Abstract:Network security is paramount in today's digital landscape, where cyberthreats continue to evolve and pose significant risks. We propose a DPDK-based scanner based on a study on advanced port scanning techniques to improve network visibility and security. The traditional port scanning methods suffer from speed, accuracy, and efficiency limitations, hindering effective threat detection and mitigation. In this paper, we develop and implement advanced techniques such as protocol-specific probes and evasive scan techniques to enhance the visibility and security of networks. We also evaluate network scanning performance and scalability using programmable hardware, including smart NICs and DPDK-based frameworks, along with in-network processing, data parallelization, and hardware acceleration. Additionally, we leverage application-level protocol parsing to accelerate network discovery and mapping, analyzing protocol-specific information. In our experimental evaluation, our proposed DPDK-based scanner demonstrated a significant improvement in target scanning speed, achieving a 2× speedup compared to other scanners in a target scanning environment. Furthermore, our scanner achieved a high accuracy rate of 99.5% in identifying open ports. Notably, our solution also exhibited a lower CPU and memory utilization, with an approximately 40% reduction compared to alternative scanners. These results highlight the effectiveness and efficiency of our proposed scanning techniques in enhancing network visibility and security. The outcomes of this research contribute to the field by providing insights and innovations to improve network security, identify vulnerabilities, and optimize network performance.

Port Scanning Techniques and Analysis of Attack and Defense

Detection and Response of Low-Rate TCP-targeted Denial of Service Attacks

A novel mechanism to defend against low-rate denial-of-service attacks

Research about technology of port scan and port scan detect

Self-adaptive distributed detection method of port scan

Research on Network Attacks and Security Countermeasures

Enhancing Network Visibility and Security with Advanced Port Scanning Techniques

Computer Network Attack and Defense Technology

The Design of Large Scale IP Address and Port Scanning Tool

Port Scan Detection Algorithms Based on Statistical Traffic Features

A Hypothesis Testing Based Scalable TCP Scan Detection.

A Defense Strategy Against RoQ Attacks Based on Dynamic Packets Filtering

Exploiting Cross-Layer Vulnerabilities: Off-Path Attacks on the TCP/IP Protocol Suite

Port Scan Behavior Diagnosis by Clustering

Research on Network Security Technology

Study on Attacking and Defending Techniques in IPv6 Networks

Detecting Coordinated Internet-Wide Scanning by TCP/IP Header Fingerprint

Classification of Network Attack Source Tracing Technologies

Study on IP Hijack

Which Doors Are Open: Reinforcement Learning-based Internet-wide Port Scanning.

Research on Key Technologies and Defenses of Botnet