Abstract
To achieve efficient and effective detection of portscan attacks on high-speed internet backbone links, a new packet sampling technique that focuses on the selection of small packets is introduced and analyzed. A new portscan detection algorithm, SnortHoneypot, which combines the detection techniques of Snort and honeypot is proposed. Under the condition of using systematic sampling, SnortHoneypot is found to have better performance on portscan detection compared with Snort. Meanwhile, this paper performs a comparative analysis of the impact of selective sampling and systematic sampling on portscan detection using real backbone packet traces by applying them to two anomaly detection algorithms: Snort and SnortHoneypot. The experimental results show that, at the same sampling rate, selective sampling exhibits better performance in terms of catching more number of true scanners.
Sign-in/Register to access full text options 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
