Scan detection under sampling: a new perspective

In tests using the same fraction of packets for comparison, packet sampling outperformed flow sampling for scan detection, while both selective sampling and a proposed extension that uses significantly less resources were superior to either of these techniques. The Web extra at http://youtu.be/Mgf8_a0fRs0 is a slide show that considers how in tests using the same fraction of packets for comparison, packet sampling outperformed flow sampling for scan detection, while both selective sampling and a proposed extension that uses significantly less resources were superior to either technique.