一种新的端口扫描检测方法

An New Portscan Detection Method

针对现有端口扫描方法存在的缺陷,提出一种端口扫描检测的新方法。该方法充分利用受保护网段内各主机的特征,对可疑事件进行关联分析,不但可以检测现有工具都可以检测的扫描,而且对慢速扫描的检测也非常有效。

A new portscan detection method is presented to overcome the existing defects of current portscan metrods. In this method, the hosts＇ features in the protected network are fully used to conduct the associate analysis to all the suspicious events. This method can detect all the scans that are detected by current techniques,and is quite efficient in slow scan detect.