Mining in a data-flow environment: experience in network intrusion detection
KDD '99 Proceedings of the fifth ACM SIGKDD international conference on Knowledge discovery and data mining
Network support for IP traceback
IEEE/ACM Transactions on Networking (TON)
Network Intrusion Detection: An Analyst's Handbook
Network Intrusion Detection: An Analyst's Handbook
Implementing and testing a virus throttle
SSYM'03 Proceedings of the 12th conference on USENIX Security Symposium - Volume 12
| Hi-index | 0.00 |
In this paper, we propose an abnormal IP address detection scheme, which is capable of detecting IP spoofing and network scan attacks. Our scheme learns active host information such as incoming interface number, whether or not working as Web server, whether or not working as DNS server, and etc., by collecting and verifying flow information on networks. By using active host information learned, we can check if IP address is normal or abnormal. Through simulation, the performance of the proposed scheme is evaluated. The simulation results show that our scheme is able to detect source IP spoofing attacks that forge using the IP address of subnet that attacker belongs to as well as using the external IP address. And also, they show that our scheme is able to detect network scan attacks with low false alarm rate.