Scalable Double Filter Structure for Port Scan Detection

Port scan detection is very important to predict network intrusions and prevent viruses from spreading. Many networks deploy Network Intrusion Detection Systems (NIDS) to detect port scans in real-time. However, most NIDS are perflow based. They are not scalable on high speed links since it is infeasible to maintain the states of numerous flows. In this paper, we propose a scalable scheme for real-time port scan detection without keeping any per-flow state. We use a double-filter structure to find out <SIP1, SP> pairs which connect to more than N <DIP, DP> pairs in T time. The experimental results on real network traces show that our scheme can find out those over-threshold <SIP, SP> pairs with high accuracy. It is easy to scale our scheme to high speed environments due to its little memory consumption and fast processing pipeline.