A Practical Approach to Portscan Detection in Very High-Speed Links
Port scans are continuously used by both worms and human attackers to probe for vulnerabilities in Internet facing systems. In this paper, we present a new method to efficiently detect TCP port scans in very high-speed links. The main idea behind our approach is to early discard those handshake packets that are not strictly needed to reliably detect port scans. We show that with just a couple of Bloom filters to track active servers and TCP handshakes we can easily discard about 85% of all handshake packets with negligible loss in accuracy. This significantly reduces both the memory requirements and CPU cost per packet. We evaluated our algorithm using packet traces and live traffic from 1 and 10 GigE academic networks. Our results show that our method requires less than 1 MB to accurately monitor a 10 Gb/s link, which perfectly fits in the cache memory of nowadays’ general-purpose processors.
Unable to display preview. Download preview PDF.
- 1.UPC/CESCA traces, http://monitoring.ccaba.upc.edu/portscan/traces
- 2.MAWI Working Group Traffic Archive, http://mawi.wide.ad.jp/mawi/
- 4.Barlet-Ros, P., et al.: Load shedding in network monitoring applications. In: Proc. of USENIX ATC (2007)Google Scholar
- 5.Brauckhoff, D., Tellenbach, B., Wagner, A., May, M., Lakhina, A.: Impact of packet sampling on anomaly detection metrics. In: Proc. of ACM SIGCOMM IMC (2006)Google Scholar
- 6.Jung, J., et al.: Fast portscan detection using sequential hypothesis testing. In: 2004 IEEE Symposium on Security and Privacy (2004)Google Scholar
- 7.Mai, J., Sridharan, A., Chuah, C.N., Zang, H., Ye, T.: Impact of packet sampling on portscan detection. IEEE J. Select. Areas Commun. (2006)Google Scholar
- 8.Manerikar, N., Palpanas, T.: Frequent items in streaming data: An experimental evaluation of the state-of-the-art. Data & Knowledge Engineering (2009)Google Scholar
- 10.Mikians, J., et al.: Span-Dec data structure in portscan detection. Technical report (2010), http://monitoring.ccaba.upc.edu/portscan/portscan-report.pdf
- 11.Nam, S., Kim, H., Kim, H.: Detector SherLOCK: Enhancing TRW with Bloom filters under memory and performance constraints. Computer Networks (2008)Google Scholar
- 12.Paxson, V.: Bro: a system for detecting network intruders in real-time. Comput. Netw (1999)Google Scholar
- 13.Robertson, S., et al.: Surveillance detection in high bandwidth environments. In: Proc. of DARPA Information Survivability Conference and Exposition (2003)Google Scholar
- 15.Sridharan, A., Ye, T., Bhattacharyya, S.: Connectionless port scan detection on the backbone. In: Proc. of IPCCC (2006)Google Scholar
- 16.Weaver, N., Staniford, S., Paxson, V.: Very fast containment of scanning worms. In: Proc. of the 13th Conf. on USENIX Security Symposium (2004)Google Scholar