Title :
A probabilistic approach to detecting network scans
Author :
Leckie, C. ; Kotagiri, R.
Author_Institution :
Dept. of Electr. & Electron. Eng., Melbourne Univ., Parkville, Vic., Australia
Abstract :
This paper presents a probabilistic approach for detecting network scans in real-time. Unlike previous approaches, our model takes into consideration both the number of destinations or ports accessed by a source, as well as how unusual these accesses are. We demonstrate the effectiveness of our approach in terms of accuracy and throughput, based on an analysis of the unusual sources that were found in real-life packet trace files.
Keywords :
packet switching; probability; security of data; telecommunication network management; accuracy; anomaly detection; probabilistic detection algorithm; real-life packet trace files; real-time network scans detection; security management; signature detection; throughput; Intelligent networks; Intrusion detection; Network topology; Operating systems; Performance analysis; Security; Software systems; Telecommunication traffic; Throughput; Traffic control;
Conference_Titel :
Network Operations and Management Symposium, 2002. NOMS 2002. 2002 IEEE/IFIP
Print_ISBN :
0-7803-7382-0
DOI :
10.1109/NOMS.2002.1015594
