Abstract:Network security is paramount in today's digital landscape, where cyberthreats continue to evolve and pose significant risks. We propose a DPDK-based scanner based on a study on advanced port scanning techniques to improve network visibility and security. The traditional port scanning methods suffer from speed, accuracy, and efficiency limitations, hindering effective threat detection and mitigation. In this paper, we develop and implement advanced techniques such as protocol-specific probes and evasive scan techniques to enhance the visibility and security of networks. We also evaluate network scanning performance and scalability using programmable hardware, including smart NICs and DPDK-based frameworks, along with in-network processing, data parallelization, and hardware acceleration. Additionally, we leverage application-level protocol parsing to accelerate network discovery and mapping, analyzing protocol-specific information. In our experimental evaluation, our proposed DPDK-based scanner demonstrated a significant improvement in target scanning speed, achieving a 2× speedup compared to other scanners in a target scanning environment. Furthermore, our scanner achieved a high accuracy rate of 99.5% in identifying open ports. Notably, our solution also exhibited a lower CPU and memory utilization, with an approximately 40% reduction compared to alternative scanners. These results highlight the effectiveness and efficiency of our proposed scanning techniques in enhancing network visibility and security. The outcomes of this research contribute to the field by providing insights and innovations to improve network security, identify vulnerabilities, and optimize network performance.

A Novel Visualization Approach for Efficient Network Scans Detection

Port Scan Behavior Diagnosis by Clustering

A Novel Approach to Design the Fast Pedestrian Detection for Video Surveillance System

Scalable Network Traffic Visualization Using Compressed Graphs.

Interactive Visual Classification and Analysis on Network Activity

A Survey of Network Anomaly Visualization

Port Scan Detection Algorithms Based on Statistical Traffic Features

Scalable Double Filter Structure for Port Scan Detection.

Self-adaptive distributed detection method of port scan

Enhancing Network Visibility and Security with Advanced Port Scanning Techniques

The Design of Large Scale IP Address and Port Scanning Tool

A real-time network security visualization system based on incremental learning (ChinaVis 2018)

ColorNetVis: an Interactive Color Network Analysis System for Exploring the Color Composition of Traditional Chinese Painting

Demo: NetVision: Efficient Visualization Front-End for Packet-level Discrete-Event Network Simulation

A Novel Radial Visualization of Intrusion Detection Alerts

A Hypothesis Testing Based Scalable TCP Scan Detection.

Scan Correlation -- Revealing distributed scan campaigns

Anomaly Detection of Large Scale Network Based on Data Streams

A Honeypot-Based Degree Statistics Method for Scans Detection

Scalable Network Traffic Visualization By Structural Equivalence Grouping

An Iterative and Toolchain-Based Approach to Automate Scanning and Mapping Computer Networks