Mining large network reconnaissance data

This paper examines techniques for a large network infrastructure reconnaissance and dives into a real-world case study of a nation-wide passive network vulnerability assessment. The main goal of this study is to understand methods of a large network risk evaluation and conduct practical experiments using a national network. The main contribution of this paper is a non-intrusive method of a large network infrastructure reconnaissance and an application of acquired data to measure network vulnerability exposures within the analysed network. In this study our assumption is based on an estimation that actual threats come from the actively exploited vulnerabilities. Information on exploit-targeted platforms and vulnerabilities could be easily collected from a large set of malicious websites and automatically turned into signatures. We propose an automated method of building such signatures and use those to analyse the reconnaissance data set to identify ranges of vulnerable systems.