Sampling techniques are often used for traffic monitoring in high-speed links in order to avoid saturation of network resources. Although there is a wide existing research dealing with anomaly detection, few studies analyzed the impact of sampling on the performance of portscan detection algorithms. In this paper, we performed several experiments on two already existing portscan detection mechanisms to test whether they are robust enough to different sampling techniques. Unlike previous works, we found that flow sampling is not always better than packet sampling to continue detecting portscans reliably. © Springer-Verlag Berlin Heidelberg 2009.
CITATION STYLE
Paredes-Oliva, I., Barlet-Ros, P., & Solé-Pareta, J. (2009). Portscan detection with sampled netflow. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) (Vol. 5537 LNCS, pp. 26–33). https://doi.org/10.1007/978-3-642-01645-5_4
Mendeley helps you to discover research relevant for your work.