Fast portscan detection using sequential hypothesis testing

Fast portscan detection using sequential hypothesis testing (2004)

Cached

Download Links

[nms.lcs.mit.edu]
[inat.lcs.mit.edu]

Other Repositories/Bibliography

DBLP

by Jaeyeon Jung , Vern Paxson , Arthur W. Berger , Hari Balakrishnan

Venue:	In Proceedings of the IEEE Symposium on Security and Privacy
Citations:	193 - 13 self

Versions

Version History

Metadata Version 1

Datum	Value	Source
TITLE	Fast portscan detection using sequential hypothesis testing	INFERENCE
AUTHOR NAME	Jaeyeon Jung	SVM HeaderParse 0.2
AUTHOR AFFIL	MIT Computer Science and Artificial Intelligence Laboratory	SVM HeaderParse 0.2
AUTHOR ADDR	Cambridge, MA USA	SVM HeaderParse 0.2
AUTHOR NAME	Vern Paxson	SVM HeaderParse 0.2
AUTHOR NAME	Arthur W. Berger	SVM HeaderParse 0.2
AUTHOR AFFIL	MIT Computer Science and Artificial Intelligence Laboratory	SVM HeaderParse 0.2
AUTHOR ADDR	Cambridge, MA USA	SVM HeaderParse 0.2
AUTHOR NAME	Hari Balakrishnan	SVM HeaderParse 0.2
AUTHOR AFFIL	MIT Computer Science and Artificial Intelligence Laboratory	SVM HeaderParse 0.2
AUTHOR ADDR	Cambridge, MA USA	SVM HeaderParse 0.2
ABSTRACT	Attackers routinely perform random “portscans ” of IP addresses to find vulnerable servers to compromise. Network Intrusion Detection Systems (NIDS) attempt to detect such behavior and flag these portscanners as malicious. An important need in such systems is prompt response: the sooner a NIDS detects malice, the lower the resulting damage. At the same time, a NIDS should not falsely implicate benign remote hosts as malicious. Balancing the goals of promptness and accuracy in detecting malicious scanners is a delicate and difficult task. We develop a connection between this problem and the theory of sequential hypothesis testing and show that one can model accesses to local IP addresses as a random walk on one of two stochastic processes, corresponding respectively to the access patterns of benign remote hosts and malicious ones. The detection problem then becomes one of observing a particular trajectory and inferring from it the most likely classification for the remote host. We use this insight to develop TRW (Threshold Random Walk), an online detection algorithm that identifies malicious remote hosts. Using an analysis of traces from two qualitatively different sites, we show that TRW requires a much smaller number of connection attempts (4 or 5 in practice) to detect malicious activity compared to previous schemes, while also providing theoretical bounds on the low (and configurable) probabilities of missed detection and false alarms. In summary, TRW performs significantly faster and also more accurately than other current solutions. 1.	SVM HeaderParse 0.2
YEAR	2004	INFERENCE
VENUE	In Proceedings of the IEEE Symposium on Security and Privacy	INFERENCE
VENUE TYPE	CONFERENCE	INFERENCE
CITATIONS	9 found	ParsCit 1.0