Heimdallur - Vulnerability Detection Through Internet Scanning

Abstract

As the number of Internet-connected devices grows, so does the likelihood of hackers successfully breaching these devices. In this paper, we present the threat scanner Heimdallur that scans networks to gain an understanding of the security landscape and be a port keeper, watching out for possible threats. In addition to enumerating networks, Heimdallur also gives the IP addresses a threat score, indicating their estimated vulnerability level. This threat score is a novel innovation and our primary contribution. The score serves as an attempt to predict the probability of the network being compromised. It is a cumulative score of weighted factors, such as the number of ports exposed to the Internet and the severity of known vulnerabilities connected to the services running behind those ports. Heimdallur was tested on all Icelandic networks that are publicly accessible but could be used to scan the entire Internet.