Supervised Learning-Based Fast, Stealthy, and Active NAT Device Identification Using Port Response Patterns

Although network address translation (NAT) provides various advantages, it may cause potential threats to network operations. For network administrators to operate networks effectively and securely, it may be necessary to verify whether an assigned IP address is using NAT or not. In this paper, we propose a supervised learning-based active NAT device (NATD) identification using port response patterns. The proposed model utilizes the asymmetric port response patterns between NATD and non-NATD. In addition, to reduce the time and to solve the security issue that supervised learning approaches exhibit, we propose a fast and stealthy NATD identification method. The proposed method can perform the identification remotely, unlike conventional methods that should operate in the same network as the targets. The experimental results demonstrate that the proposed method is effective, exhibiting a F1 score of over 90%. With the efficient features of the proposed methods, we recommend some practical use cases that can contribute to managing networks securely and effectively.

[1]  Dae-il Jang,et al.  An Intelligent Improvement of Internet-Wide Scan Engine for Fast Discovery of Vulnerable IoT Devices , 2018, Symmetry.

[2]  Jon Postel,et al.  Internet Control Message Protocol , 1981, RFC.

[3]  Nei Kato,et al.  Efficient Delay-Based Internet-Wide Scanning Method for IoT Devices in Wireless LAN , 2020, IEEE Internet of Things Journal.

[4]  T. Kohno,et al.  Remote physical device fingerprinting , 2005, 2005 IEEE Symposium on Security and Privacy (S&P'05).

[5]  Leo Breiman,et al.  Random Forests , 2001, Machine Learning.

[6]  J. L. Hodges,et al.  Discriminatory Analysis - Nonparametric Discrimination: Consistency Properties , 1989 .

[7]  Jacob H. Cox,et al.  Leveraging SDN and WebRTC for Rogue Access Point Security , 2017, IEEE Transactions on Network and Service Management.

[8]  Younchan Jung,et al.  Integrated Management of Network Address Translation, Mobility and Security on the Blockchain Control Plane , 2020, Sensors.

[9]  Peter E. Hart,et al.  Nearest neighbor pattern classification , 1967, IEEE Trans. Inf. Theory.

[10]  Simon Pietro Romano,et al.  Container NATs and Session-Oriented Standards: Friends or Foe? , 2019, IEEE Internet Computing.

[11]  Manisa Pipattanasomporn,et al.  Design and Development of an IoT Gateway for Smart Building Applications , 2019, IEEE Internet of Things Journal.

[12]  Gaël Varoquaux,et al.  Scikit-learn: Machine Learning in Python , 2011, J. Mach. Learn. Res..

[13]  Jean-Pierre Hubaux,et al.  A Location-Privacy Threat Stemming from the Use of Shared Public IP Addresses , 2014, IEEE Transactions on Mobile Computing.