摘要： 提出一种基于TCP端口和标志位异常检测的主动检测扫描技术。通过主动学习被保护网络提供的服务端口和TCP标志字段的分布特征,判断出每个到达数据包的异常性,检测各种基于TCP的扫描行为包括慢扫描和隐蔽扫描等多种系统扫描行为。测试表明,主动扫描技术具有很高检测率和较低的误报警率。

关键词: 端口扫描, 异常检测, 网络安全

Abstract: This paper presents a new method, which is active detect network scans, based on TCP's port and flag's anomaly detection. Through actively leam the distribution of ports and flags of TCP packets that arrive at the protected network, people can compute the anomaly score of each TCP packet to detect various TCP scans including slow scans and stealthy scans. The experiment results show that the new technique has a high detect-rate and a low false-negative.

中图分类号: 

• TP393.08