Connection Table Based Scanning Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network anomaly detection systems face challenges in effectively identifying scanning attacks, particularly stealthy ping scans, which are often missed due to their slow and covert nature, leading to increased management costs and security vulnerabilities in enterprise networks.
Innovation Solution
A method that involves maintaining a connection table to track host-pair interactions over short and long update periods, using adjustable thresholds to identify hosts that engage in excessive scanning activities, and reporting anomalies such as port scans, which distinguishes between normal and abnormal host interactions based on historical traffic patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anomaly detection systems are used, then network security monitoring is provided, but scanning attacks particularly stealthy ping scans are often missed
Solution Approach 1:
The system performs preliminary actions by maintaining historical profiles of normal host interactions and pre-establishing thresholds for detecting anomalies. Before a scanning attack occurs, the system has already built baseline data about typical connection patterns, allowing it to detect deviations from normal behavior even in stealthy scans that use slow, covert communication techniques.
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring current host interactions against historical profiles and adjusting detection thresholds based on observed patterns. The feedback loop compares real-time connection data with established baselines, enabling the system to adapt to evolving network conditions while maintaining accurate detection of scanning attacks that attempt to hide their true nature.
2Reliability
If network monitoring is performed to detect security violations, then network security is improved, but management costs increase
Solution Approach 1:
The system extracts only the essential information needed for security monitoring from the vast amount of network traffic data. By focusing solely on connection patterns, host interactions, and anomaly indicators rather than processing every packet detail, the system achieves effective security monitoring with significantly reduced computational resources and management overhead.
Solution Approach 2:
The monitoring system performs self-service by automatically generating and maintaining its own historical profiles of normal network behavior without requiring manual configuration or extensive human analysis. The system self-calibrates using observed network patterns, reducing the need for expensive manual security analysis while maintaining high detection accuracy.
3Reliability
If connection tables are maintained to track host interactions, then scanning attacks are detected, but system complexity increases
Solution Approach 1:
The system segments the monitoring function into distinct modular components: connection table maintenance, historical profile management, anomaly detection logic, and alert generation. This segmentation allows each component to be independently optimized and managed, reducing overall system complexity while maintaining comprehensive scanning attack detection capabilities through organized data structures and separate processing stages.
Data Source
AI summary
A system for detecting network intrusions and other conditions in a network is described. The system includes a plurality of collector devices that are disposed to collect data and statistical information on packets that are sent between nodes on a network. An aggregator device is disposed to receive data and statistical information from the plurality of collector devices. The aggregator device produces a connection table that maps each node on the network to a record that stores information about traffic to or from the node. The aggregator runs processes that determine network events from aggregating of anomalies into network events.