Detecting Slow Port Scans of Long Duration in High-Speed Networks

Port scanning is an extensively used technique by attackers to probe for vulnerabilities in network systems. Since fast port scans can be effectively detected by many existing methods, some advanced attackers perform slow port scans in order not to be suspected. A highly stealthy slow scan can last for dozens of days, which brings significant challenges to current intrusion detection approaches. Besides, the existing port scan detection methods are all based on full traffic. They are not suitable for high-speed networks because of huge computational and storage resource consumption. According to the protocol characteristics and the connection patterns of port scans, we construct a traffic feature set that can not only distinguish the specific scan types, but also remain effective for the sampled traffic. Furthermore, we customize a data structure Scan Detection Sketch (SDS) for feature extraction. Experimental results using public datasets show that our method can detect slow port scans in a 10Gbps high-speed network with high accuracy and acceptable memory consumption. And the proposed method works well even for slow port scans lasting more than 60 days.