Fast portscan detection using sequential hypothesis testing

摘要: Attackers routinely perform random portscans of IP addresses to find vulnerable servers compromise. Network intrusion detection systems (NIDS) attempt detect such behavior and flag these portscanners as malicious. An important need in is prompt response: the sooner a NIDS detects malice, lower resulting damage. At same time, should not falsely implicate benign remote hosts Balancing goals promptness accuracy detecting malicious scanners delicate difficult task. We develop connection between this problem theory sequential hypothesis testing show that one can model accesses local walk on two stochastic processes, corresponding respectively access patterns ones. The then becomes observing particular trajectory inferring from it most likely classification for host. use insight TRW (Threshold Random Walk), an online algorithm identifies hosts. Using analysis traces qualitatively different sites, we requires much smaller number attempts (4 or 5 practice) activity compared previous schemes, while also providing theoretical bounds low (and configurable) probabilities missed false alarms. In summary, performs significantly faster more accurately than other current solutions.