MA
M.F. Açıkkollu
info
Please Note
<p>This page displays the records of the person named above and is not linked to a unique person identifier. This record may need to be merged to a profile.</p>
2 records found
1
Correlating Proxy Scanning with Malicious Exploitation
Measuring the Path from Proxy Discovery to Malicious Use
Open proxies are abused to anonymize malicious traffic, yet the pipeline from proxy discovery to active exploitation has not been directly measured. Prior measurement work obtains proxies from public aggregator lists, bypassing the scanning phase entirely. We address this gap by combining a network telescope with a high-interaction proxy honeypot: the telescope captures probes from Internet-wide scanners and the honeypot logs full connection payloads, linked to telescope observations by source IP. Over 21 active measurement days, 2.79% of the 325,870 IPs observed scanning proxy ports in the telescope also connected to the honeypot. Of those that sent a non-benign payload, 33.8% did so within 24 hours of their first telescope SYN, with a median scan-to-exploit interval of 45.8 hours (IQR 17.3–179.9 h; n = 71). Across the active period, 4.5 million unique payloads were recorded. Offline LLM classification of 169,444 of these identifies 12 abuse categories spanning DoS flooding, credential stuffing, financial fraud, botnet propagation and RCE exploitation. Manual payload fingerprinting further identifies 17 named campaigns. These results show that the transition from proxy scanning to exploitation is operationally fast, structurally diverse and measurable from the proxy's perspective.
...
Open proxies are abused to anonymize malicious traffic, yet the pipeline from proxy discovery to active exploitation has not been directly measured. Prior measurement work obtains proxies from public aggregator lists, bypassing the scanning phase entirely. We address this gap by combining a network telescope with a high-interaction proxy honeypot: the telescope captures probes from Internet-wide scanners and the honeypot logs full connection payloads, linked to telescope observations by source IP. Over 21 active measurement days, 2.79% of the 325,870 IPs observed scanning proxy ports in the telescope also connected to the honeypot. Of those that sent a non-benign payload, 33.8% did so within 24 hours of their first telescope SYN, with a median scan-to-exploit interval of 45.8 hours (IQR 17.3–179.9 h; n = 71). Across the active period, 4.5 million unique payloads were recorded. Offline LLM classification of 169,444 of these identifies 12 abuse categories spanning DoS flooding, credential stuffing, financial fraud, botnet propagation and RCE exploitation. Manual payload fingerprinting further identifies 17 named campaigns. These results show that the transition from proxy scanning to exploitation is operationally fast, structurally diverse and measurable from the proxy's perspective.
Detecting Collaborative ZMap Scans
Detection of distributed ZMap scans in network telescope data using an algorithmic approach
Detecting distributed scans is crucial for understanding network security threats. This research uses an algorithmic approach to identify collaborative ZMap scanning activities in the network telescope data from TU Delft. ZMap is a high-speed network scanner capable of scanning the entire IPv4 address space. The main research question centers on creating an algorithm for detecting these distributed scans. The research method includes analyzing network telescope data, examining ZMap packets and modifying the set cover algorithm to detect collaborative ZMap scans. Key contributions include adapting the set cover algorithm to find sources that perfectly cover the entire destination address range without overlaps, which is a unique feature of ZMap scans. Results indicate that this method effectively identifies coordinated scanning activities. It is concluded that utilizing network telescope data and an adapted version of the greedy set cover algorithm significantly improves the detection of distributed scanning operations using ZMap.
...
Detecting distributed scans is crucial for understanding network security threats. This research uses an algorithmic approach to identify collaborative ZMap scanning activities in the network telescope data from TU Delft. ZMap is a high-speed network scanner capable of scanning the entire IPv4 address space. The main research question centers on creating an algorithm for detecting these distributed scans. The research method includes analyzing network telescope data, examining ZMap packets and modifying the set cover algorithm to detect collaborative ZMap scans. Key contributions include adapting the set cover algorithm to find sources that perfectly cover the entire destination address range without overlaps, which is a unique feature of ZMap scans. Results indicate that this method effectively identifies coordinated scanning activities. It is concluded that utilizing network telescope data and an adapted version of the greedy set cover algorithm significantly improves the detection of distributed scanning operations using ZMap.