Development of a Network Scan Detection System Combining Sequential Hypothesis Testing with Long-Window and Target-Centric Correlation

Abstract

Network scanning is the reconnaissance step that precedes most intrusions, yet scans that are slow, low-volume or distributed across many sources often evade the fixed-threshold detectors used in practice. This paper evaluates eight open-source scan detection tools against eight functions derived from MITRE ATT&CK techniques T1046, T1595 and T1018, using an ordinal 0–2 scale and a weighted scoring model. Snort 3 obtained the highest weighted score (76.25 of 100), followed by Security Onion (72.50), while slow-scan detection (31.25% mean coverage) and distributed-scan detection (18.75%) were the weakest functions. To close these gaps, we propose NSDS, a network scan detection system that combines a threshold random walk over new destination–port pairs with evidence ageing, a 60 min distinct-failure counter and a target-centric correlation module, and maps detections to a transparent risk score. In a simulation of a network with 464 active sources and five scan scenarios (150 runs of 2 h each), NSDS detected every scan campaign, including slow and distributed scans missed by a fixed-threshold detector and by host-level TRW, while flagging on average 0.03 benign sources per run, compared with 2.04 and 5.73 for the baselines. Validation on real traffic remains future work.

Keywords: port scanning, intrusion detection, network reconnaissance, threshold random walk, distributed scanning, MITRE ATT&CK, risk scoring, network security monitoring

Әдебиеттер тізімі

1. Allman, M.; Paxson, V.; Terrell, J. A Brief History of Scanning. In Proceedings of the 7th ACM SIGCOMM Conference on Internet Measurement (IMC ’07), San Diego, CA, USA, 24–26 October 2007; pp. 77–82.
2. MITRE Corporation. Active Scanning, Technique T1595—Enterprise. MITRE ATT&CK. Available online: https://attack.mitre.org/techniques/T1595/ (accessed on 10 November 2026).
3. MITRE Corporation. Network Service Discovery, Technique T1046—Enterprise. MITRE ATT&CK. Available online: https://attack.mitre.org/techniques/T1046/ (accessed on 10 November 2026).
4. MITRE Corporation. Remote System Discovery, Technique T1018—Enterprise. MITRE ATT&CK. Available online: https://attack.mitre.org/techniques/T1018/ (accessed on 10 November 2026).
5. Lyon, G.F. Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning; Insecure.Com LLC: Sunnyvale, CA, USA, 2009.
6. Durumeric, Z.; Wustrow, E.; Halderman, J.A. ZMap: Fast Internet-Wide Scanning and Its Security Applications. In Proceedings of the 22nd USENIX Security Symposium, Washington, DC, USA, 14–16 August 2013; pp. 605–620.
7. Graham, R.D. MASSCAN: Mass IP Port Scanner. Available online: https://github.com/robertdavidgraham/masscan (accessed on 10 November 2026).
8. Durumeric, Z.; Bailey, M.; Halderman, J.A. An Internet-Wide View of Internet-Wide Scanning. In Proceedings of the 23rd USENIX Security Symposium, San Diego, CA, USA, 20–22 August 2014; pp. 65–78.
9. National Institute of Standards and Technology. The NIST Cybersecurity Framework (CSF) 2.0; NIST CSWP 29; NIST: Gaithersburg, MD, USA, 2024.
10. Scarfone, K.; Mell, P. Guide to Intrusion Detection and Prevention Systems (IDPS); NIST SP 800-94; National Institute of Standards and Technology: Gaithersburg, MD, USA, 2007.
11. Bou-Harb, E.; Debbabi, M.; Assi, C. Cyber Scanning: A Comprehensive Survey. IEEE Commun. Surv. Tutor. 2014, 16, 1496–1519.
12. Bhuyan, M.H.; Bhattacharyya, D.K.; Kalita, J.K. Surveying Port Scans and Their Detection Methodologies. Comput. J. 2011, 54, 1565–1581.
13. Staniford, S.; Hoagland, J.A.; McAlerney, J.M. Practical Automated Detection of Stealthy Portscans. J. Comput. Secur. 2002, 10, 105–136.
14. Gates, C. Coordinated Scan Detection. In Proceedings of the 16th Annual Network and Distributed System Security Symposium (NDSS 2009), San Diego, CA, USA, 8–11 February 2009.
15. Roesch, M. Snort—Lightweight Intrusion Detection for Networks. In Proceedings of the 13th USENIX Conference on System Administration (LISA ’99), Seattle, WA, USA, 7–12 November 1999; pp. 229–238.
16. Paxson, V. Bro: A System for Detecting Network Intruders in Real-Time. Comput. Netw. 1999, 31, 2435–2463.
17. Wald, A. Sequential Tests of Statistical Hypotheses. Ann. Math. Stat. 1945, 16, 117–186.
18. Jung, J.; Paxson, V.; Berger, A.W.; Balakrishnan, H. Fast Portscan Detection Using Sequential Hypothesis Testing. In Proceedings of the 2004 IEEE Symposium on Security and Privacy, Berkeley, CA, USA, 9–12 May 2004; pp. 211–225.
19. Weaver, N.; Staniford, S.; Paxson, V. Very Fast Containment of Scanning Worms. In Proceedings of the 13th USENIX Security Symposium, San Diego, CA, USA, 9–13 August 2004; pp. 29–44.
20. Lakhina, A.; Crovella, M.; Diot, C. Mining Anomalies Using Traffic Feature Distributions. In Proceedings of the ACM SIGCOMM 2005 Conference, Philadelphia, PA, USA, 22–26 August 2005; pp. 217–228.
21. Sharafaldin, I.; Lashkari, A.H.; Ghorbani, A.A. Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization. In Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP 2018), Funchal, Portugal, 22–24 January 2018; pp. 108–116.
22. Moustafa, N.; Slay, J. UNSW-NB15: A Comprehensive Data Set for Network Intrusion Detection Systems (UNSW-NB15 Network Data Set). In Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, Australia, 10–12 November 2015; pp. 1–6.
23. Ring, M.; Wunderlich, S.; Scheuring, D.; Landes, D.; Hotho, A. A Survey of Network-Based Intrusion Detection Data Sets. Comput. Secur. 2019, 86, 147–167.
24. Cisco Talos. Snort 3 Documentation: Port Scan Inspector. Available online: https://docs.snort.org/ (accessed on 10 November 2026).
25. Open Information Security Foundation. Suricata User Guide. Available online: https://docs.suricata.io/ (accessed on 10 November 2026).
26. The Zeek Project. policy/misc/scan.zeek—Zeek Documentation. Available online: https://docs.zeek.org/en/lts/scripts/policy/misc/scan.zeek.html (accessed on 10 November 2026).
27. Rash, M. psad: Intrusion Detection and Log Analysis with iptables. Available online: https://www.cipherdyne.org/psad/ (accessed on 10 November 2026).
28. Openwall. scanlogd: A Port Scan Detection Tool. Available online: https://www.openwall.com/scanlogd/ (accessed on 10 November 2026).
29. Psionic Software. PortSentry (Sentry Tools Project). Available online: https://sourceforge.net/projects/sentrytools/ (accessed on 10 November 2026).
30. Wazuh. Wazuh Documentation: Active Response. Available online: https://documentation.wazuh.com/ (accessed on 10 November 2026).
31. Security Onion Solutions. Security Onion Documentation. Available online: https://docs.securityonion.net/ (accessed on 10 November 2026).
32. Claise, B.; Trammell, B.; Aitken, P. Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information; RFC 7011; Internet Engineering Task Force: Fremont, CA, USA, 2013.
33. Gerhards, R. The Syslog Protocol; RFC 5424; Internet Engineering Task Force: Fremont, CA, USA, 2009.

Дәйексөз келтіру үлгісі

Ilzat Khanzatov, Amir Zhumatayev, Akezhan Serkebayev Development of a Network Scan Detection System Combining Sequential Hypothesis Testing with Long-Window and Target-Centric Correlation // Central Asian Scientific Journal. – 2026. – No. 4(32), Vol. 2. – Pp. 265–275.