论文信息 - Feasibility of detecting TCP-SYN scanning at a backbone router

Feasibility of detecting TCP-SYN scanning at a backbone router

IP address and TCP/UDP port scanning are critical components of many network attacks. Such scanning allows attackers to spread a self-propagating worm or collect detailed information about end-hosts in preparation for attacks. This paper investigates an algorithm to detect TCP-SYN scanning. Special care is taken to detect even stealthy scanners. Attackers are detected by tracking the number of half-open connections generated by each source. However, a source is only tracked until it is clear that it is not currently scanning. The computational load of this method is analyzed and it is found that the method is not computationally intensive and is suitable for online detection of scanning even on backbone links. Specifically, on a backbone link investigated it was found that the total number of sources that needs to be tracked at any one time is at most a few thousand.

K. Shah | S. Bohacek | A. Broido

[1] Marco de Vivo,et al. A review of port scanning techniques , 1999, CCRV.

[2] Eugene H. Spafford,et al. The Internet Worm Incident , 1989, ESEC.

[3] Cynthia Bailey Lee,et al. Detection and Characterization of Port Scan Attacks , 2003 .

[4] Vinod Yegneswaran,et al. Internet intrusions: global characteristics and prevalence , 2003, SIGMETRICS '03.

[5] Kimberly C. Claffy,et al. Their Share: Diversity and Disparity in IP Traffic , 2004, PAM.

[6] I. Damgård,et al. The protocols. , 1989, The New Zealand nursing journal. Kai tiaki.

[7] Stefan Savage,et al. The Spread of the Sapphire/Slammer Worm , 2003 .

[8] Stuart Staniford-Chen,et al. Practical Automated Detection of Stealthy Portscans , 2002, J. Comput. Secur..

[9] Heejo Lee,et al. On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets , 2001, SIGCOMM '01.