Feasibility Study of Port Scan Detection on Encrypted Data

Abstract

We explore the feasibility of implementing port scan detection on encrypted data to protect confidentiality of sensitive network data. We experiment with four popular Port Scan detection algorithms namely Classic Version (and its Time Variant), Threshold Random Walk (TRW), Bayesian Logistic Regression (BLR). We also provide experimental results on performance and storage of our query based implementation on network flow data. Our key observation is that for complex operations on encrypted data Onion-layered encryption system like Crypt DB does not scale well.