Improving the Detection of On-Line Vertical Port Scan in IP Traffic

Problem Statement

We address in this paper the problem of designing an on-line algorithm for identifying port scan attacks in IP traffic. A port scan is a method of determining whether particular services are available on a host or a network by observing responses to connection attempts (Devivo, 1999). The received information is exploited to identify weaknesses and vulnerabilities of the host and to launch therefore more serious attacks. Several attack tools are now available and can easily be used (see (Nmap; Foundstone) and (Nessus)). Port scan can be launched from one or several sources. In this latter case, we are dealing with distributed attacks, which are more difficult to detect as the contribution of each source can be considered as legitimate traffic. According to Staniford (2002) port scan attacks can be classified into two categories:

• 1.

  Vertical scan consisting of scanning a big number of destination ports of a single destination address.

• 2.

  Horizontal scan when many IP addresses are scanned (generally within the same subnet), on one or several ports.