Router Port Scan Detection via Anomaly Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting port scanning attacks in high-speed networks, especially with low sampling rates, suffer from high false negatives and false positives, and are ineffective due to environmental variability, leading to adverse effects on router memory and internal routing tables.
Innovation Solution
A method involving anomaly detection on communication data transferred via a router to identify malicious IP addresses, generating attack signatures, and configuring routers using SDN protocols to mitigate port scanning traffic, leveraging Ternary Content-Addressable Memory (TCAM) and Software-defined networking (SDN) for real-time configuration and filtering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If aggressive sampling rates are applied to reduce load on routers, then router processing load is reduced, but detection precision deteriorates due to too many false negatives and false positives
Solution Approach 1:
The system performs preliminary anomaly detection on sampled flows to identify potential port scanning attacks before they overwhelm the router. By detecting suspicious patterns early in the sampling data, the system can then apply targeted deep inspection only to suspicious traffic, rather than processing all traffic at full depth.
Solution Approach 2:
The detection process is segmented into multiple stages: initial anomaly detection on sampled flows, identification of candidate scanning IPs, followed by more detailed analysis. This segmentation allows the system to handle high-volume traffic efficiently while maintaining detection accuracy for suspicious flows.
2Reliability
If port scanning detection algorithms are applied using sampled flows, then port scanning attacks can be detected, but false positives and false negatives increase when sampling rate is very low
Solution Approach 1:
The system uses feedback mechanisms where detection results from sampled flows inform subsequent processing decisions. When port scanning is detected in sampled data, the system feeds this information back to trigger enhanced monitoring and verification processes, adjusting the detection strategy based on observed traffic patterns.
Solution Approach 2:
The detection system dynamically adapts its behavior based on traffic conditions. When port scanning is detected, the system transitions from passive sampling to active verification modes, adjusting detection parameters and sampling rates dynamically to maintain accuracy while managing router load.
3Extent of automation
If machine learning concepts are used for port scanning detection, then automated detection can be achieved, but effectiveness decreases because each environment is different and no general training set works for all
Solution Approach 1:
Instead of relying on fixed machine learning models trained on specific environments, the system changes detection parameters dynamically based on observed traffic patterns. It adapts threshold values, sampling rates, and detection rules in real-time to match the current network environment, making it universally applicable without environment-specific training.
4Reliability
If port scanning attacks are not detected and mitigated, then network security may be compromised, but router memory is overwhelmed as flow entries occupy up to 70% of router memory
Solution Approach 1:
The system extracts and isolates suspicious port scanning traffic from the general traffic flow. By identifying and separating malicious flows early in the processing pipeline, the system prevents these flows from consuming excessive router memory while enabling targeted security responses.
Solution Approach 2:
The system takes preliminary anti-action by detecting and blocking port scanning attacks before they can overwhelm router memory. By implementing detection and mitigation measures in advance, the system prevents the accumulation of malicious flow entries that would otherwise consume 70% of router memory.
Data Source
AI summary
A method for securing data over a communication network, the method comprising detecting communication data transferred via a router in the communication network, applying an anomaly detection process on the detected communication data to identify malicious data sent via the router, generating a list of candidate Internet Protocol (IP) addresses having a probability of sending malicious data via the router, sending the list of candidates to the router, receiving additional telemetry about data received from the IP addresses included in the list of candidates, narrowing down the list of candidates to a list of verified attackers, generating one or more attack signatures configured to identify the port scanning traffic from the IP addresses included in the list of candidates, sending the one or more attack signatures to the router.