<div class="description">
<p>This thesis examines the feasibility of passively fingerprinting network reconnaissance tools. Detecting  reconnaissance is a key early indication and warning of an adversary's impending attack or intelligence gathering  effort against a network. Current network defense tools provide little capability to detect, and much less specifically  identify, network reconnaissance. This thesis introduces a methodology for identifying a network reconnaissance  tool's unique fingerprint. The methodology confirmed the utility of previous research on visual fingerprints,  produced characteristic summary tables, and introduced the application of TCP sequence number analysis to  reconnaissance tool fingerprinting. We demonstrate the use of these methods to fingerprint network reconnaissance  tools used in a real-world Cyber Defense Exercise scenario.
</p>
<br>Subjects: Computer networks; Fingerprints</div>
<div class="fn value">
Beecroft, Alexander J.</div>
Internet Archive identifier