Visualizing graph features for fast port scan detection

Authors:
Maggie Cheng;Quanmin Ye;Robert F. Erbacher
Affiliations:
Missouri University of Science and Technology, Rolla, MO;Missouri University of Science and Technology, Rolla, MO;U.S. Army Research Laboratory, Adelphi, MD
Venue:
Proceedings of the Eighth Annual Cyber Security and Information Intelligence Research Workshop
Year:
2013

Citing 3
Cited 0

The base-rate fallacy and the difficulty of intrusion detection

ACM Transactions on Information and System Security (TISSEC)
A Visualization Methodology for Characterization of Network Scans

VIZSEC '05 Proceedings of the IEEE Workshops on Visualization for Computer Security
A Novel Visualization Approach for Efficient Network Scans Detection

SECTECH '08 Proceedings of the 2008 International Conference on Security Technology

Quantified Score

Hi-index	0.00

Visualization

Abstract

Detection of sophisticated network scans, such as low and slow scans, requires correlation of large amounts of network data over long periods of time. The volume of data obfuscating such scans can be overwhelming and makes computation challenging. Such scans pose network security risks since identifying running services, the goal of executing such scans, is the first step in launching an attack on the scanned host. To detect sophisticated scans we propose the integration of graph feature extraction techniques with visualization to simultaneously optimize computational complexity and human analyst time. The integrated approach uses graph modeling and preprocessing to make visual displays easy to comprehend, and uses human intervention to avoid solving NP-hard computational problems while still providing real-time visualization.