Detection of intranet scanning traffic and tool detection based on multi-feature fusion

Abstract

Network port scanning is a crucial information gathering technique that precedes various types of cyberattacks, and it poses a primary challenge in the network defense process. Detecting port scanning traffic and identifying the types of scanning tools used can help security personnel discover unknown scanning activities, understand the attackers’ intentions, and implement targeted defenses. This paper proposes a multi-feature fusion-based scanning tool identification method, MUST, to address this challenge. First, the core data packets within each network session are extracted and transformed into Traffic Graphs (TGs). These TGs represent the communication behavior of the sessions through their shape and color characteristics. Then, the sliding window and window attention mechanisms of the Swin Transformer model are employed to extract Traffic Graph Features (TGFs) from the TGs. MUST leverages a deep fusion of the typical statistical features of the session traffic and the TGFs to detect intranet scanning traffic and accurately identify the scanning tool types. Comparative evaluations show that the multi-feature fusion approach of MUST effectively distinguishes different scanning tool traffic and achieves superior detection accuracy across various scenarios. Moreover, MUST demonstrates robust detection performance for unknown scanning activities, with accuracy and recall rates exceeding 0.97 on the CICIDS2017 and InSDN dataset.