Research about technology of port scan and port scan detect

唐小明,梁锦华,蒋建春,文伟平

DOI: https://doi.org/10.3969/j.issn.1000-7024.2002.09.005

2002-01-01

Abstract:This paper gives a summary and classification of the existing intrusion detection models and technologies, and their merits or shortcomings have been compared in detail. It also gives out the development for the future.

What problem does this paper attempt to address?

Port Scanning Techniques and Analysis of Attack and Defense

Zhaohui Hu,Qi Chen,Ruizhao Yu

DOI: https://doi.org/10.3321/j.issn:1002-8331.2001.10.020

2001-01-01

Abstract:This article introduces the implementation of TCP Protocol and the technique of Port Scanning based on the characteristic of TCP Protocol,at the same time,the several implementations of Port Scanning are also described. We also analyze the potential external attacks that can be made because of the weakness of operation system and the ways to avoid suck kinds of attack are also put up.
Intrusion Detection And Simulation For High-Speed Networks

Fei Yu,XiaoPing Dai,Yue Shen,Huang Huang,Miaoliang Zhu

DOI: https://doi.org/10.1109/ICSSSM.2005.1500110

2005-01-01

Abstract:The problem in network security presently is how to get real-time intrusion detection and alert. In the paper, we design Intrusion Detection System architecture and arithmetic again, meanwhile put forward an improved pattern matching arithmetic based on protocol analysis and theorization machine on Frete. New architecture can use network processor to collect and analyze data in network bottom, which enhance the speed and efficiency in Detection System.
Research of Analysis and Detection of Scanning Attack of NIDS

CAI Hongmin,WU Naiqi,TENG Shaohua

DOI: https://doi.org/10.3969/j.issn.2095-347x.2007.02.026

2007-01-01

Abstract:This article introduces the theorys and the methods of the detection of port scanning and OS scanning,and put forward a model of detecting port scanning and OS scanning.It can effectively detects many types of attack of scanning,by capturing the network packets and matching the snort rules.In the end,the article introduced the significance and prospect of the model.
Self-adaptive distributed detection method of port scan

LIU Ting-hua,SONG Hua,DAI Yi-qi

DOI: https://doi.org/10.3969/j.issn.1000-7024.2006.09.003

2006-01-01

Abstract:Techniques of the port scan and its detection were introduced briefly.A new self-adaptive distributed detection method of port scan wasdesigned and implemented.By detecting anomalous packets and calculating the class's anomalysum value,it sets adynamic threshold combined with the network traffic,and then judges whether that is a scan.This method could detect slow scans,random scans and distributed scans effectively.And it could detect DDoS(distributed denial of service) attacks as well.
The Detection System for Network Scanning

刘敏,过晓冰,伍卫国,钱德沛

DOI: https://doi.org/10.3969/j.issn.1000-3428.2002.07.032

2002-01-01

Abstract:This paper introduces the concept of network scanning, and current methodology of network scanning, presents a detection system for network scanning. It describes also the work flow and the implementation of this system.
Intrusion Detection System Based on Protocol Analysis

Zhi Xue

2007-01-01

Abstract:Intrusion detection based on protocol has become one of the key technologies for the intrusion system detection of the next generation.The paper￡¨based on the analysis of network intrusion detection's structure and traditional character pattern matching technology,explains the theory and realization of protocol analysis,based on protocol analysis,proposes a model of intrusion detection system,and finally analyses a typical case of intrusion detection.
Survey on Intrusion Detection Techniques

WU Qing-tao,SHAO Zhi-qing

DOI: https://doi.org/10.3969/j.issn.1001-3695.2005.12.004

2005-01-01

Abstract:Intrusion detection,as one of the most active and important network security technology,can compensate the shortcomings of traditional security protection measure.Through building dynamic security cycle,it can promote the protection capacity of system and reduce the security threats as great as possible. An overview of basic issues on intrusion detection is shown in this paper,which is involved with three main aspects of intrusion detection,including Intrusion Detection System(IDS) architecture,intrusion detection methods and IDS evaluation.Firstly,three kinds of IDS architectures are analyzed.Then,current intrusion detection models are given,and their merits or shortcomings are discussed in detail.Finally,some future promi￣sing directions are presented.
Mobile agent-based intrusion detection technology & system model research

宋明黎,温涛

DOI: https://doi.org/10.16208/j.issn1000-7024.2002.10.004

2002-01-01

Abstract:Mobile agent-based intrusion detection is a new intrusion detection technology developed in recent years. The paper mainly discusses the related concept, characteristic, basic structure and current researches of mobile agent-based intrusion detection system.
An Adaptive Algorithm to Detect Port Scans

Shan Rong-sheng,Li Xiao-yong D.,Li Jian-hua

DOI: https://doi.org/10.1007/s11741-004-0073-8

2004-01-01

Abstract:Detection of port scan is an important component in a network intrusion detection and prevention system. Traditional statistical methods can be easily evaded by stealthy scans and are prone to DoS attacks. This paper presents a new mechanism termed PSD(port scan detection), which is based on TCP packet anomaly evaluation. By learning the port distribution and flags of TCP packets arriving at the protected hosts, PSD can compute the anomaly score of each packet and effectively detect port scans including slow scans and stealthy scans. Experiments show that PSD has high detection accuracy and low detection latency.
The Research on Intrusion Detection System State-Based

饶元,冯博琴

DOI: https://doi.org/10.3969/j.issn.1009-2552.2003.12.017

2003-01-01

Abstract:As a newly security technique, intrusion detection system (IDS) is becoming a hot-point technique in the network security fields, which overcomes the default of the traditional security techniques. This paper analyzes some concepts of intrusion detection and a kind of classification method process-based. Furthermor, the Deterministic Finite Automat(DFA) model has been utilized and an algorithm has been designed to simulate the intrusion detection process. Fastly, this paper presents four dominant problems about IDS that should be solved in the future.
Research on a Port Scanner Based on Half-connection

JIANG Jian-guo

DOI: https://doi.org/10.3969/j.issn.1008-8032.2009.02.009

2009-01-01

Abstract:A port scanner based on half-connection neither sets up a TCP connection with the target computer nor releases this connection. For its security reliability,it is widely used in information detection of network penetration tests. This essay expounds the theoretical foundation of a port scanner based on half-connection by analyzing the process of a data package being transmitted from IP layer to TCP layer with the kernel protocol stack of Linux/Unix. In addition,both the raw socket and the algorism of TCP header check sum are deeply analyzed. Finally,this essay also introduces the design of such a port scanner.
The Research of Network Security Technologies

Zhen Wang,Zhijie Liu,Xiaoyao Xie

DOI: https://doi.org/10.1109/icasid.2009.5277012

2009-01-01

Abstract:Based on this essay, we introduce the current network security technologies and problems. Also, we analyze the excellence and weakness of the firewall technologies, the intrusion detection and prevention technology in order to integrate the firewall technology and intrusion prevention technology, which can help to improve the real-time check, accuracy and recovery ability of the network security system.
IP Tracing and Source-finding Technology Research on DDoS Attack

CAI Weijun,HUANG Hao

DOI: https://doi.org/10.3969/j.issn.1000-3428.2006.14.056

2006-01-01

Abstract:IP tracing and source-finding technology has great significance in anti-DDoS attack.This paper classifies present IP tracing and source-finding technology systemically,analyzes various IP tracing and source-finding technology comprehensively,and compares them each other. It discusses the development trend of IP tracing and source-finding technology in the basis of currently status.
Research on Agent-based Intrusion Detection Technique

WANG Jun,WANG Chong-Jun,XIE Jun-Yuan,CHEN Shi-Fu

DOI: https://doi.org/10.3969/j.issn.1002-137x.2006.12.017

2006-01-01

Computer Science

Abstract:Intrusion detection is a proactive network security protection mechanism, which has become a research focus in the field of the network security. Since the Agent-based intrusion detection systems have the features of the distributed coordination processing and intelligence, many researchers attach great importance to it and it has become a research trend for the next generation intrusion detection systems. In this paper, we first introduce the history of the intrusion detection systems (IDS)and its classifications. And then some recent research development that related to the key aspects of static Agent-based intrusion detection systems and mobile Agent-based intrusion detections systems are deeply explored. And their development treads are also given. In the end, we present some possible research directions and challenges for Agent-based intrusion detection systems.
The Evolving Intrusion Detection System

LIN Guo-Yuan,HUANG Hao,ZHANG Yong-Ping

2008-01-01

Computer Science

Abstract:Intrusion detection system is an important device of information security.In this paper,firstly,the current research on intrusion detection system is summarized in detail,and new characters are pointed out includes the adoption of intelligent algorithms,data fusion technology,alerts correlation algorithms,the variety of data sources and the collaboration with other security devices.Secondly,the recently work of testing and standardization about intrusion detection system is expounded.Finally,some directions for future research are addressed.
Port Scan Behavior Diagnosis by Clustering

Lanjia Wang,Haixin Duan,Xing Li

DOI: https://doi.org/10.1007/11602897_21

2005-01-01

Abstract:Detecting and identifying port scans is important for tracking malicious activities at early stage. The previous work mainly focuses on detecting individual scanners, while cares little about their common scan patterns that may imply important security threats against network. In this paper we propose a scan vector model, in which a scanner is represented by a vector that combines different scan features online, such as target ports and scan rate. A center-based clustering algorithm is then used to partition the scan vectors into groups, and provide a condense view of the major scan patterns by a succinct summary of the groups. The experiment on traffic data gathered from two subnets in our campus network shows that our method can accurately identify the major scan patterns without being biased by heavy hitters, meanwhile, possessing simplicity and low computation cost.
Research on Classification Technology of Networks Attacks

张涛,董占球

2004-01-01

Abstract:This paper first introduces the foreign classification technology of network attacks. Then from perspective of security systems and security product benchmarking,it discusses the views of considering the classification problems in study of classification,and gives a principle and criterion of attack classification suitable for benchmarking requirements.
Research on Network Security Technology

Zeng Zhao-hu

Abstract:In this paper,from two aspects of network attack anddefense of the existing network security technologies areintroduced,the main means of network attacksand the corresponding defense measures are discussed,the network protocol security,firewall,encryption,transmission process invade to examine the technique principle of these four kinds of network defense are given,so as to solve some problems the existing network security.

Engineering,Computer Science
Classification of Network Attack Source Tracing Technologies

YAN Qiao,WU Jianping,JIANG Yong

DOI: https://doi.org/10.3321/j.issn:1000-0054.2005.04.019

2005-01-01

Abstract:Network attack source tracing plays a key role in stopping on-going attacks, establishing liability, enabling prosecution of attackers, and deterring attackers. This paper classifies some promising traceback approaches and their technical characteristics. Each approach is evaluated in terms of its advantages and disadvantages. Finally, future develops in network attack tracing technologies are discussed including quantitative evaluation metrics, theoretical models, multicast systems, mobility abilities, ipv6 protocol, data encryption, and administration problems.
Detection and Protection Against Network Scanning: IEDP

XB Guo,DP Qian,M Liu,R Zhang,B Xu

DOI: https://doi.org/10.1109/iccnmc.2001.962637

2001-01-01

Abstract:Network scanning is an increasing threat to network security. This paper classifies and analyzes current scanning methods, and draws a conclusion that the current detection and protection of scanning mainly aim at information concealment. A novel system of the detection and protection named IEDP is presented in this paper Its concept is discussed and its implementation is described in details. Compared with the current approaches, the concept of IEDP can be recapitulated in one word: "impartation". When detecting a scanning, IEDP gives the scanner bogus information to spoof and confuse him/her. So, for example, when scanning ports, the scanner will find that all ports are listening and can't tell which port is really open. IEDP also adopts a new mechanism called error steering to spoof the scanner IEDP randomly steers errors in communication with the scanner, let the scanner believe that the communication is unstable and give up scanning. Experiments show that IEDP system is efficient.

Research about technology of port scan and port scan detect

Port Scanning Techniques and Analysis of Attack and Defense

Intrusion Detection And Simulation For High-Speed Networks

Research of Analysis and Detection of Scanning Attack of NIDS

Self-adaptive distributed detection method of port scan

The Detection System for Network Scanning

Intrusion Detection System Based on Protocol Analysis

Survey on Intrusion Detection Techniques

Mobile agent-based intrusion detection technology & system model research

An Adaptive Algorithm to Detect Port Scans

The Research on Intrusion Detection System State-Based

Research on a Port Scanner Based on Half-connection

The Research of Network Security Technologies

IP Tracing and Source-finding Technology Research on DDoS Attack

Research on Agent-based Intrusion Detection Technique

The Evolving Intrusion Detection System

Port Scan Behavior Diagnosis by Clustering

Research on Classification Technology of Networks Attacks

Research on Network Security Technology

Classification of Network Attack Source Tracing Technologies

Detection and Protection Against Network Scanning: IEDP