Correlations Between Quiescent Ports in Network Flows (White Paper)
• SEI Report
Publisher
Software Engineering Institute
Topic or Tag
Abstract
TCP/IP ports which are not in regular use (quiescent ports) can show surges in activity for several reasons. Two examples include the discovery of a vulnerability in an unused (but still present) network service or a new backdoor which runs on an unassigned or obsolete port. Identifying this anomalous activity can be a challenge, however, due to the ever-present background of vertical scanning, which can show substantial peak activity. It is, however, possible to separate port-specific activity from this background by recognizing that the activity due to vertical scanning results in strong correlations between port-specific flow counts. We introduce a method for detecting onset of anomalous port-specific activity by recognizing deviation from correlated activity.
Cite This SEI Report
McNutt, J., & Deshon, M. (2005, September 20). Correlations Between Quiescent Ports in Network Flows (White Paper). Retrieved September 17, 2026, from https://www.sei.cmu.edu/library/correlations-between-quiescent-ports-in-network-flows-white-paper/.
@techreport{mcnutt_2005,
author={McNutt, Josh and Deshon, Markus},
title={Correlations Between Quiescent Ports in Network Flows (White Paper)},
month={Sep},
year={2005},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/correlations-between-quiescent-ports-in-network-flows-white-paper/},
note={Accessed: 2026-Sep-17}
}
McNutt, Josh, and Markus Deshon. "Correlations Between Quiescent Ports in Network Flows (White Paper)." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, September 20, 2005. https://www.sei.cmu.edu/library/correlations-between-quiescent-ports-in-network-flows-white-paper/.
J. McNutt, and M. Deshon, "Correlations Between Quiescent Ports in Network Flows (White Paper)," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 20-Sep-2005 [Online]. Available: https://www.sei.cmu.edu/library/correlations-between-quiescent-ports-in-network-flows-white-paper/. [Accessed: 17-Sep-2026].
McNutt, Josh, and Markus Deshon. "Correlations Between Quiescent Ports in Network Flows (White Paper)." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 20 Sep. 2005. https://www.sei.cmu.edu/library/correlations-between-quiescent-ports-in-network-flows-white-paper/. Accessed 17 Sep. 2026.
McNutt, Josh; & Deshon, Markus. Correlations Between Quiescent Ports in Network Flows (White Paper). Software Engineering Institute. 2005. https://www.sei.cmu.edu/library/correlations-between-quiescent-ports-in-network-flows-white-paper/
Related Links
This content was created for a conference series or symposium and does not necessarily reflect the positions and views of the Software Engineering Institute.