Distributed Port Scan Detection

Abstract

Conventional network intrusion detection systems (NIDS) have heavyweight processing and memory requirements as they maintain per flow state using data structures such as linked lists or trees. This is required for some specialized jobs such as stateful packet inspection (SPI) where the network communications between entities are recreated in their entirety to inspect application-level data. The downside to this approach is that the NIDS must be in a position to view all inbound and outbound traffic of the protected network. The NIDS can be overwhelmed by a distributed denial of service attack since most such attacks try and exhaust the available state of network entities. For some applications, such as port scan detection, we do not need to reconstruct the complete network traffic. We propose integrating a detector into all routers so that a more distributed detection approach can be achieved. Since routers are devices with limited memory and processing capabilities, conventional NIDS approaches do not workwhile integrating a detector in them. We describe a method to detect port scans using aggregation. A data structure called a partial completion filter (PCF) or a counting Bloom filter is used to reduce the per flow state.