🚀 go-pugleaf

Stanislav,

Could not agree with you more...blind escalation of individual port scan
events is NOT productive as there is no conclusive way to determine
whether the activity is bogus or real attack.  Doing so is just going to
overwhelm ISP abuse departments that are already knee deep in SPAM
complaints.

This is why myself (and other aggregators: e.g. Dshield.org) have
developed are building an aggregation network which allows one to
achieve "collective awareness".

Using collective awareness you can't identify all real attacks, but you
CAN apply business rules that identify those that most likely real
attacks.  We ask that agents esclate ALL attack events to us so that we
can apply our rules against completely unfiltered data.  From this raw
data, we do massive filtering and throw out anything that we can't
conclusively identify as an attack...only the remaining few incidents do
we escalate to the source ISP.

To give you an idea on how much we filter see:

http://www.mynetwatchman.com/listincidentsummary.asp

As you can see our Escalation Rate is somewhere around 10%...thus we are
filtering 90%.

Our false-positive rate is remarkably low...in the last 30 days we have
only had ONE incident where the source provider indicated that the
attack was really their load-balancing servers sending DNS queries to
determine RTT and best route.

> The fact that somebody portscanned you or even, gosh, tried a
> well-known exploit blindly and went away is not a reason to bother
> remote admins unless you suspect that they may have an intruder in
> their systems.

Absolutely, but we're finding that 80-90% of the escalations we send the
source system ARE compromised hosts!  See:
http://www.mynetwatchman.com/mynetwatchman/hotclosed.asp


This makes sense since even script kiddies are not stupid enought to
launch direct scans. (Well most of them aren't)

IMHO, reporting port scans (with proper aggregation) can dramatically
reduce the number of compromised hosts on the Internet...this is a good
thing.

-------------------------
Lawrence Baldwin
Protocol Scientist
678-624-0924
http://www.mynetwatchman.com/about.htm - I'm under attack, now what?