An Intelligent Flow-Level Anomaly Detection Framework for Identifying Stealthy Network Reconnaissance Attacks

Network scanning is one of the very basic reconnaissance actions carried out by enemies to identify vulnerable machines and open ports before launching targeted attacks. Contemporary stealthy scanning tactics spread out probing operations over long temporal periods of time, thus evading typical signature based intrusion detection systems. In this manuscript, we show a flow-level behavioral analysis framework designed to detect attacks based on the covert scanning technique without requiring the inspection of the payload. Our methodology aggregates packet traces into flow records and derives a suite of statistical and temporal metrics including connection frequency, destination port diversity, inter-arrival time, flow duration and protocol-specific response signatures to capture the dynamic characteristics of network traffic. A behavioral baseline is set based on an analysis of benign historic traffic, and an analysis of anomalous behavior is conducted using Mahalanobis distance based statistical modelling that offers a strongly quantified metric of deviation. The proposed framework supports the principle transport protocols: TCP, UDP, ICMP, and DNS; and has capability to categories scanners along horizontal, vertical and distributed dimensions. Experimental results prove that the framework satisfies low detection latency while improving anomaly identification at insignificant processing overhead, making it extremely applicable to be deployed across high speed enterprise networks.