Abstract
Port scanning is an extensively used technique by attackers to probe for vulnerabilities in network systems. Since fast port scans can be effectively detected by many existing methods, some advanced attackers perform slow port scans in order not to be suspected. A highly stealthy slow scan can last for dozens of days, which brings significant challenges to current intrusion detection approaches. Besides, the existing port scan detection methods are all based on full traffic. They are not suitable for high-speed networks because of huge computational and storage resource consumption. According to the protocol characteristics and the connection patterns of port scans, we construct a traffic feature set that can not only distinguish the specific scan types, but also remain effective for the sampled traffic. Furthermore, we customize a data structure Scan Detection Sketch (SDS) for feature extraction. Experimental results using public datasets show that our method can detect slow port scans in a 10Gbps high-speed network with high accuracy and acceptable memory consumption. And the proposed method works well even for slow port scans lasting more than 60 days.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.