Research on portscan detection based on selective packet sampling

To achieve efficient and effective detection of portscan attacks on high-speed internet backbone links, a new packet sampling technique that focuses on the selection of small packets is introduced and analyzed. A new portscan detection algorithm, SnortHoneypot, which combines the detection techniques of Snort and honeypot is proposed. Under the condition of using systematic sampling, SnortHoneypot is found to have better performance on portscan detection compared with Snort. Meanwhile, this paper performs a comparative analysis of the impact of selective sampling and systematic sampling on portscan detection using real backbone packet traces by applying them to two anomaly detection algorithms: Snort and SnortHoneypot. The experimental results show that, at the same sampling rate, selective sampling exhibits better performance in terms of catching more number of true scanners.