search menu icon-carat-right cmu-wordmark

Detecting Scans at the ISP Level

Technical Report
In this 2006 report, the authors present an approach to detecting scans against, or passing through, very large networks.
Publisher

Software Engineering Institute

CMU/SEI Report Number
CMU/SEI-2006-TR-005

Abstract

Scans are often used by adversaries to determine the potential weaknesses in a target network or system prior to an intrusion attempt. In other cases, exploits are packaged with the scans themselves. This report presents a novel approach to detecting scans (including very stealthy scans) against, or passing through, very large networks. It meets operational requirements that are particular to detecting scans in ISP level networks. 

This scan-detection approach performs an ongoing, incremental analysis of flow-level data regarding traffic inbound to a network. It is multi-dimensional and flexible, based on up to 21 characteristics describing traffic collected from any single source.  

The report describes in detail a method developed to provide a probability that a particular traffic sample contains a scan. In validation testing using a manual analysis of traffic collected from a high-volume network, this method correctly classified 99.3% of TCP traffic samples.

Cite This Technical Report

Gates, C., Kadane, J., McNutt, J., & Kellner, M. (2006, April 1). Detecting Scans at the ISP Level. (Technical Report CMU/SEI-2006-TR-005). Retrieved December 2, 2023, from https://insights.sei.cmu.edu/library/detecting-scans-at-the-isp-level/.

@techreport{gates_2006,
author={Gates, Carrie and Kadane, Joseph and McNutt, Josh and Kellner, Marc},
title={Detecting Scans at the ISP Level},
month={Apr},
year={2006},
number={CMU/SEI-2006-TR-005},
howpublished={Carnegie Mellon University, Software Engineering Institute's Digital Library},
url={https://insights.sei.cmu.edu/library/detecting-scans-at-the-isp-level/},
note={Accessed: 2023-Dec-2}
}

Gates, Carrie, Joseph Kadane, Josh McNutt, and Marc Kellner. "Detecting Scans at the ISP Level." (CMU/SEI-2006-TR-005). Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, April 1, 2006. https://insights.sei.cmu.edu/library/detecting-scans-at-the-isp-level/.

C. Gates, J. Kadane, J. McNutt, and M. Kellner, "Detecting Scans at the ISP Level," Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, Technical Report CMU/SEI-2006-TR-005, 1-Apr-2006 [Online]. Available: https://insights.sei.cmu.edu/library/detecting-scans-at-the-isp-level/. [Accessed: 2-Dec-2023].

Gates, Carrie, Joseph Kadane, Josh McNutt, and Marc Kellner. "Detecting Scans at the ISP Level." (Technical Report CMU/SEI-2006-TR-005). Carnegie Mellon University, Software Engineering Institute's Digital Library, Software Engineering Institute, 1 Apr. 2006. https://insights.sei.cmu.edu/library/detecting-scans-at-the-isp-level/. Accessed 2 Dec. 2023.

Gates, Carrie; Kadane, Joseph; McNutt, Josh; & Kellner, Marc. Detecting Scans at the ISP Level. CMU/SEI-2006-TR-005. Software Engineering Institute. 2006. https://insights.sei.cmu.edu/library/detecting-scans-at-the-isp-level/