An adaptive fuzzy based scan detection technique using Time Independent Feature Set

Port scanning is used to identify vulnerable machines, and in most cases a precursor to more sophisticated attacks. Early detection of port scans results in reducing the impact and propagation of distributed attacks and worms. Many algorithmic, threshold and visual based solutions have been proposed each one boils down to testing X events across in Y size time window in one way or other. Consequently, the accuracy and detection time for each detection solutions ends up to the threshold or sensitivity of detector that also depends upon scanner deployment point. Parallel to these solutions, port scanning has also gone stealthy. Attackers are using diverse techniques to attenuate the scanning pattern either distributing it in time, feature and/or address space. This article proposes an adaptive threshold based generic solution for detecting various port scans and DDoS attacks using time independent feature set. Instead of using a fix threshold for scan detector, the paper adapts the fuzzy linguistic set boundaries consequently adapting threshold according to network traffic feature such as number of TCP connected sessions. Experiments carried out using DARPA 98/99 data set shows an early detection of port scans with high detection accuracy.