Detection of TCP SYN Scanning Using Packet Counts and Neural Network

Soniya, B.; Wiscy, M.

doi:10.1109/sitis.2008.33

Cited by 17 publications

(11 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…More specifically, the authors propose various techniques that correspond to both the misuse detection and anomaly detection. In [2], the authors used a large amount of the different TCP control packets as input for Back Propagation algorithm so as to detect port scans. The learning phase was supported by a training set that contains normal traffic and port scanning attacks.…”

Section: Related Workmentioning

confidence: 99%

Automatic Port Scanner

Mohammed¹

2020

IJISRT

View full text Add to dashboard Cite

In a computer network, an attack is an attempt to destroy or steal unauthorized information or make use of information as an asset. One of the attacks is a reconnaissance attack considered as the first step of a computer attack. This type of attack is mostly done by a black hat, an expert in the programmer, by scanning the internal network devices and gather vulnerability information. In this paper, shows the identification of open ports and services through the network and available IP on the network are possible to attack.

show abstract

Section: Related Workmentioning

confidence: 99%

Automatic Port Scanner

Mohammed¹

2020

IJISRT

View full text Add to dashboard Cite

show abstract

“…More specifically, the authors proposed techniques that correspond to both the anomaly detection and misuse detection. In [7], the researchers used the number of the different TCP control packets and SYN as input for Back Propagation algorithm in order to detect port scans.…”

Section: Literature Reviewmentioning

confidence: 99%

“…In [6], [7], [10], [11] and [13], researchers used some algorithms to detect port scanning attack in network, where some them used data mining technique and others used fuzzy based algorithm. But the problem with existing techniques are, they consider all the scan as a attack while in any network most of scanning are used by system connect () method to establish the communication between client and server.…”

Section: Figure 5 Structure Of Snort Rule Headermentioning

confidence: 99%

Rule-Based Network Intrusion Detection System for Port Scanning with Efficient Port Scan Detection Rules Using Snort

Patel¹,

Sonker²

2016

IJFGCN

View full text Add to dashboard Cite

In the field of network security, researchers have implemented different models to secure the network. Intrusion Detection System is also one of them and Snort is an open source tool for Intrusion Detection and Prevention System. Today intrusion Detection System is a growing technology in network security and mostly researchers have focused in this field, some of them used signature or rule-based technique and some are anomaly based techniques to improve security of network. In this paper we propose a rule-base Intrusion Detection System with our self generated new Efficient Port Scan Detection Rules (EPSDR). These rules will be used to detect naive port scan attacks in real time network using Snort and Basic Analysis Security Engine (BASE). BASE is used to view the snort results in font-end web page because Snort has no graphic user interface. In This rule-based Intrusion Detection

show abstract

“…More specifically, the authors propose techniques that correspond to both the misuse detection and anomaly detection. In [7], the authors used the number of the different TCP control packets as input for Back Propagation algorithm in order to detect port scans. The learning phase was based on a training set that contains normal traffic and port scanning attacks.…”

Section: Related Workmentioning

confidence: 99%

Slow port scanning detection

Dabbagh

Ghandour

Fawaz

et al. 2011

2011 7th International Conference on Information Assurance and Security (IAS)

View full text Add to dashboard Cite

Port scanning is the most popular reconnaissance technique attackers use to discover services they can break into. Port scanning detection has received a lot of attention by researchers. However a slow port scan attack can deceive most of the existing Intrusion Detection Systems (IDS). In this paper, we present a new, simple, and efficient method for detecting slow port scans. Our proposed method is mainly composed of two phases: (1) a feature collection phase that analyzes network traffic and extracts the features needed to classify a certain IP as malicious or not. (2) A classification phase that divides the IPs, based on the collected features, into three groups: normal IPs, suspicious IPs and scanner IPs. The IPs our approach classify as suspicious are kept for the next (K) time windows for further examination to decide whether they represent scanners or legitimate users. Hence, this approach is different than the traditional approach used by IDSs that classifies IPs as either legitimate or scanners, and thus producing a high number of false positives and false negatives. A small Local Area Network was put together to test our proposed method. The experiments show the effectiveness of our proposed method in correctly identifying malicious scanners when both normal and slow portscan were performed using the three most common TCP port scanning techniques. Moreover, our method detects malicious scanners that are otherwise not detected using well known IDSs such as Snort.

show abstract

Detection of TCP SYN Scanning Using Packet Counts and Neural Network

Cited by 17 publications

References 10 publications

Automatic Port Scanner

Automatic Port Scanner

Rule-Based Network Intrusion Detection System for Port Scanning with Efficient Port Scan Detection Rules Using Snort

Slow port scanning detection

Contact Info

Product

Resources

About