A probabilistic approach to detecting network scans

IEEE Symposium Record on Network Operations and Management Symposium

Volumn , Issue , 2002, Pages 359-372

  Leckie, C ^a   Kotagiri, R ^a  

^a UNIVERSITY OF MELBOURNE   (Australia)

Author keywords

Network intrusion detection; Network scans

Indexed keywords

PACKET NETWORKS; PROBABILISTIC LOGICS; REAL TIME SYSTEMS; SECURITY OF DATA;

INTRUSION DETECTION;

COMPUTER NETWORKS;

EID: 0037710746     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (15)

1. M. de Vivo, E. Carrasco, G. Isern and G. de Vivo, "A Review of Port Scanning Techniques," in Computer Communications Review, 29(2), April 1999, pp. 41-48.
2. S. Northcutt and J. Novak, Network Intrusion Detection: An Analyst's Handbook, Second Edition, New Riders Publishing, 2000.
3. J. Green, D. Marchette, S. Northcutt, and B. Ralph, "Analysis Techniques for Detecting Coordinated Attacks and Probes," in Proceedings of the First USENIX Workshop Intrusion Detection and Network Monitoring, Santa Cruz, California, April 1999.
4. S. Northcutt, M. Cooper, M. Fearnow and K. Frederick, Intrusion Signatures and Analysis, New Riders Publishing, 2001.
5. S. Staniford, J. Hoagland, J. McAlerney, "Practical Automated Detection of Stealthy Portscans," in Proceedings of the ACM CCS Workshop on Intrusion Detection Systems, Athens, Greece, November 2000.
6. V. Paxson, "Bro: A System for Detecting Network Intruders in Real-Time," in Computer Networks, 31(23-24), December 1999, pp. 2435-2463.
7. S. Sekar, Y. Guang, S. Verma, and T. Shanbhag, "A High-Performance Network Intrusion Detection System," in Proceedings of the 6th ACM Conference on Computer and Communications Security, Singapore, November 1999, pp. 8-17.
8. W. Lee, S. Stolfo and K. Mok, "Mining in a Data-flow Environment: Experience in Network Intrusion Detection," in Proceedings of the 5th ACM International Conference on Knowledge Discovery and Data Mining (KDD'99), August 1999.
9. S. Hofmeyr and S. Forrest, "Architecture for an Artifical Immune System," in Evolutionary Computation, 7(1), 1999, pp. 1289-1296.
10. N. Kato, H. Nitou, K. Ohta, G. Mansfield and Y. Nemoto, "A Real-Time Intrusion Detection System (IDS) for Large Scale Networks and Its Evaluations," in IEICE Transactions on Communications, Vol. E82-B, No. 11, November 1999.
11. H. Javitz and A. Valdes, The SRI IDES Statistical Anomaly Detector, Technical Report, SRI International, California, March 1994.
12. P. Porras and A. Valdes, "Live Traffic Analysis of TCP/IP Gateways," in Proceedings of the Networks and Distributed Systems Security Symposium, March 1998.
13. R. Lippmann et al., "Evaluating Intrusion Detection Systems: The 1998 DARPA Off-Line Intrusion Detection Evaluation," in Proceedings of the DARPA Information Survivability Conference, Hilton Head, South Carolina, January 2000.
14. SANS Institute, Commonly probed ports, 4 May 2000, (www.sans.org/y2k/ports.htm).
15. R. Graham, FAQ: Firewall Forensics, Version 0.4.1, 20 June 2000, (www.robertgraham.com/pubs/firewall-seen.html).