking port scans and vulnerability scans to the number of packets observed per connection. Customized scripts were then developed to filter the collected data and group them on the basis of scans and attacks between a source and destination IP address pair. The correlation of the filtered data groups was assessed. The analyzed data consists of forty-eight days of data collection for two target computers on a heavily utilized subnet.},
	keywords = {attack data collection, computer crime, filtered data groups, ICMP scans, IP address, IP networks, management traffic, port scans, telecommunication security, Telecommunication traffic, vulnerability scans},
	doi = {10.1109/DSN.2005.18},
	author = {Panjwani,S. and Tan,S. and Jarrin,K.M. and Michel Cukier}
}
