L-025
Estimation of attackers' intentions based on observation of scanning activities

○Kim Cuong Ngo・Yasuhiro Nakamura（National Defense Academy）

Intention estimation is the ability to judge and predict the goal of attackers according to attack behavior and network environment. Knowing an attacker’s purposes can support the network security administrators make the right decision to protect the network resources. Additionally, intent analysis plays an important role in the calculation of the essential threat value and it has become a hot research topics in network security area recently. In this paper, a taxonomy of attack intentions in inbound network traffic is introduced, then the attack intention models based on network scanning activities is proposed and used to estimate attackers' intentions.