Detecting Scans at the ISP Level
Scans are often used by adversaries to determine the potential weaknesses in a target network or system prior to an intrusion attempt. In other cases, exploits are packaged with the scans themselves. This report presents a novel approach to detecting scans (including very stealthy scans) against, or passing through, very large networks. It meets operational requirements that are particular to detecting scans in ISP level networks.
This scan-detection approach performs an ongoing, incremental analysis of flow-level data regarding traffic inbound to a network. It is multi-dimensional and flexible, based on up to 21 characteristics describing traffic collected from any single source.
The report describes in detail a method developed to provide a probability that a particular traffic sample contains a scan. In validation testing using a manual analysis of traffic collected from a high-volume network, this method correctly classified 99.3% of TCP traffic samples.
This report is related to the following area(s) of work:
Security and SurvivabilityTechnical Report
CMU/SEI-2006-TR-005
April 2006
Cite This Report
SEI:
Gates, Carrie; McNutt, Josh; Kadane, Joseph; & Kellner, Marc. Detecting Scans at the ISP Level (CMU/SEI-2006-TR-005). Software Engineering Institute, Carnegie Mellon University, 2006. http://www.sei.cmu.edu/library/abstracts/reports/06tr005.cfm
IEEE:
C. Gates, J. McNutt, J. Kadane, and M. Kellner, "Detecting Scans at the ISP Level," Software Engineering Institute, Carnegie Mellon University, Pittsburgh, Pennsylvania, Technical Report CMU/SEI-2006-TR-005, 2006. http://www.sei.cmu.edu/library/abstracts/reports/06tr005.cfm
APA:
Gates, C., McNutt, J., Kadane, J., & Kellner, M. (2006). Detecting Scans at the ISP Level (CMU/SEI-2006-TR-005). Retrieved May 25, 2013, from the Software Engineering Institute, Carnegie Mellon University website: http://www.sei.cmu.edu/library/abstracts/reports/06tr005.cfm
CHI:
Gates, Carrie, Josh McNutt, Joseph Kadane, and Marc Kellner. Detecting Scans at the ISP Level (CMU/SEI-2006-TR-005). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2006. http://www.sei.cmu.edu/library/abstracts/reports/06tr005.cfm
MLA:
Gates, C., McNutt, J., Kadane, J., & Kellner, M. 2006. Detecting Scans at the ISP Level (Technical Report CMU/SEI-2006-TR-005). Pittsburgh: Software Engineering Institute, Carnegie Mellon University. http://www.sei.cmu.edu/library/abstracts/reports/06tr005.cfm
Find Us Here
Share This Page
For more information
