⇄term_id => integer 838

$post['veroeffentlichungsart']['term_id']

⇄name => UTF-8 string (22) "Zeitschriftenbeiträge"

$post['veroeffentlichungsart']['name']

⇄slug => string (26) "246_zeitschriftenbeitraege"

$post['veroeffentlichungsart']['slug']

⇄term_group => integer 0

$post['veroeffentlichungsart']['term_group']

⇄term_taxonomy_id => integer 838

$post['veroeffentlichungsart']['term_taxonomy_id']

⇄taxonomy => string (21) "veroeffentlichungsart"

$post['veroeffentlichungsart']['taxonomy']

⇄description => string (0) ""

$post['veroeffentlichungsart']['description']

⇄parent => integer 0

$post['veroeffentlichungsart']['parent']

⇄count => integer 444

$post['veroeffentlichungsart']['count']

⇄filter => string (3) "raw"

$post['veroeffentlichungsart']['filter']

⇄term_id => integer 899

$post['forschungsschwerpunkt']['term_id']

⇄name => string (37) "HRK Schwerpunkt Sensorik und Analytik"

$post['forschungsschwerpunkt']['name']

⇄slug => string (41) "155_hrk-schwerpunkt-sensorik-und-analytik"

$post['forschungsschwerpunkt']['slug']

⇄term_group => integer 0

$post['forschungsschwerpunkt']['term_group']

⇄term_taxonomy_id => integer 899

$post['forschungsschwerpunkt']['term_taxonomy_id']

⇄taxonomy => string (21) "forschungsschwerpunkt"

$post['forschungsschwerpunkt']['taxonomy']

⇄description => string (0) ""

$post['forschungsschwerpunkt']['description']

⇄parent => integer 0

$post['forschungsschwerpunkt']['parent']

⇄count => integer 72

$post['forschungsschwerpunkt']['count']

⇄filter => string (3) "raw"

$post['forschungsschwerpunkt']['filter']

• Table (3)
• Contents (3)

• name
  link
  intern
  personenkennziffer
  0
  M. Ring
  false
  1
  Dieter Landes
  https://www.hs-coburg.de/personen/prof-dr-dieter-landes/
  true
  2
  A. Hotho
  false
  

• ⇄⧉0 => array (4)

  $post['autoren'][0]

  ⇄name => string (7) "M. Ring"

  $post['autoren'][0]['name']

  ⇄link => string (0) ""

  $post['autoren'][0]['link']

  ⇄intern => boolean false

  $post['autoren'][0]['intern']

  ⇄personenkennziffer => string (0) ""

  $post['autoren'][0]['personenkennziffer']

  ⇄⧉1 => array (4)

  $post['autoren'][1]

  ⇄name => string (13) "Dieter Landes"

  $post['autoren'][1]['name']

  ⇄link => string (56) "https://www.hs-coburg.de/personen/prof-dr-dieter-landes/"

  $post['autoren'][1]['link']

  ⇄intern => boolean true

  $post['autoren'][1]['intern']

  ⇄personenkennziffer => string (0) ""

  $post['autoren'][1]['personenkennziffer']

  ⇄⧉2 => array (4)

  $post['autoren'][2]

  ⇄name => string (8) "A. Hotho"

  $post['autoren'][2]['name']

  ⇄link => string (0) ""

  $post['autoren'][2]['link']

  ⇄intern => boolean false

  $post['autoren'][2]['intern']

  ⇄personenkennziffer => string (0) ""

  $post['autoren'][2]['personenkennziffer']

Frequently, port scans are early indicators of more serious attacks. Unfortunately, the detection of slow port scans in company networks is challenging due to the massive amount of network data. This paper proposes an innovative approach for preprocessing flow-based data which is specifically tailored to the detection of slow port scans. The preprocessing chain generates new objects based on flow-based data aggregated over time windows while taking domain knowledge as well as additional knowledge about the network structure into account. The computed objects are used as input for the further analysis. Based on these objects, we propose two different approaches for detection of slow port scans. One approach is unsupervised and uses sequential hypothesis testing whereas the other approach is supervised and uses classification algorithms. We compare both approaches with existing port scan detection algorithms on the flow-based CIDDS-001 data set. Experiments indicate that the proposed approaches achieve better detection rates and exhibit less false alarms than similar algorithms.

Ring, M.; Landes, Dieter; Hotho, A. (2018): Detection of slow port scans in flow-based network traffic. PLOS ONE 2018 13 (9). DOI: 10.1371/journal.pone.0204507

https://www.hs-coburg.de/publikation/2520-detection-of-slow-port-scans-in-flow-based-network-traffic/