Reconnaissance Scan Detection Heuristics to disrupt the pre-attack information gathering
J. Udhayan, Muruga Prabu M, Aravinda Krishnan, R. Anitha · 2009
Inception stage of devastating attacks like DDoS attacks and botnet hosted attacks includes compromising numerous computers or networks over the Internet. The Port scanning tools are often used by the attackers not only to identify the vulnerable servers but also to identify the vulnerable network or vulnerable computers over the Internet. If the attackers can identify a single vulnerability then, with the use of malicious codes they can compromise that system and makes it a zombie. By compromising a group of computers the attackers can constitute the malicious botnet or zombie army. These are then used to perform a range of devastating attacks. One possible solution to curb the zombie army or malicious botnet is by detecting and blocking or dropping the reconnaissance scan, otherwise port scan. Numerous port scanning techniques are available today. To detect them all, one single algorithm is not sufficient so we derived a set of heuristics to detect the port scan traffic, even the crafty ones.