Abstract:Network security is paramount in today's digital landscape, where cyberthreats continue to evolve and pose significant risks. We propose a DPDK-based scanner based on a study on advanced port scanning techniques to improve network visibility and security. The traditional port scanning methods suffer from speed, accuracy, and efficiency limitations, hindering effective threat detection and mitigation. In this paper, we develop and implement advanced techniques such as protocol-specific probes and evasive scan techniques to enhance the visibility and security of networks. We also evaluate network scanning performance and scalability using programmable hardware, including smart NICs and DPDK-based frameworks, along with in-network processing, data parallelization, and hardware acceleration. Additionally, we leverage application-level protocol parsing to accelerate network discovery and mapping, analyzing protocol-specific information. In our experimental evaluation, our proposed DPDK-based scanner demonstrated a significant improvement in target scanning speed, achieving a 2× speedup compared to other scanners in a target scanning environment. Furthermore, our scanner achieved a high accuracy rate of 99.5% in identifying open ports. Notably, our solution also exhibited a lower CPU and memory utilization, with an approximately 40% reduction compared to alternative scanners. These results highlight the effectiveness and efficiency of our proposed scanning techniques in enhancing network visibility and security. The outcomes of this research contribute to the field by providing insights and innovations to improve network security, identify vulnerabilities, and optimize network performance.

Scalable Double Filter Structure for Port Scan Detection.

Intrusion Detection And Simulation For High-Speed Networks

An Efficient Sampling And Classification Approach For Flow Detection In Sdn-Based Big Data Centers

A Hypothesis Testing Based Scalable TCP Scan Detection.

A Parallel Intrusion Detection System for High-Speed Networks

An Online Framework for Catching Top Spreaders and Scanners.

An Adaptive Algorithm to Detect Port Scans

Port Scan Behavior Diagnosis by Clustering

A DoS Resilient Flow-level Intrusion Detection Approach for High-speed Networks

Enhancing Network Visibility and Security with Advanced Port Scanning Techniques

Techniques of Building a Scalable, Efficient Intrusion Monitoring Architecture

Port Scan Detection Algorithms Based on Statistical Traffic Features

Dual Cuckoo Filter with a Low False Positive Rate for Deep Packet Inspection

An Efficient Security System for Mobile Data Monitoring.

Self-adaptive distributed detection method of port scan

New Trend of Intrusion Detection System for High-speed Networks

HiFIND: A High-Speed Flow-Level Intrusion Detection Approach with DoS Resiliency.

A novel spread estimation based abnormal flow detection in high-speed networks

Parameterization and Performance Analysis of a Scalable, near Real-Time Packet Capturing Platform

Real-time intrusion detection for high-speed networks