Feasibility of detecting TCP-SYN scanning at a backbone router

IP address and TCP/UDP port scanning are critical components of many network attacks. Such scanning allows attackers to spread a self-propagating worm or collect detailed information about end-hosts in preparation for attacks. This paper investigates an algorithm to detect TCP-SYN scanning. Special care is taken to detect even stealthy scanners. Attackers are detected by tracking the number of half-open connections generated by each source. However, a source is only tracked until it is clear that it is not currently scanning. The computational load of this method is analyzed and it is found that the method is not computationally intensive and is suitable for online detection of scanning even on backbone links. Specifically, on a backbone link investigated it was found that the total number of sources that needs to be tracked at any one time is at most a few thousand.