Identifying Reconnaissance Activity: A Strategy for Network Defence
Scanlan, J and Hartnett, J and Williams, R (2005) Identifying Reconnaissance Activity: A Strategy for Network Defence. In: 6th Australian Information Warfare and Security Conference, 25 - 26 November 2005, Geelong, Victoria.
|PDF - Requires a PDF viewer|
Over recent years there has been a massive increase in the need to build stronger and more effective defensive systems in many contexts due to the amplified threat of terrorism. Network security is no exception to this increased need to secure systems against attack. One area within network security which has received a heightened interest is the correlation of reconnaissance activities, rather than merely blocking source addresses without further investigation. This paper will examine the work to date and detail how various researchers have approached the correlation of network scan activity, in relation to the detection of more overt malicious activity or network mapping. The systems that have been built contain two key components for examination: the correlation engine and the method by which data is collected and in some cases transported across the host network. After the summary of existing research this paper will then detail new work we are undertaking in this field, using clustering techniques in conjunction with a peer to peer network, to correlate port scan activity in real-time.
|Item Type:||Conference or Workshop Item (Paper)|
|Keywords:||data correlation, attack detection|
|Deposited By:||utas eprints|
|Deposited On:||23 Aug 2006|
|Last Modified:||18 Jul 2008 19:42|
|ePrint Statistics:||View statistics for this ePrint|
Repository Staff Only: item control page