Detecting subtle port scans through characteristics based on interactive visualization
Weijie Wang, Baijian Yang, Yingjie Chen · 2014
Port-scan detection is essentially vital to enterprise networks, since many intrusions start with scanning. A port scan can be obvious or subtle in terms of the volume of network traffic. In this paper, we propose a creative approach by combining the characteristic-based method and visual analytics to detect those hard-to-find subtle scans as well as obvious scans in an enterprise environment. The goal of designing this system is to provide useful information and implications about port-scan attackers and benign hosts to a network security team in a simple and efficient manner. The major components of the system consist of three different semantic level visualizations. Through several use cases, we illustrate how the system can detect both obvious and subtle port-scanning activities. The analysis approach proposed in this study proves to be effective by identifying all the port-scan attackers in the data sets.