Inter-domain stealthy port scan detection through complex event processing

摘要: Large enterprises are nowadays complex interconnected software systems spanning over several domains. This new dimension makes difficult for the task of enabling efficient security defenses. paper addresses problem detecting inter-domain stealthy port scans and proposes an architecture Intrusion Detection System which uses, such purpose, open source Complex Event Processing engine named Esper. Esper provides low cost ownership high flexibility. The consists sensors deployed at different enterprise Each sensor sends events to event processor correlation. We implemented algorithm detection interdomain SYN Rank-based (R-SYN) scan algorithm. It combines adapts three techniques in order obtain a unique global statement about malicious behavior host activities. An evaluation accuracy our approach has been carried out using traces, some including original traffic dumps, others altered by injecting packets that simulate Accuracy results show is able produce list scanners characterized false positive rates.