Slow Port Scanning with Bro
Year: 2013
Type: dissertation
Abstract: ENGLISH: Today’s society relies on computer networks. More and more data of vital importance are transmitted over\nthem each day. Because of that, networks have become an interesting target for attackers, from ordinary\ncriminals to foreign organizations and states. This has forced equipment providers and network administrators\nto make computer networks more robust. To this end, various countermeasures against cyber attacks\nare performed. One of the most commonly used ones is application of Intrusion Detection Systems (IDS).\nThese systems are capable of classifying network traffic into several categories, according to the traffic features\ndetermined in advance. The basic classification performed by them is the classification in two classes\n– benign traffic and malicious traffic.\nThe classification methods that IDS implement are different, but classic pattern/signature matching and\nstatistical parametric decision making are used very often. According to the intrusion detection model,\nIDS are classified into two categories: misuse detection systems and anomaly detection systems. Misuse\ndetection systems use a database of known attacks and report if they recognize signatures of known attacks\nin the incoming traffic. Anomaly detection systems define profiles of normal host/network behavior and\nreport discrepancies from that.\nThis thesis concentrates on methods of detection of special kind of reconnaissance activity in computer\nnetworks – so-called port scanning, which tries to determine what services are active on a target host. In\naddition, the scans are considered slow – this means that the time delay between scanning two ports is\nrelatively long – from several minutes to several days. This kind of port scanning is in general harder to\ndetect by IDS. The IDS of particular interest in this context is Bro – an open-source system that detects\nintrusions by semantic, highly stateful traffic analysis. This system also has advanced protocol detection\ncapabilities. It can be configured to be either misuse or anomaly detection system, even a combination of\nboth at the same time. As such, it has attracted much attention of the scientific community in the recent\nyears. The goal of the thesis is to develop a method for slow port scanning detection with Bro and compare\nthe capabilities of the new method with slow port scanning detection methods applied on other IDS,\nespecially in the presence of noise.\nOur results shows that our modified version of scan.bro policy script, gave improved slow port scanning\ndetection capabilities in Bro.
Author: Roger Larsen
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W2462522988