Detecting Scans at the ISP Level
Abstract
Scans are often used by adversaries to determine the potential weaknesses in a target network or system prior to an intrusion attempt. In other eases, exploits are packaged with the scans themselves. This report presents a novel approach to detecting scans (including very stealthy scans) against, or passing through, very large networks. It meets operational requirements that are particular to detecting scans in ISP level networks. This scan-detection approach performs an ongoing, incremental analysis of flow-level data regarding traffic inbound to a network. It is multi-dimensional and flexible, based on up to 21 characteristics describing traffic collected from any single source. The report describes in detail a method developed to provide a probability that a particular traffic sample contains a scan. In validation testing using a manual analysis of traffic collected from a high-volume network, this method correctly classified 99.3% of TCP traffic samples. This report also compares this new approach to other scan approaches, particularly a naive scan approach, based on simple thresholding, and a modified version of the threshold random walk approach, to which it performed comparably. Combining the radom walk approach with the new approach produced very good results, reducing the number of false negatives to zero.
Document Details
- Document Type
- Technical Report
- Publication Date
- Apr 01, 2006
- Accession Number
- ADA448156
Entities
People
- Carrie Gates
- Joseph B. Kadane
- Josh Mcnutt
- Marc Kellner
Organizations
- Carnegie Mellon University