Practical automated detection of stealthy portscans

摘要: Portscan detectors in network intrusion detection products are easy to evade. They classify a portscan as more than N distinct probes within M seconds from single source. This paper begins with an analysis of the scan problem, and then presents Spice (Stealthy Probing Intrusion Correlation Engine), detector that is effective against stealthy scans yet operationally practical. Our design maintains records event likelihood, which we approximate anomalousness given packet. We use simulated annealing cluster anomalous packets together into portscans using heuristics developed real scans. Packets kept around longer if they anomalous. should enable us detect all detected by current techniques, plus many scans, manageable false positives. also discuss other activity such worms, DDOS control networks.