Fast portscan detection using sequential hypothesis testing

By Jaeyeon Jung, Vern Paxson, Arthur W. Berger, Hari Balakrishnan. IEEE Symposium on Security and Privacy : Proceedings, 2004

800 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/440b296d3a360bdb6cddaa6802b33d28d235633d

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

An empirical evaluation of entropy-based traffic anomaly detection (2008, neutral): “, failed connections [6]) are necessary.”
Attacks against process control systems: risk assessment, detection, and response (2011, methodology): “SPRT has been widely used in various problems in information security such as detecting portscans [55], worms [56], proxies used by spammers [57], and botnets [58].”
The monitoring and early detection of Internet worms (2005, positive): “Our trend detection system attempts to detect the dynamic trend of monitored traf.c based on the fact that, at the early stage, a worm propagates exponentially with a constant, positive exponential rate.”
Very Fast Containment of Scanning Worms (2004, neutral): “In abstract terms, the algorithm operates by using an oracle to determine if a connection will fail or succeed.”
Research Challenges for the Security of Control Systems (2008, neutral): “Unlike previous work [19, 27], we cannot use a fixed model for the attack hypothesis (this is known in statistics as a simple hypothesis testing problem) because for deception attacks, we do not know the attack sequences αk or βk that an adversary will select.”
Fast Detection of Scanning Worm Infections (2004, methodology): “To detect inbound scans initiated by hosts outside the local network, previous work on which we collaborated [8] used an approach based on sequential hypothesis testing.”
NOX: towards an operating system for networks (2008, neutral): “simple implementation to that in [11], where scan detection required a traffic choke-point and heuristics to guess whether an IP address is active.”
A framework for the evaluation of intrusion detection systems (2006, neutral): “Examples of x used in intrusion detection are sequences of system calls [8], sequences of user commands [26], connection attempts to local hosts [12], proportion of accesses (in terms of TCP or UDP packets) to a given port of a machine over a ﬁxed period of time [19] etc.”
Amplification Hell: Revisiting Network Protocols for DDoS Abuse (2014, background): “propose Threshold Random Walk, an online detection algorithm to detect malicious port scans [11].”
FRESCO: Modular Composable Security Services for Software-Defined Networks (2013, methodology): “Several exemplar security applications demonstrate both threat detection and mitigation in an OpenFlow network, including scan detectors [16] [34] [15] and BotMiner [11].”
Revisiting Traffic Anomaly Detection Using Software Defined Networking (2011, background): “Many ADSs have been proposed during the last few years to detect traffic anomalies in the network core [20,22,29,30,31].”
Characteristics of internet background radiation (2004, background): “A more ne-grained study of remote scanning activity found (for a different day) 13,000 different scanners probing LBL addresses [ 14 ].”
Mining anomalies using traffic feature distributions (2005, background): “Much of the work in anomaly detection and identiﬁcation has been restricted to point-solutions for speciﬁc types of anomalies, e.g. , portscans [14], worms [17,32], DOS attacks [11], and ﬂash crowds [12].”