Survey and Taxonomy of Adversarial Reconnaissance Techniques

TL;DR

This paper provides a comprehensive survey and taxonomy of adversarial reconnaissance techniques used in cyber attacks, categorizing methods based on information sources to enhance understanding and defense strategies.

Contribution

It introduces a detailed taxonomy of adversarial reconnaissance techniques based on information sources, aiding in understanding and modeling cyber attack behaviors.

Findings

Categorizes reconnaissance techniques into third-party, human-, and system-based methods.

Provides a comprehensive overview of adversarial reconnaissance tactics.

Offers insights to improve defensive strategies like cyber deception.

Abstract

Adversaries are often able to penetrate networks and compromise systems by exploiting vulnerabilities in people and systems. The key to the success of these attacks is information that adversaries collect throughout the phases of the cyber kill chain. We summarize and analyze the methods, tactics, and tools that adversaries use to conduct reconnaissance activities throughout the attack process. First, we discuss what types of information adversaries seek, and how and when they can obtain this information. Then, we provide a taxonomy and detailed overview of adversarial reconnaissance techniques. The taxonomy introduces a categorization of reconnaissance techniques based on the source as third-party, human-, and system-based information gathering. This paper provides a comprehensive view of adversarial reconnaissance that can help in understanding and modeling this complex but vital aspect of cyber attacks as well as insights that can improve defensive strategies, such as cyber deception.