Abstract
Port scans are continuously used by both worms and human attackers to probe for vulnerabilities in Internet facing systems. In this paper, we present a new method to efficiently detect TCP port scans in very high-speed links. The main idea behind our approach is to early discard those handshake packets that are not strictly needed to reliably detect port scans. We show that with just a couple of Bloom filters to track active servers and TCP handshakes we can easily discard about 85% of all handshake packets with negligible loss in accuracy. This significantly reduces both the memory requirements and CPU cost per packet. We evaluated our algorithm using packet traces and live traffic from 1 and 10 GigE academic networks. Our results show that our method requires less than 1 MB to accurately monitor a 10 Gb/s link, which perfectly fits in the cache memory of nowadays’ general-purpose processors.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
UPC/CESCA traces, http://monitoring.ccaba.upc.edu/portscan/traces
MAWI Working Group Traffic Archive, http://mawi.wide.ad.jp/mawi/
Barlet-Ros, P., et al.: Load shedding in network monitoring applications. In: Proc. of USENIX ATC (2007)
Brauckhoff, D., Tellenbach, B., Wagner, A., May, M., Lakhina, A.: Impact of packet sampling on anomaly detection metrics. In: Proc. of ACM SIGCOMM IMC (2006)
Jung, J., et al.: Fast portscan detection using sequential hypothesis testing. In: 2004 IEEE Symposium on Security and Privacy (2004)
Mai, J., Sridharan, A., Chuah, C.N., Zang, H., Ye, T.: Impact of packet sampling on portscan detection. IEEE J. Select. Areas Commun. (2006)
Manerikar, N., Palpanas, T.: Frequent items in streaming data: An experimental evaluation of the state-of-the-art. Data & Knowledge Engineering (2009)
Metwally, A., Agrawal, D., Abbadi, A.E.: Efficient computation of frequent and top-k elements in data streams. In: Eiter, T., Libkin, L. (eds.) ICDT 2005. LNCS, vol. 3363, pp. 398–412. Springer, Heidelberg (2005)
Mikians, J., et al.: Span-Dec data structure in portscan detection. Technical report (2010), http://monitoring.ccaba.upc.edu/portscan/portscan-report.pdf
Nam, S., Kim, H., Kim, H.: Detector SherLOCK: Enhancing TRW with Bloom filters under memory and performance constraints. Computer Networks (2008)
Paxson, V.: Bro: a system for detecting network intruders in real-time. Comput. Netw (1999)
Robertson, S., et al.: Surveillance detection in high bandwidth environments. In: Proc. of DARPA Information Survivability Conference and Exposition (2003)
Schechter, S.E., Jung, J., Berger, A.W.: Fast detection of scanning worm infections. In: Jonsson, E., Valdes, A., Almgren, M. (eds.) RAID 2004. LNCS, vol. 3224, pp. 59–81. Springer, Heidelberg (2004)
Sridharan, A., Ye, T., Bhattacharyya, S.: Connectionless port scan detection on the backbone. In: Proc. of IPCCC (2006)
Weaver, N., Staniford, S., Paxson, V.: Very fast containment of scanning worms. In: Proc. of the 13th Conf. on USENIX Security Symposium (2004)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2011 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Mikians, J., Barlet-Ros, P., Sanjuàs-Cuxart, J., Solé-Pareta, J. (2011). A Practical Approach to Portscan Detection in Very High-Speed Links. In: Spring, N., Riley, G.F. (eds) Passive and Active Measurement. PAM 2011. Lecture Notes in Computer Science, vol 6579. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-19260-9_12
Download citation
DOI: https://doi.org/10.1007/978-3-642-19260-9_12
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-19259-3
Online ISBN: 978-3-642-19260-9
eBook Packages: Computer ScienceComputer Science (R0)