Statistical cross-relation approach for detecting TCP and UDP random and sequential network scanning (SCANS)

References

• Bay, S. D. , Kibler, D. , Pazzani, M. J. , and Smyth, P. , 2000. The UCI KDD archive of large data sets for data mining research and experimentation , SIGKDD Explor. Newsl. 2 (2) (2000), pp. 81–85.
   Google Scholar
• Benesty, J. , Chen, J. , and Huang, Y. , 2009. Pearson Correlation Coefficient Noise Reduction in Speech Processing . Vol. 2. Berlin, Heidelberg: Springer; 2009. pp. 1–4.
   Google Scholar
• Gu, G. , Porras, P. , Yegneswaran, V. , Fong, M. , and Lee, W. , 2007. "BotHunter: Detecting malware infection through IDS-driven dialog correlation". In: Proceedings of 16th SENIX Security Symposium on USENIX Security Symposium . Boston, MA: USENIX Association; 2007.
   Google Scholar
• Jung, J. , Paxson, V. , Berger, A. , and Balakrishnan, H. , "Fast portscan detection using sequential hypothesis testing". In: IEEE Symposium on Security and Privacy . Oakland, CA, May 2004.
   Google Scholar
• Kato, N. , Nitou, H. , Ohta, K. , Mansfield, G. , and Nemoto, Y. , 1999. A real-time intrusion detection system (IDS) for large scale networks and its evaluations , IEICE Trans. Commun. 82 (1999), pp. 1817–1825.
   Google Scholar
• Leckie, C. , and Kotagiri, R. , "A probabilistic approach to detecting network scans". In: Proceedings of the Eighth IEEE Network Operations and Management Symposium (NOMS 2002) . Florence, Italy. pp. 359–372, April 2002.
   Google Scholar
• Li, P. , Salour, M. , and Su, X. , 2008. A survey of internet worm detection and containment , IEEE Commun. Surv. Tutor. 10 (2008), pp. 20–35.
   Web of Science ®Google Scholar
• M. Mahoney and P.K. Chan, PHAD: Packet header anomaly detection for identifying hostile network traffic, Florida Institute of Technology technical report CS-2001-04, 2001, pp. 1–17. Available at https://cs.fit.edu/Projects/tech_reports/cs-2001-04.pdf..
   Google Scholar
• Massachusetts Institute of Technology, L. L. Available at http://www.ll.mit.edu/mission/communications/ist/corpora/ideval/data/1998data.html (accessed 14 September 2010)..
   Google Scholar
• Moore, D. , Paxson, V. , Savage, S. , Shannon, C. , Staniford, S. , and Weaver, N. , 2003. Inside the slammer worm , IEEE Secur. Priv. 1 (2003), pp. 33–39.
   Google Scholar
• NAv6, National Advanced IPv6 Centre of Excellence, 2010. Available at http://nav6.org..
   Google Scholar
• Nmap, Free security scanner for network exploration & security. Available at http://www.insecure.org/nmap/..
   Google Scholar
• Northcutt, S. , and Novak, J. , 2002. Network Intrusion Detection: An Analyst's Handbook . Thousand Oaks, CA: New Riders Publishing; 2002.
   Google Scholar
• Reed, W. , 2001. The Pareto, Zipf and other power laws , Econom. Lett. 74 (2001), pp. 15–19.
   Web of Science ®Google Scholar
• Roesch, M. , 1999. "Snort – lightweight intrusion detection for networks". In: Proceedings of USENIX LISA'99 . Washington: Seattle; 1999. pp. 7–12, November.
   Google Scholar
• C. Shannon, D. Moore, and J. Brown. Code-red: A case study on the spread and victims of an Internet worm, in Proceedings of the Internet Measurement Workshop (IMW), December 2002..
   Google Scholar
• Singh, S. , Estan, C. , Varghese, G. , and Savage, S. , 2003. "The earlybird system for real-time detection of unknown worms". In: Citeseer, Tech. Rep. CS2003-0761 . San Diego: University of California; 2003.
   Google Scholar
• Smaha, S. E. , 1988. "Haystack: An intrusion detection system". In: Proceedings of the IEEE Fourth Aerospace Computer Security Applications Conference . Los Alamitos, CA: IEEE Computer Society Press; 1988, Orlando, FL.
   Google Scholar
• Snort, A free lightweight network intrusion detection system for UNIX and Windows. Available at http://www.snort.org..
   Google Scholar
• Staniford, S. , Hoagland, J. A. , and McAlerney, J. M. , 2002. Practical automated detection of stealthy portscans , J. Comput. Secur. 10 (2002), pp. 105–136.
   Google Scholar
• de Vivo, M. , Carrasco, E. , Isern, G. , and de Vivo, G. O. , 1999. A review of port scanning techniques , ACM SIGCOMM Comput. Commun. Rev. 29 (1999), pp. 41–48.
   Google Scholar
• Zeidanloo, H. R. , Manaf, A. B.A. , Ahmad, R. B. , Zamani, M. , and Chaeikar, S. S. , 2010. A proposed framework for P2P Botnet detection , IACSIT Int. J. Eng. Technol. 2 (2010), pp. 161–168.
   Google Scholar