自适应分布式端口扫描检测方法  

Self-adaptive distributed detection method of port scan

作　　者：刘庭华[1] 宋华[1] 戴一奇[1] 

机构地区：[1]清华大学计算机科学与技术系,北京100084

出　　处：《计算机工程与设计》2006年第9期1521-1523,共3页Computer Engineering and Design

基　　金：国家自然科学基金项目(90104032)

摘　　要：简要介绍了端口扫描技术及其检测技术,设计并实现了一种自适应的分布式端口扫描检测方法。该方法通过对异常包的检测及分类计算异常值的总和,并结合网络流量,设定动态阈值,然后判断出扫描。这种方法能有效地检测到慢速扫描、随机化扫描和分布式扫描,并能检测出分布式拒绝服务(DDoS)攻击。Techniques of the port scan and its detection were introduced briefly. A new self-adaptive distributed detection method of port scan was designed and implemented. By detecting anomalous packets and calculating the class＇s anomaly sum value, it sets a dynamic threshold combined with the network traffic, and then judges whether that is a scan. This method could detect slow scans, random scans and distributed scans effectively. And it could detect DDoS （distributed denial of service） attacks as well.

关 键 词：端口扫描 端口扫描检测 分布式端口扫描检测 异常包 分布式拒绝服务 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]