Two Pass Port Scan Detection Technique Based on Connection Pattern and Status on Sampled Data

• 作者: Ankit Asati Kamlesh Dutta Sunil Kumar
• 来源期刊: 电脑和通信(英文)
• 学科: 医学
• 关键词: PORT SCAN TRW TAPS CPST PACKET Sampling Flow Sampling
• 年，卷（期）: dnhtxyw_2015,（9）
• 页码范围: 1-8
• 页数: 8页
• 分类号: R73

摘要

Anomaly detection is now very important in the network because the increasing use of the internet and security of a network or user is a main concern of any network administrator. As the use of the internet increases, so the chances of having a threat or attack in the network are also increasing day by day and traffic in the network is also increasing. It is very difficult to analyse all the traffic data in network for finding the anomaly in the network and sampling provides a way to analyse the anomalies in network with less traffic data. In this paper, we propose a port scan detection approach called CPST uses connection status and pattern of the connections to detect a particular source is scanner or benign host. We also show that this approach works efficiently under different sampling methods.