Scan detection under sampling: a new perspective
Ignasi Paredes-Oliva, Pere Barlet‐Ros, Josep Solé‐Pareta · Computer · 2013
In tests using the same fraction of packets for comparison, packet sampling outperformed flow sampling for scan detection, while both selective sampling and a proposed extension that uses significantly less resources were superior to either of these techniques. The Web extra at http://youtu.be/Mgf8_a0fRs0 is a slide show that considers how in tests using the same fraction of packets for comparison, packet sampling outperformed flow sampling for scan detection, while both selective sampling and a proposed extension that uses significantly less resources were superior to either technique.