Retracted: A Network Scanning Detection Method Based on TCP Flow State

Network scanning is always the beginning action of network attack and recent detection methods are hard to detect distributed scanning behavior. This paper proposes a Network Scanning Detection algorithm based on Flow State (NSCDFS) to precisely detect both traditional scanning and distributed scanning. The algorithm divides the state of flows into 6 stages and set the state of each flow according to the flag value of its package. And based on the situation of flows' state from the same source IP address, the traditional scanning and the distributed scanning can be detected precisely. And the experimental result shows the algorithm works well in the high speed network.