Detection of TCP SYN Scanning Using Packet Counts and Neural Network

摘要

Port Scanning is used by malicious users to mapthe characteristics of a network to launch furtherattacks. Hence, detection of port scanning assumesparamount importance. This paper investigates theeffectiveness of using counts of various TCP controlpackets in detecting TCP SYN scanning on a singlemachine. The behavioural characteristics of TCPcontrol packets are aggregated. A Neural Network istrained to capture this behaviour for normal as wellas port scan data. It is seen from the investigationthat the counts of TCP SYN, SYN-ACK and FINpackets show definite patterns in their behaviour forlegitimate connections. A deviation from thisbehaviour is used to effectively detect TCP SYNscanning without maintaining state information.