Scan Detection on Very Large Networks Using Logistic Regression Modeling
- 1 January 2006
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
- p. 402-408
- https://doi.org/10.1109/iscc.2006.142
Abstract
Scanning activity is a common activity on the Internet today, representing malicious activity such as information gathering by a motivated adversary or automated tools searching for vulnerable hosts (e.g., worms). Many scan detection techniques have been developed; however, their focus has been on smaller networks where packet-level information is available, or where internal characteristics of the network are known. For large networks, such as those of ISPs, large corporations or government organizations, this information might not be available. This paper presents a model of scans that can be used given only unidirectional flow data. The model uses a Bayesian logistic regression, which was developed using a combination of expert opinion and manually-classified training data. It is shown to have a detection rate of 95.5% with a false positive rate of 0.4% overall when tested against a set of 300 TCP events.Keywords
This publication has 10 references indexed in Scilit:
- An Experimental Evaluation to Determine if Port Scans are Precursors to an AttackPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2005
- Preliminary results using scale-down to explore worm dynamicsPublished by Association for Computing Machinery (ACM) ,2004
- Fast portscan detection using sequential hypothesis testingPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2004
- Surveillance detection in high bandwidth environmentsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2004
- A probabilistic approach to detecting network scansPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2003
- The base-rate fallacy and the difficulty of intrusion detectionACM Transactions on Information and System Security, 2000
- Estimation and Inference via Bayesian Simulation: An Introduction to Markov Chain Monte CarloAmerican Journal of Political Science, 2000
- Bro: a system for detecting network intruders in real-timeComputer Networks, 1999
- Bayesian Data AnalysisPublished by Taylor & Francis ,1995
- Optimum Allocation in Linear Regression TheoryThe Annals of Mathematical Statistics, 1952