Detecting network portscans through anomoly detection
Hyukjoon Kim, Surrey Kim, Michael A. Kouritzin, Wei Sun · Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE · 2004
In this note, we consider the problem of detecting network portscans through the use of anomaly detection. First, we introduce some static tests for analyzing traffic rates. Then, we make use of two dynamic chi-square tests to detect anomalous packets. Further, we model network traffic as a marked point process and introduce a general portscan model. Simulation results for correct detects and false alarms are presented using this portscan model and the statistical tests.