Sciweavers

Share
INFOCOM
2012
IEEE

Stochastic analysis of horizontal IP scanning

7 years 9 months ago
Stochastic analysis of horizontal IP scanning
—Intrusion Detection Systems (IDS) have become ubiquitous in the defense against virus outbreaks, malicious exploits of OS vulnerabilities, and botnet proliferation. As attackers frequently rely on host scanning for reconnaissance leading to penetration, IDS is often tasked with detecting scans and preventing them. However, it is currently unknown how likely an IDS is to detect a given Internet-wide scan pattern and whether there exist sufficiently fast scan techniques that can remain virtually undetectable at large-scale. To address these questions, we propose a simple analytical model for the window-expiration rules of popular IDS tools (i.e., Snort and Bro) and utilize a variation of the Chen-Stein theorem to derive the probability that they detect some of the commonly used scan permutations. Using this analysis, we also prove the existence of stealth-optimal scan patterns, examine their performance, and contrast it with that of well-known techniques.
Derek Leonard, Zhongmei Yao, Xiaoming Wang, Dmitri
Added 28 Sep 2012
Updated 28 Sep 2012
Type Journal
Year 2012
Where INFOCOM
Authors Derek Leonard, Zhongmei Yao, Xiaoming Wang, Dmitri Loguinov
Comments (0)
books