New Sequential Methods for Detecting Portscanners

Details New Sequential Methods for Detecting Portscanners New Sequential Methods for Detecting Portscanners

2012-04-09

arxiv.org/abs/1204.1935v1

Statistics

Applications

11 pages, 5 figures, the mathematical theory of the detection algorithm has been presented in SPIE conferences

Scientific paper

In this paper, we propose new sequential methods for detecting port-scan attackers which routinely perform random "portscans" of IP addresses to find vulnerable servers to compromise. In addition to rigorously control the probability of falsely implicating benign remote hosts as malicious, our method performs significantly faster than other current solutions. Moreover, our method guarantees that the maximum amount of observational time is bounded. In contrast to the previous most effective method, Threshold Random Walk Algorithm, which is explicit and analytical in nature, our proposed algorithm involve parameters to be determined by numerical methods. We have developed computational techniques such as iterative minimax optimization for quick determination of the parameters of the new detection algorithm. A framework of multi-valued decision for testing portscanners is also proposed.

Affiliated with

Also associated with

No associations

Rating

New Sequential Methods for Detecting Portscanners does not yet have a rating. At this time, there are no reviews or comments for this scientific paper.

If you have personal experience with New Sequential Methods for Detecting Portscanners, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and New Sequential Methods for Detecting Portscanners will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFWR-SCP-O-652224