To access the full text documents, please follow this link: http://hdl.handle.net/2117/13177
| dc.contributor | Universitat Politècnica de Catalunya. Departament d'Arquitectura de Computadors |
|---|---|
| dc.contributor | Universitat Politècnica de Catalunya. CBA - Sistemes de Comunicacions i Arquitectures de Banda Ampla |
| dc.contributor.author | Mikians, Jakub |
| dc.contributor.author | Barlet Ros, Pere |
| dc.contributor.author | Sanjuàs Cuxart, Josep |
| dc.contributor.author | Solé Pareta, Josep |
| dc.date | 2011 |
| dc.identifier.citation | Mikians, J. [et al.]. A practical approach to portscan detection in very high-speed links. A: International Conference on Passive and Active Measurement. "12th International Conference on Passive and Active Measurement". Springer Verlag, 2011, p. 112-121. |
| dc.identifier.citation | 10.1007/978-3-642-19260-9_12 |
| dc.identifier.uri | http://hdl.handle.net/2117/13177 |
| dc.description.abstract | Port scans are continuously used by both worms and human attackers to probe for vulnerabilities in Internet facing systems. In this paper, we present a new method to efficiently detect TCP port scans in very high-speed links. The main idea behind our approach is to early discard those handshake packets that are not strictly needed to reliably detect port scans. We show that with just a couple of Bloom filters to track active servers and TCP handshakes we can easily discard about 85% of all handshake packets with negligible loss in accuracy. This significantly reduces both the memory requirements and CPU cost per packet. We evaluated our algorithm using packet traces and live traffic from 1 and 10 GigE academic networks. Our results show that our method requires less than 1 MB to accurately monitor a 10 Gb/s link, which perfectly fits in the cache memory of nowadays’ general-purpose processors. |
| dc.description.abstract | Peer Reviewed |
| dc.language.iso | eng |
| dc.publisher | Springer Verlag |
| dc.relation | http://www.springerlink.com/content/m7x721553k62w312/ |
| dc.rights | Attribution-NonCommercial-NoDerivs 3.0 Spain |
| dc.rights | info:eu-repo/semantics/openAccess |
| dc.rights | http://creativecommons.org/licenses/by-nc-nd/3.0/es/ |
| dc.subject | Àrees temàtiques de la UPC::Enginyeria de la telecomunicació::Telemàtica i xarxes d'ordinadors::Xarxes de banda ampla |
| dc.subject | Port scanner |
| dc.subject | Very high-speed links |
| dc.subject | TCP ports |
| dc.subject | Escàner de ports (Informàtica) |
| dc.title | A practical approach to portscan detection in very high-speed links |
| dc.type | info:eu-repo/semantics/publishedVersion |
| dc.type | info:eu-repo/semantics/conferenceObject |
Related documents
Other documents of the same author
Sanjuàs Cuxart, Josep; Barlet Ros, Pere; Solé Pareta, Josep; Andriuzzi, Gabriella
Barlet Ros, Pere; Sanjuàs Cuxart, Josep; Solé Pareta, Josep; Gandía, Maria Isabel; Malagón, Chelo
Mikians, Jakub; Laoutaris, Nikolaos; Dhamdhere, Amogh; Barlet Ros, Pere
Sanjuàs Cuxart, Josep; Barlet Ros, Pere; Duffield, Nick; Kompella, Ramana
Sanjuàs Cuxart, Josep; Barlet Ros, Pere; Duffield, Nick; Kompella, Ramana