DynamicWEB: A Method for Reconnaissance Activity Profiling

Abstract

Port scan correlation aims to differentiate between benign and malicious scans. In this paper we will examine a new method of profiling port scan activity in an attempt to lin k d ifferent source IP addresses to being the same end user. A data mining approach DynamicW EB based upon the COBW EB conceptual clustering algorith m is shown along with some preliminary results of it functioning within the context of scan correlation.