A Baseline Modeling Algorithm for Internet Port Scanning Radiation Flows

Aiming at the port scanning traffic obtained from the background radiation flow on a specific Internet location, this paper proposes a baseline model construction method named Scanning_Baseline. The proposed algorithm maps the scanning numbers of each port to a set of coordinates and tracks the centroid to form the baseline model. With the Scanning_baseline model proposed in this paper, we can compare the morphological differences of scanning background traffic in different time windows or different network locations. The algorithm is applied on 420 groups of measured data obtained from 60 campus network boundaries in seven consecutive days according to two schemes respectively. The results show that Scanning_Baseline algorithm can construct stable baselines for different scenarios and find anomalies by comparing the shape and distance between baselines. This method can also be used to model Internet traffic in other contexts.