A Behavior-based Method for Detecting Distributed Scan Attacks in Darknets

Computer Networks and Broadcasting

Institute of Systems, Information Technologies and Nanotechnologies (ISIT)">Yaokai Feng, Institute of Systems, Information Technologies and Nanotechnologies (ISIT)">Yoshiaki Hori, Institute of Systems, Information Technologies and Nanotechnologies (ISIT)">Kouichi Sakurai, Institute of Systems, Information Technologies and Nanotechnologies (ISIT)">Jun'ichi Takeuchi

Author information

Keywords: distributed scan, anomaly detection, cyber-attack, collaborative attack, behavior-based methods, darknets

JOURNAL FREE ACCESS

2013 Volume 8 Issue 3 Pages 843-854

DOI https://doi.org/10.11185/imt.8.843

Details

Abstract

The technologies used by attackers in the Internet environment are becoming more and more sophisticated. Of the many kinds of attacks, distributed scan attacks have become one of the most serious problems. In this study, we propose a novel method based on normal behavior modes of traffic to detect distributed scan attacks in darknet environments. In our proposed method, all the possible destination TCP and UDP ports are monitored, and when a port is attacked by a distributed scan, an alert is given. Moreover, the alert can have several levels reflecting the relative scale of the attack. To accelerate learning and updating the normal behavior modes and to realize rapid detection, an index is introduced, which is proved to be very efficient. The efficiency of our proposal is verified using real darknet traffic data. Although our proposal focuses on darknets, the idea can also be applied to ordinary networks.

Corresponding author

Register with J-STAGE for free!