IdentifyingReconAct.pdf (85.34 kB)
Identifying Reconnaissance Activity: A Strategy for Network Defence
conference contribution
posted on 2023-05-26, 09:08 authored by Joel ScanlanJoel Scanlan, Hartnett, J, Williams, ROver recent years there has been a massive increase in the need to build stronger and more effective defensive systems in many contexts due to the amplified threat of terrorism. Network security is no exception to this increased need to secure systems against attack. One area within network security which has received a heightened interest is the correlation of reconnaissance activities, rather than merely blocking source addresses without further investigation. This paper will examine the work to date and detail how various researchers have approached the correlation of network scan activity, in relation to the detection of more overt malicious activity or network mapping. The systems that have been built contain two key components for examination: the correlation engine and the method by which data is collected and in some cases transported across the host network. After the summary of existing research this paper will then detail new work we are undertaking in this field, using clustering techniques in conjunction with a peer to peer network, to correlate port scan activity in real-time.
History
Publication status
- Published
Event title
6th Australian Information Warfare and Security ConferenceEvent Venue
Geelong, VictoriaDate of Event (Start Date)
2005-11-24Date of Event (End Date)
2005-11-26Repository Status
- Open
Usage metrics
Categories
No categories selectedKeywords
Licence
Exports
RefWorks
BibTeX
Ref. manager
Endnote
DataCite
NLM
DC