Tracking port scanners on the IP backbone

Proceedings of the 2007 Workshop on Large Scale Attack Defense, LSAD '07

Volumn , Issue , 2007, Pages 137-144

  Sridharan, Avinash ^a   Ye, Tao ^b  

^a Dept of Electrical Engineering ^*  (United States)

^b Sprint   (United States)

Author keywords

IP backbone monitoring; Port scanning; Real time port scan detection

Indexed keywords

IP BACKBONE; IP BACKBONE MONITORING; PORT SCANNING; PORT SCANS; REAL TIME;

DATA STRUCTURES; GATEWAYS (COMPUTER NETWORKS); INTERNET PROTOCOLS; INTRUSION DETECTION;

SCANNING;

EID: 77954322607     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1352664.1352673     Document Type: Conference Paper

References (21)

1. Endace. http://www.endace.com.
2. Gigascope. http://www.research.att.com.
3. Honeynets. http://www.honeynets.org.
4. Internet storm center. http://www.sans.org.
5. Leurrecom honeypot project.
6. Mark Allman, Paul Barford, Balachander Krishnamurthy, and Jia Wang. Tracking the role of adversaries in measuring unwanted traffic. San Jose, CA, USA, 2006.
7. Marianne Durand and Philippe Flajolet. Loglog counting of large cardinalities. 2003.
8. Cristian Estan, George Varghese, and Mike Fisk. Bitmap algorithms for counting active flows on high speed links. In USENIX/ACM Internet Measurement Conference, 2003.
9. Philippe Flajolet and G. Nigel Martin. Probabilistic counting algorithms for data base applications. volume 31, pages 182-209, 1985.
10. Jaeyeon Jung, Vern Paxson, Arthur W. Berger, and Hari Balakrishnan. Fast portscan detection using sequential hypothesis testing. In IEEE Symposium on Security and Privacy, May 2004.
11. Hyang-Ah Kim and Brad Karp. Autograph: Tward automated, distributed worm signature detection. In 13th USENIX Security Symposium, 2004.
12. L. Tassiulas L. Georgiadis, M.J. Neely. Resource allocation and cross-layer control in wireless networks. Foundations and Trends in Networking, 1(1), 2006.
13. Preetham Mysore. Cmon: "always-on" monitoring platform for high-speed links. Master Thesis, Rutgers University.
14. R. Pang, V. Yegneswaran, P. Barford, V. Paxson, and L. Peterson. Characteristics of internet background radiation. In USENIX/ACM Internet Measurement Conference, 2004.
15. Sumeet Singh, Cristian Estan, George Varghese, and Stefan Savage. Automated worm fingerprinting. In the 6th ACM/USENIX Symposium on Operating System Design and Implementation (OSDI), San Francisco, CA, 2004.
16. Avinash Sridharan, Tao Ye, and Supratik Bhattacharrya. Connectionless port scan detection on the backbone. In Malware workshop, held in conjunction with IPCCC, Pheonix, AZ, April 2006.
17. Kuai Xu, Zhi-Li Zhang, and Supratik Bhattacharrya. Profiling internet backbone traffic: Behavior models and applications. In ACM Sigcomm 2005, Philadelphia, PA, August 2005.
18. Kuai Xu, Zhi-Li Zhang, and Supratik Bhattacharrya. Reducing unwanted traffic in a backbone network. In USENIX Workshop on Steps to Reduce Unwanted Traffic in the Internet (SRUTI), Boston, MA, July 2005.
19. V. Yegneswaran, P. Barford, and D. Plonka. On the design and use of internet sinks for network abuse monitoring. In the Symposium on Recent Advances in Intrusion Detection, 2004.
20. Vinod Yegneswaran, Paul Barford, and Johannes Ullrich. Internet intrusions: Global characteristics and prevalence. In Proceedings of ACM SIGMETRICS, 2003.
21. Qi Zhao, Abhishek Kumar, and Jun Xu. Joint streaming and sampling techniques for accurate identification of super sources/destination. In USENIX/ACM Internet Measurement Conference, 2005.