Identifying Reconnaissance Activity: A Strategy for Network Defence

摘要: Over recent years there has been a massive increase in the need to build stronger and more effective defensive systems many contexts due amplified threat of terrorism. Network security is no exception this increased secure against attack. One area within network which received heightened interest correlation reconnaissance activities, rather than merely blocking source addresses without further investigation. This paper will examine work date detail how various researchers have approached scan activity, relation detection overt malicious activity or mapping. The that built contain two key components for examination: engine method by data collected some cases transported across host network. After summary existing research then new we are undertaking field, using clustering techniques conjunction with peer network, correlate port real-time.