A Practical Approach to Portscan Detection in Very High-Speed Links

  • Jakub Mikians
  • Pere Barlet-Ros
  • Josep Sanjuàs-Cuxart
  • Josep Solé-Pareta
Part of the Lecture Notes in Computer Science book series (LNCS, volume 6579)


Port scans are continuously used by both worms and human attackers to probe for vulnerabilities in Internet facing systems. In this paper, we present a new method to efficiently detect TCP port scans in very high-speed links. The main idea behind our approach is to early discard those handshake packets that are not strictly needed to reliably detect port scans. We show that with just a couple of Bloom filters to track active servers and TCP handshakes we can easily discard about 85% of all handshake packets with negligible loss in accuracy. This significantly reduces both the memory requirements and CPU cost per packet. We evaluated our algorithm using packet traces and live traffic from 1 and 10 GigE academic networks. Our results show that our method requires less than 1 MB to accurately monitor a 10 Gb/s link, which perfectly fits in the cache memory of nowadays’ general-purpose processors.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
  2. 2.
    MAWI Working Group Traffic Archive, http://mawi.wide.ad.jp/mawi/
  3. 3.
  4. 4.
    Barlet-Ros, P., et al.: Load shedding in network monitoring applications. In: Proc. of USENIX ATC (2007)Google Scholar
  5. 5.
    Brauckhoff, D., Tellenbach, B., Wagner, A., May, M., Lakhina, A.: Impact of packet sampling on anomaly detection metrics. In: Proc. of ACM SIGCOMM IMC (2006)Google Scholar
  6. 6.
    Jung, J., et al.: Fast portscan detection using sequential hypothesis testing. In: 2004 IEEE Symposium on Security and Privacy (2004)Google Scholar
  7. 7.
    Mai, J., Sridharan, A., Chuah, C.N., Zang, H., Ye, T.: Impact of packet sampling on portscan detection. IEEE J. Select. Areas Commun. (2006)Google Scholar
  8. 8.
    Manerikar, N., Palpanas, T.: Frequent items in streaming data: An experimental evaluation of the state-of-the-art. Data & Knowledge Engineering (2009)Google Scholar
  9. 9.
    Metwally, A., Agrawal, D., Abbadi, A.E.: Efficient computation of frequent and top-k elements in data streams. In: Eiter, T., Libkin, L. (eds.) ICDT 2005. LNCS, vol. 3363, pp. 398–412. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  10. 10.
    Mikians, J., et al.: Span-Dec data structure in portscan detection. Technical report (2010), http://monitoring.ccaba.upc.edu/portscan/portscan-report.pdf
  11. 11.
    Nam, S., Kim, H., Kim, H.: Detector SherLOCK: Enhancing TRW with Bloom filters under memory and performance constraints. Computer Networks (2008)Google Scholar
  12. 12.
    Paxson, V.: Bro: a system for detecting network intruders in real-time. Comput. Netw (1999)Google Scholar
  13. 13.
    Robertson, S., et al.: Surveillance detection in high bandwidth environments. In: Proc. of DARPA Information Survivability Conference and Exposition (2003)Google Scholar
  14. 14.
    Schechter, S.E., Jung, J., Berger, A.W.: Fast detection of scanning worm infections. In: Jonsson, E., Valdes, A., Almgren, M. (eds.) RAID 2004. LNCS, vol. 3224, pp. 59–81. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  15. 15.
    Sridharan, A., Ye, T., Bhattacharyya, S.: Connectionless port scan detection on the backbone. In: Proc. of IPCCC (2006)Google Scholar
  16. 16.
    Weaver, N., Staniford, S., Paxson, V.: Very fast containment of scanning worms. In: Proc. of the 13th Conf. on USENIX Security Symposium (2004)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2011

Authors and Affiliations

  • Jakub Mikians
    • 1
  • Pere Barlet-Ros
    • 1
  • Josep Sanjuàs-Cuxart
    • 1
  • Josep Solé-Pareta
    • 1
  1. 1.UPC BarcelonaTechBarcelonaSpain

Personalised recommendations