[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-145597-105":3,"detail-sidebar-cat-0-en-105":81,"doc-detail-145597-en":130},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","analysis-techniques-for-detecting-coordinated-attacks-and-probes-paper","Analysis Techniques for Detecting Coordinated Attacks and Probes - Paper","","Coordinated attacks and probes have targeted multiple protected networks, often embedding known exploits within network traffic. The paper describes observed attack behaviors and explains how and why they are carried out, including hypotheses to clarify puzzling probe activity. It provides detection methods aimed at identifying these concerted efforts, especially when multiple external sources coordinate against a single protected address or present distributed scanning patterns.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/document/","Document",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/document/research-report/","Research & Report",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/document/analysis-techniques-for-detecting-coordinated-attacks-and-probes-paper/145597/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/analysis-techniques-for-detecting-coordinated-attacks-and-probes-paper/145597.png","ImageObject",300,407,{"name":42,"@type":43},"Alex Sinclair","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-31","2026-08-26",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",5,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What are coordinated attacks and probes, according to the paper?","Question",{"text":63,"@type":64},"They are activities where multiple IP addresses work toward a common goal, often targeting a single protected address or appearing as distributed scans across internal addresses or services.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"Why does the paper focus on structured threats?",{"text":68,"@type":64},"Structured threats are methodical, well-supported, and pose the most significant risk for national security, unlike unstructured random threats.",{"name":70,"@type":61,"acceptedAnswer":71},"How can coordinated traceroutes be detected?",{"text":72,"@type":64},"Detection is described as straightforward: look for about five traceroutes within two seconds of one another, often with similar names, probing the same target.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},145597,1790825682,{"code":4,"msg":82,"data":83},"success",[84,88,92,96,100,105,110,114,119,122,126],{"id":22,"doc_module":4,"doc_module_name":25,"category_name":85,"show_sort_weight":86,"slug":87},"Story & Novel",90,"story-novel",{"id":26,"doc_module":4,"doc_module_name":25,"category_name":89,"show_sort_weight":90,"slug":91},"Literature",80,"literature",{"id":33,"doc_module":4,"doc_module_name":25,"category_name":93,"show_sort_weight":94,"slug":95},"Exam",70,"exam",{"id":55,"doc_module":4,"doc_module_name":25,"category_name":97,"show_sort_weight":98,"slug":99},"Comic",60,"comic",{"id":101,"doc_module":4,"doc_module_name":25,"category_name":102,"show_sort_weight":103,"slug":104},6,"Technology",50,"technology",{"id":106,"doc_module":4,"doc_module_name":25,"category_name":107,"show_sort_weight":108,"slug":109},7,"Healthcare",40,"healthcare",{"id":111,"doc_module":4,"doc_module_name":25,"category_name":29,"show_sort_weight":112,"slug":113},8,30,"research-report",{"id":115,"doc_module":4,"doc_module_name":25,"category_name":116,"show_sort_weight":117,"slug":118},9,"Religion & Spirituality",20,"religion-spirituality",{"id":117,"doc_module":4,"doc_module_name":25,"category_name":120,"show_sort_weight":117,"slug":121},"World Cup","world-cup",{"id":123,"doc_module":4,"doc_module_name":25,"category_name":124,"show_sort_weight":123,"slug":125},10,"Lifestyle","lifestyle",{"id":127,"doc_module":4,"doc_module_name":25,"category_name":128,"show_sort_weight":55,"slug":129},19,"General","general",{"code":4,"msg":82,"data":131},{"doc_id":79,"user_id":132,"nickname":42,"user_avatar":133,"doc_module":4,"category_id":111,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":123,"language":139,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":140,"faqs":141,"seo_title":142,"seo_description":12,"update_tm":143,"read_time":144},1099523882182,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","THE ADVANCED COMPUTING SYSTEMS ASSOCIATION  \nThe following paper was originally published in the  \nProceedings of the Workshop on Intrusion Detection and Network Monitoring  \nSanta Clara, California, USA, April 9–12, 1999  \nAnalysis Techniques for Detecting Coordinated Attacks and Probes  \nJohn Green and David Marchette  \nNaval Surface Warfare Center  \nStephen Northcutt  \nBallistic Missile Defense Organization  \nBill Ralph  \nATR Corporation  \n© 1999 by The USENIX Association  \nAll Rights Reserved  \nRights to individual papers remain with the author or the author's employer. Permission is granted for noncommercial reproduction of the work for educational or research purposes. This copyright notice must be included in the reproduced paper. USENIX acknowledges all trademarks herein.  \nFor more information about the USENIX Association:  \nPhone: 1 510 528 8649 FAX: 1 510 548 5738  \nEmail: [office@usenix.org](office@usenix.org) [WWW:](WWW:) [http://www.usenix.org](http://www.usenix.org)  \nAnalysis Techniques for Detecting Coordinated Attacks and Probes  \nJohn Green  \nNaval Surface Warfare Center  \nDavid Marchette  \nNaval Surface Warfare Center  \nStephen Northcutt  \nBallistic Missile Defense Organization  \nBill Ralph  \nATR Corporation  \nAbstract  \nCoordinated attacks and probes have been observed against several networks that we protect. We describe some of these attacks and provide insight into how and why they are carried out. We also suggest hypotheses for some of the more puzzling probes. Methods for detecting these coordinated attacks are provided.  \n1. Introduction  \nFor approximately the last year, SHADOW analysts have been detecting a new class of network traffic. Although the probes and attacks embedded within this traffic consist mostly of known exploits, subsequent analysis reveals that multiple IP addresses are working together toward a common goal. Therefore, we have coined the phrase “coordinated attacks” to describe the activity that has been observed.  \nIndications of these concerted efforts appear in network traffic logs as multiple external IP addresses targeting a single address of the protected network. Similarly, a coordinated attack can also look as though multiple attackers are working together to execute a distributed scan on many internal addresses or services. It is believed that probes of this nature have been developed in an attempt to elude the scan detection code present in many intrusion detection systems.  \nIn most of the cases observed, the number of cooperating IP addresses is rather small; four or five is common. However, as many as fifteen different coactive, scanning hosts have been uncovered by SHADOW analysts. Due to their distributed nature, these attacks were well below the threshold for a structured attack in terms of targeting, lethality and scope.  \n“We distinguish two fundamental types of threat. The unstructured threat is random and relatively limited. It consists of adversaries with limited funds and organization and short-term goals. While it poses a threat to system operations, national security is not targeted. This is the most obvious threat today. The structured threat is considerably more methodical and well-supported. While the unstructured threat is the most obvious threat today, for national security purposes we are concerned primarily with the structured threat, since that poses the most significant risk.”  \nAir Force Lt. Gen. Kenneth A Minihan, director of the National Security Agency - brief to the Senate Government Affairs Committee, June 2 4 1998.  \nWhat is a structured attack? Interviews with premier intrusion detection researchers revealed that they consider structured attacks to be on the order of thousands of related exploits, probes, viruses, scans, denials of service, and ruses over a short period of time. Eventhough this definition doesn’t accurately describe the patterns discussed earlier, we cannot call this activity unstructured. It definitely has structure!  \nThi","cbCaifeW8hORXYql","https://ap.wps.com/l/cbCaifeW8hORXYql","pdf",140978,"English","# Abstract\n# 1. Introduction\n# 2. Coordinated traceroutes","[{\"question\":\"What are coordinated attacks and probes, according to the paper?\",\"answer\":\"They are activities where multiple IP addresses work toward a common goal, often targeting a single protected address or appearing as distributed scans across internal addresses or services.\"},{\"question\":\"Why does the paper focus on structured threats?\",\"answer\":\"Structured threats are methodical, well-supported, and pose the most significant risk for national security, unlike unstructured random threats.\"},{\"question\":\"How can coordinated traceroutes be detected?\",\"answer\":\"Detection is described as straightforward: look for about five traceroutes within two seconds of one another, often with similar names, probing the same target.\"}]","Analysis Techniques for Detecting Coordinated Attacks and Probes - Paper | PDF",1787725593,25]