Identifying Anomalous Port-Specific Network Behavior
Increasing trends in traffic volume on specific ports may indicate new interest in a vulnerability associated with that port. This activity can be a precursor to internet-wide attacks. Port-specific behavior can also arise from stealthy applications that migrate to different ports in order to evade firewalls. But detecting this subtle activity among thousands of monitored ports requires careful statistical modeling as well as methods for controlling false positives. The analysis documented in this report is a large-scale application of statistical outlier detection for determining unusual port-specific network behavior. The method uses a robust correlation measure to cluster related ports and to control for the background baseline traffic trend. A scaled, median-corrected process, called a Z-score, is calculated for the hourly volume measurements for each port. The Z-score measures how unusual each port's behavior is in comparison with the rest of the ports in its cluster. The researchers discuss lessons learned from applying the method to the hourly count of incoming flow records for a carrier-class network over a period of three weeks.
This report is related to the following area(s) of work:
Security and SurvivabilityTechnical Report
CMU/SEI-2010-TR-010
May 2010
Cite This Report
SEI:
Weaver, Rhiannon; Identifying Anomalous Port-Specific Network Behavior (CMU/SEI-2010-TR-010 ). Software Engineering Institute, Carnegie Mellon University, 2010. http://www.sei.cmu.edu/library/abstracts/reports/10tr010.cfm
IEEE:
R. Weaver, "Identifying Anomalous Port-Specific Network Behavior," Software Engineering Institute, Carnegie Mellon University, Pittsburgh, Pennsylvania, Technical Report CMU/SEI-2010-TR-010 , 2010. http://www.sei.cmu.edu/library/abstracts/reports/10tr010.cfm
APA:
Weaver, R., (2010). Identifying Anomalous Port-Specific Network Behavior (CMU/SEI-2010-TR-010 ). Retrieved May 24, 2013, from the Software Engineering Institute, Carnegie Mellon University website: http://www.sei.cmu.edu/library/abstracts/reports/10tr010.cfm
CHI:
Weaver, Rhiannon, Identifying Anomalous Port-Specific Network Behavior (CMU/SEI-2010-TR-010 ). Pittsburgh, PA: Software Engineering Institute, Carnegie Mellon University, 2010. http://www.sei.cmu.edu/library/abstracts/reports/10tr010.cfm
MLA:
Weaver, R., 2010. Identifying Anomalous Port-Specific Network Behavior (Technical Report CMU/SEI-2010-TR-010 ). Pittsburgh: Software Engineering Institute, Carnegie Mellon University. http://www.sei.cmu.edu/library/abstracts/reports/10tr010.cfm
Find Us Here
Share This Page
For more information
