Detection of Slow Port Scanning Attacks
Detection of Slow Port Scanning Attacks
复制标题
慢速端口扫描攻击检测
DOI：
--
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
K. Kifayat
中科院分区：
文献类型：
--
作者：
M. Nisa;K. Kifayat
网络安全可以被认为是一组用于保护计算机数据的机密性，完整性和可用性免受威胁的技术。扫描攻击本身并不是一种技术，它实际上是一个两步的过程，第一步是扫描，发现通信信道的漏洞，然后在第二步中发起攻击。因为端口是一个攻击面，因为所有的信息都是通过这个媒介进出计算机的。因此，在端口扫描中，通过网络搜索可用的开放端口，以找出可能被利用的易受攻击的机器。文献中提出了许多慢端口扫描检测解决方案，然而，所有这些方法都使用静态时间段内检测慢端口扫描攻击的方法。本文提出的方法不仅可以检测静态时间间隔上的慢端口扫描攻击，而且可以检测所有在时间间隔上逐渐增加或减少的攻击。此外，这种新提出的方法也被用来检测实时数据上的攻击。进一步的基于数据包的分析，以检测不同类型的端口扫描攻击。实现了不同扫描的所有精度中最好的。所提出的方法还根据所做的尝试对单端口扫描和并行端口扫描进行分类。因此，实现了较快扫描和较慢扫描之间的差异。
Cyber Security can be thought of as a set of techniques used to protect the secrecy, integrity, and availability of computer data against threats. Scanning attack itself is not a technique; In fact, it is a two-step procedure in which scanning is the first step where the vulnerability of communication channels are discovered and then the attack is launched in the second step. Since a port is an attack surface as all the information goes into and out of a computer through this medium. Therefore in port scanning, available open ports are searched over the network to find out the vulnerable machine that can be exploited. Many slow port scan detection solutions were proposed in the literature; however, all of these approaches use methods to detect the slow port scan attacks over the static time period. The approach proposed in this paper can detect the slow port scanning attacks not just over the static time interval but also all the attacks that are made with a gradual increase or decrease in the time duration. Moreover, this new proposed approach is employed to detect attacks over live data also. Further packet-based analysis is performed to detect the different types of port scan attacks. The best of all the accuracy of different scans is implemented. The proposed approach also classifies the single and parallel port scans based on attempts made. Therefore the difference between the faster scans and the slower ones is achieved.