Detection of TCP SYN Scanning Using Packet Counts and Neural Network
Soniya Balram, M. Wiscy · 2008
Port scanning is used by malicious users to map the characteristics of a network to launch further attacks. Hence, detection of port scanning assumes paramount importance. This paper investigates the effectiveness of using counts of various TCP control packets in detecting TCP SYN scanning on a single machine. The behavioural characteristics of TCP control packets are aggregated. A neural network is trained to capture this behaviour for normal as well as port scan data. It is seen from the investigation that the counts of TCP SYN, SYN-ACK and FIN packets show definite patterns in their behaviour for legitimate connections. A deviation from this behaviour is used to effectively detect TCP SYN scanning without maintaining state information.