A Design of Port Scan Detection Method Based on the Characteristics of Packet-In Messages in OpenFlow Networks

Due to the diversification of devices and the spread of the Internet, many people are handling information over the network and the threat of cyber-attacks by unauthorized access and malware is also considered as a problem, and countermeasures against these threats are an urgent issue. SDN and OpenFlow are useful for network cybersecurity countermeasures because they can collect traffic statistics from switches and can interrupt communication at the switch level. In this study, we focus on detecting a port scanning as a preparation stage for cyber-attacks. In this paper, we propose port scan detection method based on the characteristics of Packet-In messages in an OF network. Also, we show its effectiveness through the experiments.