Author(s)

Sunil Kumar, Kamlesh Dutta, Ankit Asati

Department of Computer Science and Engineering, National Institute of Technology, Hamirpur-177005, Himachal Pradesh, INDIA.

Anomaly detection is now very important in the network because the increasing use of the internet and security of a network or user is a main concern of any network administrator. As the use of the internet increases, so the chances of having a threat or attack in the network are also increasing day by day and traffic in the network is also increasing. It is very difficult to analyse all the traffic data in network for finding the anomaly in the network and sampling provides a way to analyse the anomalies in network with less traffic data. In this paper, we propose a port scan detection approach called CPST uses connection status and pattern of the connections to detect a particular source is scanner or benign host. We also show that this approach works efficiently under different sampling methods.

Port Scan, TRW, TAPS, CPST, Packet Sampling, Flow Sampling

Kumar, S. , Dutta, K. and Asati, A. (2015) Two Pass Port Scan Detection Technique Based on Connection Pattern and Status on Sampled Data. Journal of Computer and Communications, 3, 1-8. doi: 10.4236/jcc.2015.39001.