Feasibility of detecting TCP-SYN scanning at a backbone router

Proceedings of the American Control Conference

Volumn 2, Issue , 2004, Pages 988-995

  Shah, Khushboo ^a   Bohacek, Stephan ^b   Broido, Andre ^c  

^a University of Southern California   (United States)

^b UNIVERSITY OF DELAWARE   (United States)

^c UNIVERSITY OF CALIFORNIA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ALGORITHMS; COMPUTATIONAL COMPLEXITY; COMPUTER OPERATING SYSTEMS; DATABASE SYSTEMS; INTERNET; MICROPROCESSOR CHIPS; ONLINE SYSTEMS; PACKET NETWORKS;

BACKBONE ROUTERS; SELF-PROPAGATING WORMS;

ROUTERS;

EID: 8744295707     PISSN: 07431619     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.23919/acc.2004.1386700     Document Type: Conference Paper

References (16)

1. E. Stafford, "The Internet Worm Incident," 2nd European Software Engineering Conference, 1989.
2. D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver, "The spread of the sapphire/slammer worm," 2003.
3. CERT Advisory CA-2001-23, "Continued threat of the "Code Red" worm," 2002.
4. CERT Advisory CA-2003-20, "W32/Blaster worm," 2003.
5. O. Arkin, "Network scanning techniques," http://www.sys- security.com, 1999.
6. Nmap, "http://ww.insecure.org/nmap/index.html," 1999.
7. M. Vivo, E. Carrasco, G. Isern, and G.Vivo, "A review of port scanning techniques," ACM SIGCOMM Computer Communication Review, vol. 29, Issue 2, pp. 41-48, 1999.
8. SHADOW Indications Technical Analysis, Coordinated Attacks and Probes. http://www.nswc.navy.mil/ISSEC/CID/, 1999.
9. V. Yegneswaran, P. Barford, and J. Ullrich, "Internet intrusions: Global characteristics and prevalence," ACM SIGMETRICS Performance Evaluation Review, vol. 31, Issue 1, pp. 138-147, 2003.
10. S. Staniford, J. Hoagland, and J. McAlerney, "Practical automated detection of stealthy portscans," J. of Computer Security, 2002.
11. K. Park and H. Lee, "On the effectiveness of route-based packet □tering for distributed DoS attack prevention in power-law internets," Sigcomm, 2001.
12. C. B. Lee, C. Roedel, and E. Silenok, "Detection and characterization of port scan attacks,"
13. Waikato Applied Network Dynamics group, "The dag project: http://dag.cs.waikato.ac.nz,"
14. E. M. Systems, "www.endace.com,"
15. A.Broido, Y.Hyun, K.Claffy, and R.Gao, "Their share: Diversity and disparity in IP traf□c," Passive and Active Measurement, 2004.
16. W. R. Stevens, TCP/IP Illustrated (Vol. 1): The Protocols. Boston, MA: Addison-Wesley Longman Publishing Co., Inc, 1993.