Impact of Packet Sampling on Portscan Detection

Abstract

<para xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> Packet sampling is commonly deployed in high-speed backbone routers to minimize resources used for network monitoring. It is known that packet sampling distorts traffic statistics and its impact has been extensively studied for traffic engineering metrics such as flow size and mean rate. However, it is unclear how packet sampling impacts anomaly detection, which has become increasingly critical to network providers. This paper is the first attempt to address this question by focusing on one common class of nonvolume-based anomalies, &lt;emphasis emphasistype="boldital"&gt;portscans&lt;/emphasis&gt;, which are associated with worm/virus propagation. Existing portscan detection algorithms fall into two general approaches: target-specific and traffic profiling. We evaluated representative algorithms for each class, namely: 1) &lt;emphasis emphasistype="boldital"&gt;TRWSYN&lt;/emphasis&gt; that performs stateful traffic analysis; 2) &lt;emphasis emphasistype="boldital"&gt;TAPS&lt;/emphasis&gt; that tracks connection pattern of scanners; and 3) &lt;emphasis emphasistype="boldital"&gt;entropy-based&lt;/emphasis&gt; traffic profiling. We applied these algorithms to detect portscans in both the original and sampled packet traces from a Tier-1 provider's backbone network. Our results demonstrate that sampling introduces fundamental bias that degrades the effectiveness of these detection algorithms and dramatically increases false positives. Through both experiments and analysis, we identify the traffic features critical for anomaly detection that are affected by sampling. Finally, using insight gained from this study, we show how portscan algorithms can be enhanced to be more robust to sampling. </para>