Data Mining and Machine Learning in Cybersecurity

144  ◾  Data Mining and Machine Learning in Cybersecurity

systems to help readers understand the design and workow of dierent methods.

e benchmark of the applications will also help readers learn how to improve scan

detection systems. Examples for scan detection are listed in Table 1.5.

Application Study 1: SPICE and SPADE Using Cluster and Correlation Methods

in Stealthy Scan Detection (Table 1.5, E.1)

Staniford et al. (2002a,b) presented an SPICE and an SPADE to detect stealthy

portscans. Stealthy portscans refer to the varieties of scan techniques that can

elude traditional IDS systems. Examples of these techniques include random-

izing the scanning order of IP addresses and port sequences, randomizing the

scanning lull, slowing down