Using InetVis to Evaluate Snort and Bro Scan Detection on a Network Telescope

摘要: This paper presents an investigative analysis of network scans and scan detection algorithms. Visualisation is employed to review telescope traffic identify incidents activity. Some the identified phenomena appear be novel forms host discovery. Scan algorithms used by Snort Bro intrusion systems are critiqued comparing visualised with alert output. Where human assessment disagrees output, explanations sought analysing The based on counting unique connection attempts destination addresses ports. For Snort, notable false positive negative cases result due a grossly oversimplified method