Improving the detection of On-line Vertical Port Scan in IP Traffic - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2012

Improving the detection of On-line Vertical Port Scan in IP Traffic

Résumé

We propose in this paper an on-line algorithm based on Bloom filters to detect port scan attacks in IP traffic. Only relevant information about destination IP addresses and destination ports are stored in two steps in a two-dimensional Bloom filter. This algorithm can be indefinitely performed on a real traffic stream thanks to a new adaptive refreshing scheme that closely follows traffic variations. It is a scalable algorithm able to deal with IP traffic at a very high bit rate thanks to the use of hashing functions over a sliding window. Moreover it does not need any a priori knowledge about traffic characteristics. When tested against real IP traffic, the proposed on-line algorithm performs well in the sense that it detects all the port scan attacks within a very short response time of only 10 seconds without any false positive.
Fichier principal
Vignette du fichier
IJSSE.pdf (689.66 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-00773108 , version 1 (29-11-2013)

Identifiants

Citer

Yousra Chabchoub, Christine Fricker, Philippe Robert. Improving the detection of On-line Vertical Port Scan in IP Traffic. CRiSIS 2012 - 7th International Conference on Risks and Security of Internet and Systems, Oct 2012, Cork, Ireland. pp.1-6, ⟨10.1109/CRISIS.2012.6378945⟩. ⟨hal-00773108⟩
393 Consultations
468 Téléchargements

Altmetric

Partager

Gmail Mastodon Facebook X LinkedIn More