Low-speed port scanning detection method for high-speed network sampling data collection scene

Abstract

The invention discloses a low-speed port scanning detection method for a high-speed network sampling data collection scene, which comprises the following steps of: firstly, carrying out system sampling on a public data set, and then extracting traffic characteristics by utilizing a sketch structure comprising four counters and two hash tables; firstly, adopting a K-means algorithm to cluster traffic characteristics, then verifying and labelling the traffic in a cluster where a known scanning stream is located based on a rule, and then constructing a training set with a complete label; and finally, training a classification model for port scanning detection by using a supervised machine learning algorithm. The classification model detects low-speed port scanning activities of TCP and UDP in a high-speed network under a sampling data collection scene, and the method is still effective for low-speed scanning attacks with the duration time exceeding 50 days. According to the invention, detection of port scanning events in massive high-speed traffic is realized by using a limited memory, and the method is used by a network manager for safety event monitoring in a high-speed network.

Description

technical field [0001] The invention relates to a slow port scanning detection method for high-speed network sampling data collection scenarios, belonging to the technical field of network security. Background technique [0002] Port scanning means that the attacker sends a set of detection messages to the target host and waits for a reply, and obtains the port status of the target host by observing the received response, and then understands the type of network service it provides. Although port scan attacks do not directly cause substantial harm to the victim, they expose the target host's entry points that can be attacked. Therefore, port scan detection is of vital importance to prevent attackers from causing further damage to network systems. [0003] However, some malicious attackers perform slow port scans to avoid detection. In a slow scanning attack, the time interval between scanning detection packets is long (more than 10 seconds), and the traffic characteristics...

AI Technical Summary

Problems solved by technology

[0008] The detection method based on machine learning realizes the detection of unknown traffic by training the classification model. This type of method needs to manually mark all or part of the characteristic data in advance. However, in the face of high-speed networks with massive traffic data, manual marking is very expensive. the price of

This strong dependence on labeled data leads to the inability of existing machine learning-based port scan detection methods to be applied in high-speed network environments.

Images