Detection of Port and Network Scan Using Time Independent Feature Set

Probes or network scans are designed to identify security vulnerabilities of a network and are precursor to most of the cyber attacks. Slow, random and distributed attacks are the most difficult to detect. Extensive training over longer packet traces or larger detection window size can give better results but requires larger memory. A model based on Time Independent Feature Set is proposed here, which can efficiently detect slow and random attacks in real time with reduce memory needs. The proposed model has been tested using DARPA 99 data set.