DeepPort: Detect Low Speed Port Scan Using Convolutional Neural Network

Abstract

Port scanning is a widely used technology in reconnaissance, which aims to determine remotely the running services on the target TCP/UDP ports. Current research works have achieved acceptable performance for detection of conventional port scanning, which use handcrafted features such as packets receiving rate, count of requesting ports and packets arriving time distribution. However, advanced attacks such as APT usually employ low-speed scans to lower the risk of exposure. Nevertheless, it is a challenge to precisely detect a low-speed scan since it has much coarser features that are hard to be matched by the current approaches. We propose a novel method DeepPort to solve this problem. DeepPort filters out a majority of normal packets using their well-defined features. Thereafter, DeepPort detects port scans using learned features using a dedicated Convolutional Neural Network (CNN) that is trained from real scanning packets under various time interval configurations. The experiments carried in our campus network show that DeepPort can detect 10 class of low-speed scans with a precision of 97.4% and a recall of 96.9%.