Improving the Security of Network Services by Changing the Transport Protocol Port

The number of network attacks is growing continuously. The first stage in most of them is network scanning. The simplest way to protect network services is to limit connection sources to trusted IP addresses only, but unfortunately, this method is not applicable to all services. Another method of protection is to transfer applications to a non-standard transport protocol port. This reduces the effectiveness of the attack by complicating the network intelligence stage. Different ports have different detection probabilities during scanning. This paper provides a quantitative assessment of such a protection measure based on statistics of monitoring scanners operating in the global network. The study used 4 network traps located in various autonomous systems, which recorded the scanning impact applied to them for 200 days. Based on the collected packets, the most popular transport protocols and ports among scanners were determined. Moving a remote access service (for example, SSH or RDP) from a standard, frequently scanned port to an unused port allows you to reduce the probability of detection of the service by global scanners by tens of thousands of times.