Practical automated detection of stealthy portscans

By Stuart Staniford-Chen, James A. Hoagland, J. McAlerney. Journal of computing and security, 2002

565 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/01d6e376e4f68e052d704dcbf4d4b6943d081198

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Bitmap algorithms for counting active flows on high speed links (2003, methodology): “As a result, we can avoid timing-out state as ag-gressively as Snort and keep counting sources with longer inter-arrival times between events detecting more stealthy port scans, a goal of many detection systems [16].”
Fast portscan detection using sequential hypothesis testing (2004, background): “[7]: Efficiency: the ratio of the number of detected scanners (true positives) to all cases flagged as H1.”
Immune system approaches to intrusion detection – a review (2004, background): “Many experimental anomaly detection systems exist including [34, 69, 108] and a commercial system also adopts the anomaly detection approach [4].”
Fast Detection of Scanning Worm Infections (2004, methodology): “As with existing approaches to scan detection [8] [19] [28] [24], we rely upon the observation that only a small fraction of addresses are likely to respond to a connection request at any given port.”
A hybrid machine learning approach to network anomaly detection (2007, methodology): “Staniford [39] is the author of SPADE for anomaly-based port scan detection in Snort.”
A Survey of Network-based Intrusion Detection Data Sets (2019, background): “security-related data [1]–[4], detecting botnets [5]–[8], port scans [9]–[12], brute force attacks [13]–[16] and so on.”
A survey of coordinated attacks and collaborative intrusion detection (2010, methodology): “The primary intention of an attacker who performs a largescale stealthy scan is to gather information about the reachability and the status of particular ports and IP addresses of interest (Staniford, 2002).”
Very Fast Containment of Scanning Worms (2004, unknown): “Although there have been systems proposed to detect very stealthy scanning [22], these systems are currently too resource-intensive for use in this application.”
Internet intrusions: global characteristics and prevalence (2003, methodology): “cept of developing an infrastructure that would pool resources in order to more rapidly and more effectively respond to attacks and intrusions [6, 10, 22].”
Constructing attack scenarios through correlation of intrusion alerts (2002, background): “cult for human users or intrusion response systems to understand the alerts and take appropriate actions.”
Mining intrusion detection alarms for actionable knowledge (2002, background): “Alarm correlation systems [12, 14, 40, 42] try to group alarms so that the alarms of the same group pertain to the same phenomenon (e.g. the same attack).”
Global Intrusion Detection in the DOMINO Overlay System (2004, background): “There is potentially a wide disparity in the sizes and underlying NIDS and firewall software running in these networks, and extensions to provide support for DOMINO would be implemented as plug-ins for these systems.”
An overview of anomaly detection techniques: Existing solutions and latest technological trends (2007, methodology): “In [17], the authors used a simple frequency based approach, to calculate the “anomaly score” of a packet.”
Combining OpenFlow and sFlow for an effective and scalable anomaly detection and mitigation mechanism on SDN environments (2014, methodology): “Our architecture can accept any algorithm such as statistical anomaly detection [20], machine learning based anomaly detection [21] and data mining based anomaly detection [22] as presented in [23,24] due to its modular design principle.”
A taxonomy of DDoS attack and DDoS defense mechanisms (2004, methodology): “Based on the degree of automation, we di(cid:11)erentiate between manual , semi-automatic and automatic DDoS attacks.”
BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, background): “Over the last decade, malicious software or malwarehas risen to become a primary source of most of the scanning [38], (distributed) denial-of-service (DOS) activities [28], and direct attacks [5], taking place across the Internet.”