Interactive Visualization for Network and Port Scan Detection

Many times, network intrusion attempts begin with either a network scan, where a connection is attempted to every possible destination in a network, or a port scan, where a connection is attempted to each port on a given destination. Being able to detect such scans can help identify a more dangerous threat to a network. Several techniques exist to automatically detect scans, but these are mostly dependant on some threshold that an attacker could possibly avoid crossing. This paper presents a means to use visualization to detect scans interactively. Key words: Network security, information visualization, intrusion detection, user interfaces, port scans, network scans

• Type: Conference
• Year: 2005
• Where: RAID
• Authors: Chris Muelder, Kwan-Liu Ma, Tony Bartoletti
• Keywords: Network Intrusion, Network Scans, Port Scans, RAID 2005