On Detection for Scarcely Collided Super-Slow Port Scannings in IDSs' Log-Data
Kazuyoshi Furukawa, Satoru Shimizu, Masahiko Takenaka, Satoru Toriil · Journal of Communications · 2013
Recently, cyber-attacks against governments and enterprises more intensified, these have already taken on “Cyber-warfare.” Because the attack technics are more artful, it is too difficult to defend them perfectly. We began this research because super-slow port scannings are extracted from IDSs’ log-data placed in our managed networks for 4 months. In order to extract similar scannings from large log-data, a systematical detection method is required. In this paper, we propose a detection method of scarcely collided super-slow port scannings. This method uses only -value of number of accesses per each port without relying on time rate of traffic count. And, we report that plural kinds of scarcely collided super-slow port scannings can be detected in the IDSs’ log-data.