On detecting port scanning using fuzzy based intrusion detection system

Wassim El-Hajj, Fadi Aloul, Zouheir Trabelsi, Nazar Zaki

Research output: Chapter in Book/Report/Conference proceedingConference contribution

21 Citations (Scopus)

Abstract

Intrusion detection is a mechanism used to detect various attacks on a wired or wireless network. Port scanning is one of the dangerous attacks that intrusion detection tries to detect. Snort, a famous network intrusion detection system (NIDS), detects a port scanning attack by combining and analyzing various traffic parameters. Because these parameters cannot be easily combined using a mathematical formula, fuzzy logic can be used to combine them; fuzzy logic can also reduce the number of false alarms. This paper presents a novel approach, based on fuzzy logic, to detect port scanning attacks. A fuzzy logic controller is designed and integrated with Snort in order to enhance the functionality of port scanning detection. Experiments are carried out in both wired and wireless networks. The results show that applying fuzzy logic adds to the accuracy of determining bad traffic. Moreover, it gives a level of degree for each type of port scanning attack.

Original languageEnglish
Title of host publicationIWCMC 2008 - International Wireless Communications and Mobile Computing Conference
Pages105-110
Number of pages6
DOIs
Publication statusPublished - 2008
EventInternational Wireless Communications and Mobile Computing Conference, IWCMC 2008 - Crete, Greece
Duration: Aug 6 2008Aug 8 2008

Publication series

NameIWCMC 2008 - International Wireless Communications and Mobile Computing Conference

Other

OtherInternational Wireless Communications and Mobile Computing Conference, IWCMC 2008
Country/TerritoryGreece
CityCrete
Period8/6/088/8/08

Keywords

  • Fuzzy logic
  • Intrusion detection system
  • Port scanning
  • Snort

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Software
  • Electrical and Electronic Engineering

Fingerprint

Dive into the research topics of 'On detecting port scanning using fuzzy based intrusion detection system'. Together they form a unique fingerprint.

Cite this