Traffic analyzer for differentiating BitTorrent handshake failures from port-scans

TL;DR

This paper presents a traffic analysis method that significantly reduces false positives in port-scan detection by differentiating BitTorrent traffic from port-scans, enhancing IDS accuracy.

Contribution

It introduces a novel approach to distinguish BitTorrent handshake attempts from port-scans, reducing false positives by 80% without compromising detection accuracy.

Findings

False positives reduced by 80%

Effective differentiation of BitTorrent and port-scan traffic

Maintains IDS accuracy while reducing false alarms

Abstract

This paper aims to improve the accuracy of port-scan detectors by analyzing traffic of BitTorrent hosts and differentiating their respective BitTorrent connection (attempts) from port-scans. It is shown that by looking at BitTorrent coordination traffic and modelling port-scanning behavior the number of BitTorrent-related false positives can be reduced by 80% without any loss of IDS accuracy.