Recently, there are many indiscriminant attacks against end-hosts on the Internet. As attackers carry out TCP portscans to find vulnerable end-hosts, portscans can be considered as the sign of intrusion. Therefore prompt detection of the portscan is significant to prepare protection of end-hosts.
papers
Masayoshi KOHARA，Yoshiaki HORI，Koichi SAKURAI
“A State of Portscan in Campus Network and its Automated Detection”
In Proceedings of Symposium on Cryptography and Information Security (SCIS2005)， pp.1543--1548， January，2005．
Masayoshi KOHARA，Yoshiaki HORI，Koichi SAKURAI
“Fast TCP Portscan Detection Method”
IPSJ SIG Technical Reports, pp.37-42, May，2005．