search menu icon-carat-right cmu-wordmark

Identifying Anomalous Port-Specific Network Behavior

Technical Report
In this report, Rhiannon Weaver describes a method for identifying network behavior that may be a sign of coming internet-wide attacks.
Publisher

Software Engineering Institute

CMU/SEI Report Number
CMU/SEI-2010-TR-010
DOI (Digital Object Identifier)
10.1184/R1/6574142.v1

Abstract

Increasing trends in traffic volume on specific ports may indicate new interest in a vulnerability associated with that port. This activity can be a precursor to internet-wide attacks. Port-specific behavior can also arise from stealthy applications that migrate to different ports in order to evade firewalls. But detecting this subtle activity among thousands of monitored ports requires careful statistical modeling as well as methods for controlling false positives. The analysis documented in this report is a large-scale application of statistical outlier detection for determining unusual port-specific network behavior. The method uses a robust correlation measure to cluster related ports and to control for the background baseline traffic trend. A scaled, median-corrected process, called a Z-score, is calculated for the hourly volume measurements for each port. The Z-score measures how unusual each port's behavior is in comparison with the rest of the ports in its cluster. The researchers discuss lessons learned from applying the method to the hourly count of incoming flow records for a carrier-class network over a period of three weeks.

Cite This Technical Report

Weaver, R. (2010, May 1). Identifying Anomalous Port-Specific Network Behavior. (Technical Report CMU/SEI-2010-TR-010). Retrieved July 13, 2024, from https://doi.org/10.1184/R1/6574142.v1.

@techreport{weaver_2010,
author={Weaver, Rhiannon},
title={Identifying Anomalous Port-Specific Network Behavior},
month={May},
year={2010},
number={CMU/SEI-2010-TR-010},
howpublished={Carnegie Mellon University, Software Engineering Institute's Digital Library},
url={https://doi.org/10.1184/R1/6574142.v1},
note={Accessed: 2024-Jul-13}
}

Weaver, Rhiannon. "Identifying Anomalous Port-Specific Network Behavior." (CMU/SEI-2010-TR-010). Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, May 1, 2010. https://doi.org/10.1184/R1/6574142.v1.

R. Weaver, "Identifying Anomalous Port-Specific Network Behavior," Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, Technical Report CMU/SEI-2010-TR-010, 1-May-2010 [Online]. Available: https://doi.org/10.1184/R1/6574142.v1. [Accessed: 13-Jul-2024].

Weaver, Rhiannon. "Identifying Anomalous Port-Specific Network Behavior." (Technical Report CMU/SEI-2010-TR-010). Carnegie Mellon University, Software Engineering Institute's Digital Library, Software Engineering Institute, 1 May. 2010. https://doi.org/10.1184/R1/6574142.v1. Accessed 13 Jul. 2024.

Weaver, Rhiannon. Identifying Anomalous Port-Specific Network Behavior. CMU/SEI-2010-TR-010. Software Engineering Institute. 2010. https://doi.org/10.1184/R1/6574142.v1