Practical automated detection of stealthy portscans

Portscan detectors in network intrusion detection products are easy to evade. They classify a portscan as more than N distinct probes within M seconds from a single source. This paper begins with an analysis of the scan detection problem, and then presents Spice (Stealthy Probing and Intrusion Corr elation Engine), a portscan detector that is effective against stealthy scans yet operationally practical. Our design maintains records of event...