Portscan Detection with Sampled NetFlow

  • Ignasi Paredes-Oliva
  • Pere Barlet-Ros
  • Josep Solé-Pareta
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5537)


Sampling techniques are often used for traffic monitoring in high-speed links in order to avoid saturation of network resources. Although there is a wide existing research dealing with anomaly detection, few studies analyzed the impact of sampling on the performance of portscan detection algorithms. In this paper, we performed several experiments on two already existing portscan detection mechanisms to test whether they are robust enough to different sampling techniques. Unlike previous works, we found that flow sampling is not always better than packet sampling to continue detecting portscans reliably.


Anomaly Detection Success Ratio Under Sampling Equal Fraction Worm Propagation 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
  2. 2.
    Roesch, M.: Snort–lightweight intrusion detection for networks. In: Proc. of USENIX Systems Administration Conference (1999)Google Scholar
  3. 3.
    Jung, J., Paxson, V., Berger, A., Balakrishnan, H.: Fast portscan detection using sequential hypothesis testing. In: Proc. of IEEE Symposium on Security and Privacy (2004)Google Scholar
  4. 4.
    Avinash, S., Ye, T., Supratik, B.: Connectionless portscan detection on the backbone. In: Proc. of IEEE International Performance Computing and Communications Conference (2006)Google Scholar
  5. 5.
    Paxson, V.: Bro: a system for detecting network intruders in real-time. Computer Networks 31(23-24) (1999)Google Scholar
  6. 6.
    Mai, J., Sridharan, A., Chuah, C., Zang, H., Ye, T.: Impact of packet sampling on portscan detection. IEEE Journal on Selected Areas in Communications 24(12) (2006)Google Scholar
  7. 7.
    Mai, J., Chuah, C., Sridharan, A., Ye, T., Zang, H.: Is sampled data sufficient for anomaly detection? In: Proc. of ACM SIGCOMM conference on Internet measurement (2006)Google Scholar
  8. 8.
    Brauckhoff, D., Tellenbach, B., Wagner, A., May, M., Lakhina, A.: Impact of packet sampling on anomaly detection metrics. In: Proc. of ACM SIGCOMM conference on Internet measurement (2006)Google Scholar
  9. 9.
    Duffield, N.: Sampling for passive internet measurement: A review. Statistical Science 19(3) (2004)Google Scholar
  10. 10.
    Estan, C., Varghese, G.: New directions in traffic measurement and accounting: focusing on the elephants, ignoring the mice. ACM Transactions on Computer Systems 21(3) (2003)Google Scholar
  11. 11.
    IST-Lobster sensor at UPC:
  12. 12.
    Barlet-Ros, P., Solé-Pareta, J., Barrantes, J., Codina, E., Domingo-Pascual, J.: SMARTxAC: a passive monitoring and analysis system for high-speed networks. Campus-Wide Information Systems 23(4) (2006)Google Scholar
  13. 13.
    Falletta, V., Ricciato, F.: Detecting scanners: empirical assessment on a 3G network. International Journal of Network Security 9(2) (2009)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2009

Authors and Affiliations

  • Ignasi Paredes-Oliva
    • 1
  • Pere Barlet-Ros
    • 1
  • Josep Solé-Pareta
    • 1
  1. 1.Computer Architecture Dept.Universitat Politècnica de Catalunya (UPC)BarcelonaSpain

Personalised recommendations