Skip to Content
[CAIDA - Center for Applied Internet Data Analysis logo]
Center for Applied Internet Data Analysis
www.caida.org > publications : papers : 2004 : detectscanning
Feasibility of Detecting TCP-SYN Scanning at a Backbone router
K. Shah, S. Bohacek, and A. Broido, "Feasibility of Detecting TCP-SYN Scanning at a Backbone router", in IEEE American Control Conference, Jun 2004, pp. 988--995.
|   View full paper:    PDF    |  Citation:    BibTeX   |

Feasibility of Detecting TCP-SYN Scanning at a Backbone router

Khushboo Shah2
Stephan Bohacek3
Andre Broido1
1

CAIDA, San Diego Supercomputer Center, University of California San Diego

2

Department of Electrical Engineering, University of Southern California

3

University of Delaware

IP address and TCP/UDP port scanning are critical components of many network attacks. Such scanning allows attackers to spread a self-propagating worm or collect detailed information about end-hosts in preparation for attacks. This paper investigates an algorithm to detect TCP-SYN scanning. Special care is taken to detect even stealthy scanners. Attackers are detected by tracking the number of half-open connections generated by each source. However, a source is only tracked until it is clear that it is not currently scanning. The computational load of this method is analyzed and it is found that the method is not computationally intensive and is suitable for online detection of scanning even on backbone links. Specifically, on a backbone link investigated it was found that the total number of sources that needs to be tracked at any one time is at most a few thousand.

Keywords: security
  Last Modified: Wed Oct-11-2017 17:03:50 PDT
  Page URL: http://www.caida.org/publications/papers/2004/detectscanning/index.xml