Port Scan Attacks Research Articles

Analysis of a new firewall constructed on Pfsense with Snort to defend against common internet intrusions

This paper aims to design a new firewall based on the detection of common forms of network attacks in the current Internet environment using Snort in combination with the Pfsense network security platform. Firstly, the functions of Snort and Pfsense are introduced, and the shortcomings of traditional firewalls in the current network environment are analyzed. Then analyze the common port scanning attacks, DOS attacks and algorithm complexity attacks, and by means of reviewing the literature, demonstrate that it adopts the network proxy, CNN-BiLSTM intrusion detection model, IBM algorithm, VLDC algorithm and other means to specifically detect common network attacks, so as to achieve the function of specifically defending against network attacks, and to improve the operation efficiency and detection accuracy of the firewall. accuracy of the firewall, etc.

Machine learning-based PortScan attacks detection using OneR classifier

PortScan attacks are a common security threat in computer networks, where an attacker systematically scans a range of network ports on a target system to identify potential vulnerabilities. Detecting such attacks in a timely and accurate manner is crucial to ensure network security. Attackers can determine whether a port is open by sending a detective message to it, which helps them find potential vulnerabilities. However, the best methods for spotting and identifying port scanner attacks are those that use machine learning. One of the most dangerous online threats is PortScan attack, according to experts. The research is work on detection while improving detection accuracy. Dataset containing tags from network traffic is used to train machine learning techniques for classification. The JRip algorithm is trained and tested using the CICIDS2017 dataset. As a consequence, the best performance results for JRip-based detection schemes were 99.84%, 99.80%, 99.80%, and 0.09 ms for accuracy, precision, recall, F-score, and detection overhead, respectively. Finally, the comparison with current models demonstrated our model's proficiency and advantage with increased attack discovery speed.

USING MODIFIED SNIFFER SCRIPTS, IMPLEMENTING LINEAR ALGORITHMS FOR DETECTION OF NETWORK PORT SCAN ATTACKS IN LINUX BASED OPERATING SYSTEMS

In this scientific paper modified sniffer scripts, implementing linear algorithms for detection of network port scan attacks in Linux based operating systems are presented.

Leveraging Graph-Based Representations to Enhance Machine Learning Performance in IIoT Network Security and Attack Detection

In the dynamic and ever-evolving realm of network security, the ability to accurately identify and classify portscan attacks both inside and outside networks is of paramount importance. This study delves into the underexplored potential of fusing graph theory with machine learning models to elevate their anomaly detection capabilities in the context of industrial Internet of things (IIoT) network data analysis. We employed a comprehensive experimental approach, encompassing data preprocessing, visualization, feature analysis, and machine learning model comparison, to assess the efficacy of graph theory representation in improving classification accuracy. More specifically, we converted network traffic data into a graph-based representation, where nodes represent devices and edges represent communication instances. We then incorporated these graph features into our machine learning models. Our findings reveal that incorporating graph theory into the analysis of network data results in a modest-yet-meaningful improvement in the performance of the tested machine learning models, including logistic regression, support vector machines, and K-means clustering. These results underscore the significance of graph theory representation in bolstering the discriminative capabilities of machine learning algorithms when applied to network data.

Network Security Analysis with SnortIDS Using ACID (Analysis Console for Intrusion Databases

The use of Wi-Fi and Ethernet is increasing in today's computer networks due to the advancement of technology. The development of networks today is characterized by the need for low-latency and high-bandwidth technology. The technology has also introduced 5G and Wi-Fi 6 which support high-speed internet surfing. The introduction of Network File System (NFS) in this era sparked the demand for Ethernet. NFS also increased the use of UNIX in education and professional computing in the 1980s. Then, in 1982, Token Ring Topology emerged as an alternative to the internet and was only standardized in 1985. Network security is an important factor in ensuring data is not stolen or damaged. With the increasing knowledge of hacking and cracking, and the availability of tools that can be easily used to launch attacks or intrusions, it is important to investigate when an attack occurs. One network forensic method for monitoring attacks on the network is using Snort IDS and Ntop to facilitate the logging process for monitoring the network system. Based on the results obtained from designing a network security with Snort Intrusion Detection System (IDS) using ACID (Analysis Console for Intrusion Databases) with the utilization of IPTables on Ubuntu Server can stop attackers. In this research, the researcher used IPTables on Ubuntu as a firewall to anticipate attacks. To prevent port scanning attacks conducted by the attacker, the author created a firewall using IPTables where the IPTables rules aim to block the IP address of the attacker.

Intelligent Intrusion Detection System for VANET Using Machine Learning and Deep Learning Approaches

Detecting the attacks in Vehicular Ad hoc Network (VANET) system is very important to provide more secure and reliable communication between all vehicles in the system. In this article, an effective Intelligent Intrusion Detection System (IDS) is proposed using machine learning and deep learning approaches such as Adaptive Neuro Fuzzy Inference System (ANFIS) and Convolutional Neural Networks (CNN), respectively. The existing methods focus on detecting only the known attacks in VANET environment. This limitation is overcome by proposing the Intelligent IDS system using soft computing techniques. The proposed method consists of Known IDS (KIDS) and Unknown IDS (UIDS) modules, which detect both known attacks and unknown attacks. The KIDS module uses ANFIS classification module to detect the known malicious attacks, whereas the UIDS module uses a deep learning algorithm to detect the unknown attacks in VANET. Modified LeeNET (MLNET) architecture is proposed in this article to identify the type of unknown attacks. In this work, DoS attacks, Botnet attacks, PortScan attacks, and Brute Force attacks are detected using this hybrid learning algorithm. The proposed system obtains 96.9% of Pr, 98.3% of Se, 98.7% of Sp, and 98.6% of Acc and consumed 1.75 s for detecting the DoS attack on i-VANET dataset. The proposed system obtains 98.1% of Pr, 98.9% of Se, 98.1% of Sp, and 98.1% of Acc and consumed 0.95 s for detecting the Botnet attack. The proposed system obtains 98.7% of Pr, 99.1% of Se, 98.9% of Sp, and 99.2% of Acc and consumed 1.38 s for detecting the PortScan attack. The proposed system obtains 99.1of Pr, 97.8% of Se, 98.7% of Sp, and 98.5% of Acc and consumed 1.29 s for detecting the Brute Force attack. The developed methodology is tested on the real-time CIC-IDS 2017 dataset, and the experimental results are compared with other state-of-the-art methods.

On Sustained Zero Trust Conceptualization Security for Mobile Core Networks in 5G and Beyond

The rapid increase in data traffic is forcing mobile network operators to enhance and expand their network infrastructure to meet the new requirements of customers’ Service Level Agreements (SLA). Network Function Virtualization (NFV) provides abstractions of core network functions from the vendor-specific hardware. This allows the network functions to move around the cloud, providing better performance and scaling capabilities. However, deploying virtualized mobile core network in the cloud environment opens many security concerns not only regarding communication between the Radio Access Network (RAN) and the mobile core network but also within the core network itself. In this paper, we propose a framework called virtual Evolved Packet Core - virtual Software Defined Perimeter (vEPC-vSDP) to provide secure communications within the mobile core network by using an authentication-based approach. The SDP components are virtualized and placed within the virtualized core network to provide a zero-trust environment where only authenticated and authorized core network elements can have access to one another. The analysis of the proposed vEPC-vSDP framework confirms its ability to shield the core network traffic from both external and internal attacks. The vEPC-vSDP framework was implemented and tested against Denial of Service (DoS), Distributed Denial of Service (DDoS) and port scanning attacks to demonstrate the resilience of the proposed framework. The results show the capability of vEPC-vSDP to provide secure communication path to mobile core network elements.

Human-guided auto-labeling for network traffic data: The GELM approach

Data labeling is crucial in various areas, including network security, and a prerequisite for applying statistical-based classification and supervised learning techniques. Therefore, developing labeling methods that ensure good performance is important. We propose a human-guided auto-labeling algorithm involving the self-supervised learning concept, with the purpose of labeling data quickly, accurately, and consistently. It consists of three processes: auto-labeling, validation, and update. A labeling scheme is proposed by considering weighted features in the auto-labeling, while the generalized extreme learning machine (GELM) enabling fast training is applied to validate assigned labels. Two different approaches are considered in the update to label new data to investigate labeling speed and accuracy. We experiment to verify the suitability and accuracy of the algorithm for network traffic, applying the algorithm to five traffic datasets, some including distributed denial of service (DDoS), DoS, BruteForce, and PortScan attacks. Numerical results show the algorithm labels unlabeled datasets quickly, accurately, and consistently and the GELM’s learning speed enables labeling data in real-time. It also shows that the performances between auto- and conventional labels are nearly identical on datasets containing only DDoS attacks, which implies the algorithm is quite suitable for such datasets. However, the performance differences between the two labels are not negligible on datasets, including various attacks. Several reasons that require further investigation can be considered, including the selected features and the reliability of conventional labels. Even with this limitation of the current study, the algorithm will provide a criterion for labeling data in real-time occurring in many areas.

Link Security Situation Identification Method Based on the Ad Hoc Network of Medical Units.

In order to strengthen the management and security status monitoring of the internal network of medical units and make up for security vulnerabilities in time, an ad hoc network link security situation identification method is proposed. According to the architecture of the ad hoc network, it is analyzed that it has the advantages of strong persistence and its own protocol. Combined with the data of detection equipment and security log, the hierarchical acquisition model is used to obtain the situation elements such as port scanning attack and flood attack. The transmission rate factor, forwarding rate factor, dispersion factor, and node aggregation factor are regarded as eigenvectors. We determine the relationship between identity, difference, and opposition, identify the security situation through the description of the node state, and conduct quantitative processing to obtain the final identification result. The experimental results show that the weight value of this method is the same as the standard weight, which can identify the security situation level, obtain the specific situation value, and present a more intuitive identification result.

A Gated Recurrent Unit Deep Learning Model to Detect and Mitigate Distributed Denial of Service and Portscan Attacks

Nowadays, it is common for applications to require servers to run constantly and aim as close as possible to zero downtime. The slightest failure might cause significant financial losses and sometimes even lives. For this reason, security and management measures against network threats are fundamental and have been researched for years. Software-defined networks (SDN) are an advancement in network management due to their centralization of the control plane, as it facilitates equipment setup and administration over the local network. However, this centralization makes the controller a target to denial of service attacks (DoS). In this study, we aim to develop a network anomaly detection and mitigation system that uses gated recurrent unit (GRU) neural networks combined with fuzzy logic. The neural network is trained to forecast future traffic, and anomalies are detected when the forecasting fails. The system is designed to operate in software-defined networks since they provide network flow information and tools to manage forwarding tables. We also demonstrate how the neural network’s hyperparameters affect the detection module. The system was tested using two datasets: one with emulated traffic generated by the data communication and networking research group called Orion, from computer science department at state university of Londrina, and CICDDoS2019, a well-known dataset by the anomaly detection community. The results show that GRU networks combined with fuzzy logic are a viable option to detect anomalies in SDN and possibly in other anomaly detection applications. We compared our model with other deep learning techniques.

IMPLIKASI R-WALL UNTUK PENDETEKSIAN DAN PENGAMANAN SERANGAN SIBER PADA SERVER

Keamanan berbanding terbalik dengan kenyamanan, semakin nyaman dalam penerapan teknologi maka akan berdampak pada sisi keamanan sistem. Server merupakan salah satu infratruktur yang penting dalam mengelolah data. Mencegah serangan pada Server penting untuk dilakukan. Penerapan firewall dapat meminimalisir serangan yang membahayakan Server. Salah satunya dengan menerapkan aplikasi Intrusion Detection System (IDS) seperti Snort yang memiliki kemampuan untuk mendeteksi serangan yang terjadi pada sistem Server. Pada penelitian ini, penulis melakukan pengembangan sistem yang diberi nama R-Wall. Penerapan R-Wall bertujuan untuk mampu memonitor dan mengamankan server terhadap beberapa metode serangan, antara lain yaitu distribution denial of service (DDoS) ping of death, port scanning, brute force pada layanan file transfer protocol (FTP) dan brute force pada layanan secure shell (SSH). Hasil penerapan ini mampu memberikan notifikasi serangan yang dikirimkan melalui robot Telegram dengan total 247 serangan DDoS ping of death, 8 serangan port scanning, 247 serangan brute force pada layanan FTP dan 208 serangan pada layanan brute force SSH. R-Wall juga mampu melakukan pembatasan akses terhadap penyerang.

An End-to-End Framework for Machine Learning-Based Network Intrusion Detection System

The increase of connected devices and the constantly evolving methods and techniques by attackers pose a challenge for network intrusion detection systems from conception to operation. As a result, we see a constant adoption of machine learning algorithms for network intrusion detection systems. However, the dataset used by these studies has become obsolete regarding both background and attack traffic. This work describes the AB-TRAP framework that enables the use of updated network traffic and considers operational concerns to enable the complete deployment of the solution. AB-TRAP is a five-step framework consisting of ( i) the generation of the attack dataset, (ii) the bonafide dataset, (iii) training of machine learning models, (iv) realization (implementation) of the models, and ( v) the performance evaluation of the realized model after deployment. We exercised the AB-TRAP for local (LAN) and global (internet) environments to detect TCP port scanning attacks. The LAN study case presented an f1-score of 0.96, and an area under the ROC curve of 0.99 using a decision tree with minimal CPU and RAM usage on kernel-space. For the internet case with eight machine learning algorithms with an average f1-score of 0.95, an average area under the ROC curve of 0.98, and an average overhead of 1.4% CPU and 3.6% RAM on user-space in a single-board computer. This framework has the following paramount characteristics: it is reproducible, uses the most up-to-date network traffic, attacks, and addresses the concerns to the model's realization and deployment.

ARIES: A Novel Multivariate Intrusion Detection System for Smart Grid.

The advent of the Smart Grid (SG) raises severe cybersecurity risks that can lead to devastating consequences. In this paper, we present a novel anomaly-based Intrusion Detection System (IDS), called ARIES (smArt gRid Intrusion dEtection System), which is capable of protecting efficiently SG communications. ARIES combines three detection layers that are devoted to recognising possible cyberattacks and anomalies against (a) network flows, (b) Modbus/Transmission Control Protocol (TCP) packets and (c) operational data. Each detection layer relies on a Machine Learning (ML) model trained using data originating from a power plant. In particular, the first layer (network flow-based detection) performs a supervised multiclass classification, recognising Denial of Service (DoS), brute force attacks, port scanning attacks and bots. The second layer (packet-based detection) detects possible anomalies related to the Modbus packets, while the third layer (operational data based detection) monitors and identifies anomalies upon operational data (i.e., time series electricity measurements). By emphasising on the third layer, the ARIES Generative Adversarial Network (ARIES GAN) with novel error minimisation functions was developed, considering mainly the reconstruction difference. Moreover, a novel reformed conditional input was suggested, consisting of random noise and the signal features at any given time instance. Based on the evaluation analysis, the proposed GAN network overcomes the efficacy of conventional ML methods in terms of Accuracy and the F1 score.

Detecting attacks in high-speed networks: Issues and solutions

ABSTRACTIntrusion detection systems are one of the necessities of networks to identify the problem of network attacks. Organizations striving to protect their data from intruders are often challenged by attackers, who find new ways to attack and compromise the security of the network. The detection process becomes quite difficult while dealing with high-speed and distributed attacks that are performed using botnets. These attacks threat both the confidentiality of legitimate users and the infrastructure of the network and to protect them, early discovery of network attacks is important. In this paper, an open source Intrusion Detection System (IDS), Snort is presented as a solution to detect DoS and Port Scan network attacks in a high-speed network. A set of custom rules has been proposed for Snort to detect DoS and Port Scan attacks in high-speed network. The rules are compared and tested using different attack generators like Scapy, Hping3, LOIC and Nmap. Snort’s efficiency in detecting the DoS and Port Scan attacks using the new rules is experimentally proved to be around 99% for all the attacks except for Ping of Death. The proposed system works well for different attack generators in a high-speed network.

The Analysis of Web Server Security For Multiple Attacks in The Tic Timor IP Network

The current technology is changing rapidly, with the significant growth of the internet technology, cyber threats are becoming challenging for IT professionals in the companies and organisations to guard their system. Especially when all the hacking tools and instructions are freely available on the Internet for beginners to learn how to hack such as stealing data and information. Tic Timor IP is one of the organisations involved and engaged in the data center operation. It often gets attacks from the outside networks. A network traffic monitoring system is fundamental to detect any unknown activities happening within a network. Port scanning is one of the first methods commonly used to attack a network by utilizing several free applications such as Angry IP Scan, Nmap and Low Orbit Ion Cannon (LOIC). On the other hand, the snort-based Intrusion Detection System (IDS) can be used to detect such attacks that occur within the network perimeter including on the web server. Based on the research result, snort has the ability to detect various types of attack including port scanning attacks and multiple snort rules can be accurately set to protect the network from any unknown threats.

Long Short-Term Memory and Fuzzy Logic for Anomaly Detection and Mitigation in Software-Defined Network Environment

Computer networks become complex and dynamic structures. As a result of this fact, the configuration and the managing of this whole structure is a challenging activity. Software-Defined Networks(SDN) is a new network paradigm that, through an abstraction of network plans, seeks to separate the control plane and data plane, and tends as an objective to overcome the limitations in terms of network infrastructure configuration. As in the traditional network environment, the SDN environment is also liable to security vulnerabilities. This work presents a system of detection and mitigation of Distributed Denial of Service (DDoS) attacks and Portscan attacks in SDN environments (LSTM-FUZZY). The LSTM-FUZZY system presented in this work has three distinct phases: characterization, anomaly detection, and mitigation. The system was tested in two scenarios. In the first scenario, we applied IP flows collected from the SDN Floodlight controllers through emulation on Mininet. On the other hand, in the second scenario, the CICDDoS 2019 dataset was applied. The results gained show that the efficiency of the system to assist in network management, detect and mitigate the occurrence of the attacks.

Analysis of Intrusion Detection System Performance for the Port Scan Attack Detector, Portsentry, and Suricata

The purpose of this study is to analyze the performance of IDS (PSAD, Portsentry and Suricata). The research methodology used was the Network Development Life Cycle (NDLC). The system has designed through several stages (system requirements analysis, system/software installation, configuration and testing software attacks). The system detects and monitors the number of suspicious activities that occur on the server (using a cloud service) or computer network. In the event of a threat, the system will issue a warning and keep records for analysis. The IDS performance tests are differentiated based on three types of attack (port scanning, DDoS SYN flood and brute force attack), the parameters tested include a speed of detection, detection accuracy and resources usage. Test results showed Suricata and PSAD are superior in detection accuracy (100%). Suricata showed better performance in resources usage (average 1.64% CPU, 8.42% disk), portsentry is only superior to RAM usage (26.89%). PSAD was better in the speed of detection (average 4.21s.). The result concluded Suricata and PSAD better performance to be used as network IDS.

A Network Forensic Framework for Port Scan Attack based on Efficient Packet Capturing

In the last two decades the networks become larger in scale, more complex in structure and more diversified in traffic. Which generate huge amount of network packets such as TCP, UDP and HTTP etc. Log files are repository for captured packets and play a vital role in investigation. However, a significant and obvious limitation of current packet logging is that, data storage volume increases rapidly depending on factors such as network bandwidth and the number of points in the network that need to be tapped. Forensic investigator needs to back up these recorded data to free up recording media and to preserve the data for future analysis. The objective of the proposed work is to build a network forensics framework that precisely scrutinizes only the relevant packets .In this work, a network forensic framework is developed subjected to port scanning attack to mitigate evidence gathering challenges faced by forensic investigator. It captures and processes only fine-grained evidences present in the network traffic stream. Moreover, in the captured relevant log, attack specific discovery is carried out to mine the exact packets utilized to execute the network attack. Hypotheses being developed to validate each machine against attack specific criteria’s. Only those machine who full fill the criteria will be scrutinizes for further analysis. To test and validate the effectiveness of the proposed framework two scenario have been developed, It is observed that developed system preciously securitizes the attack patterns and improved decrement in the log size is observed for both scenario developed that is about 93.12% and 95.65% respectively. It is also observed that only 6.09% and 1.93% of total traffic being scrutinized for NULL, FIN and XMAS attack in scenario 1 and 2 respectively. Similarly 19.88% and 13.42% packets of total packets are scrutinized for TCP Connect and SYN (Half open) scanning variant in scenario 1 and 2 respectively.

Software-Defined Perimeter (SDP): State of the Art Secure Solution for Modern Networks

The boom in the evolution and adoption of new technologies, architectures, and paradigms such as cloud computing, SDN, and NFV in recent years has led to a new set of security and privacy challenges and concerns. These challenges/ concerns include proper authentication, access control, data privacy, and data integrity, among others. SDP has been proposed as a security model/framework to protect modern networks in a dynamic manner. This framework follows a need-to-know model where a device's identity is first verified and authenticated before gaining access to the application infrastructure. In this article, a brief discussion of the security and privacy challenges/concerns facing modern cloud-based networks is presented along with some of the related work from the literature. The SDP concept, architecture, possible implementations, and challenges are described. An SDP-based framework adopting a client-gateway architecture is proposed with its performance being evaluated using a virtualized network testbed for an internal enterprise scenario as a use case. To the best of our knowledge, no previous work has provided a quantitative performance evaluation of such a framework. Performance evaluation results show that the SDP-secured network is resilient to denial of service attacks and port scanning attacks despite needing longer initial connection setup time. The achieved results confirm the promising potential of SDP as a security model/framework that can dynamically protect current and future networks.

Mitigation of DoS and Port Scan Attacks Using Snort

Mitigation of DoS and Port Scan Attacks Using Snort