Scalable Double Filter Structure for Port Scan Detection
Shijin Kong, Tao He, Xiaoxin Shao, Changqing An, Xing Li · 2006 IEEE International Conference on Communications · 2006
Port scan detection is very important to predict network intrusions and prevent viruses from spreading. Many networks deploy Network Intrusion Detection Systems (NIDS) to detect port scans in real-time. However, most NIDS are perflow based. They are not scalable on high speed links since it is infeasible to maintain the states of numerous flows. In this paper, we propose a scalable scheme for real-time port scan detection without keeping any per-flow state. We use a double-filter structure to find outpairs which connect to more than Npairs in T time. The experimental results on real network traces show that our scheme can find out those over-thresholdpairs with high accuracy. It is easy to scale our scheme to high speed environments due to its little memory consumption and fast processing pipeline.