Slow Port Scanning Detection

الموضوعات

علوم تطبيقية وتكنولوجية

الملخص

Port scanning represents a sizable portion of today’s internet traffic. An attackerperforms port scans of IP addresses to find vulnerable hosts to compromise. Portscanning detection has received a lot of attention by researchers. However a slow portscan attack can deceive most of the existing Intrusion Detection Systems (IDS). In thisproject, we present a new, simple, and efficient method for detecting slow port scans.Our proposed method is mainly composed of two phases: (1) a feature collectionphase that analyzes network traffic and extracts the features needed to classify acertain IP as malicious or not. (2) A classification phase that divides the IPs, based onthe collected features, into two groups: suspicious IPs and scanner IPs. The IPs of ourapproach classified as suspicious are kept and their destination ports for the next (K)time windows for further examination to decide whether they represent scanners orlegitimate users. A small Local Area Network was put together to test our proposedmethod. The experiments show the effectiveness of our proposed method in correctlyidentifying malicious scanners when both normal and slow port scan were performedusing the three most common TCP port scanning techniques(TCP SYN, Half connect,FIN ).

روابط وملفات

التعريف والنوع

رقم الوثيقة

f42ea052-e90b-404f-aeda-7e5d7c7afd03

رقم العقد

0

نوع الوسائط

Crawler

نوع المحتوى

الرسائل العلمية

صيغة المصدر

ماستر (LMD)

نوع الملف

pdf text

أسماء الملفات

191901_10.pdf, 191901_11.pdf, 191901_12.pdf, 191901_13.pdf, 191901_14.pdf, 191901_15.pdf, 191901_16.pdf, 191901_17.pdf, 191901_18.pdf, 191901_19.pdf, 191901_2.pdf, 191901_20.pdf, 191901_21.pdf, 191901_22.pdf, 191901_3.pdf, 191901_4.pdf, 191901_5.pdf, 191901_6.pdf, 191901_7.pdf, 191901_8.pdf, 191901_9.pdf

بيانات النشر

ألقاب المؤلفين

[{"name_ar":" Amel Daoud","title_ar":"اعداد","title_en":"Preparation"},{"name_ar":"lalia Saoudi ","title_ar":"اشراف","title_en":"Supervision"}]

اللغة

French

المصدر والدورية

اسم المصدر

Slow Port Scanning Detection

المحتوى والصفحات

عدد الصفحات

0

إشراف وإعداد

الإشراف

lalia Saoudi

الإعداد

Amel Daoud

الاقتباسات الببليوغرافية