Scan Detection in High-Speed Networks Based on Optimal Dynamic Bit Sharing
Scan detection is one of the most important functions in intrusion detection systems. In order to keep up with the ever-higher line speed, recent research trend is to implement scan detection in fast but small SRAM. This leads to a difficult technical challenge because the amount of traffic to be monitored is huge but the on-die memory space for performing such a monitoring task is very limited. The authors propose an efficient scan detection scheme based on dynamic bit sharing, which incorporates probabilistic sampling and bit sharing for compact information storage. They design a maximum likelihood estimation method to extract per-source information from the shared bits in order to determine the scanners.