Coordinated Scan Detection Algorithm Based on the Global Characteristics of Time Sequence

Scanning acquires status information regarding target hosts. In networks, attackers often conduct coordinated scans of the target host or network segment because such scans are efficient and stealthy. However, an algorithm that effectively detects coordinated scans has not yet been developed. In this study, we identify a coordinated scan under a single controller during a clustering analysis of the scan sequence. This scan sequence was determined through time sequence, and the clustering analysis was based on the global characteristics of the time sequence. Simulation and test results demonstrated that the proposed algorithm can detect scans more frequently and more accurately than existing algorithms.