Organizations use Ubuntu Linux servers to host applications, internal services, databases, and network-accessible resources. These servers communicate with other systems through network protocols and service ports.
Port scanning is a reconnaissance technique in which a source system probes multiple ports on a target server to discover accessible services. An attacker may use this information to identify exposed services and determine potential targets for further investigation or attacks.
Traditional network monitoring tools record connection activity and provide visibility into network communications. However, reviewing large volumes of connection records manually can make it difficult to identify unusual connection patterns as they occur.
In this use case, an Ubuntu Linux server is deployed as the target system within an isolated Oracle VirtualBox laboratory. Kali Linux is used to generate controlled port-scanning traffic against the authorized Ubuntu target.
Zeek monitors the laboratory network and records connection information, including source and destination addresses, ports, protocols, connection states, and timestamps. These records provide the network telemetry required for subsequent analysis. Zeek's connection logs support both live traffic monitoring and analysis of stored traffic.
Python processes the Zeek connection logs and extracts relevant network-behavior features. River provides the Half-Space Trees algorithm to analyse incoming feature records and identify observations that differ from the learned baseline.
A publicly available network traffic dataset is used for model development and evaluation. The dataset is preprocessed to ensure that its available features are compatible with the features extracted from Zeek logs.
The model's anomaly scores are then evaluated against controlled port-scanning activity generated in the isolated laboratory. Anomalous events are recorded and displayed for security investigation.
Network access controls and monitoring configurations are reviewed to reduce unnecessary exposure. The assessment is repeated after applying appropriate defensive measures to evaluate changes in detection results.
Application/Service: Ubuntu Linux Server
Ubuntu Linux Server is the target system in this use case. It provides the operating-system environment for running network-accessible services and receiving connections from other systems.
An Ubuntu server may expose multiple network services through listening ports. If an external or internal system repeatedly probes different ports, the activity may indicate reconnaissance intended to identify accessible services.
Although Zeek records network connections, collecting connection logs alone does not automatically determine whether the observed activity represents suspicious port scanning. The connection records must be analysed to identify patterns such as repeated connection attempts, numerous destination ports, and unusual connection frequencies within a defined time window.
The proposed solution introduces Zeek-based network monitoring, network-feature extraction, Half-Space Trees anomaly detection, public-dataset evaluation, controlled port-scanning assessment, alert generation, network access-control review, and post-remediation validation.
Specific Attack: Port-Scanning Attack Against an Ubuntu Linux Server
The controlled attack scenario evaluates whether repeated connections to different destination ports on the Ubuntu Linux server can be identified as unusual network behaviour.
Kali Linux is used to perform authorized port scanning against the designated Ubuntu target within the isolated VirtualBox laboratory.
The assessment focuses on identifying network patterns associated with port scanning, including repeated connection attempts, the number of distinct destination ports contacted by a source, connection frequency, and relevant connection states.
Half-Space Trees analyses the extracted network features to identify anomalous observations. The resulting anomaly scores are compared with the controlled test activity to evaluate whether the scanning behaviour differs from the established baseline.
Continuous Network Anomaly Detection and Security Monitoring
The primary security concept is continuous network monitoring combined with streaming machine-learning-based anomaly detection.
Zeek provides network visibility by recording connection events. Python converts the recorded events into numerical features suitable for analysis, including connection frequency and distinct destination-port counts aggregated over defined time windows.
Half-Space Trees analyses these feature records incrementally and calculates anomaly scores. The scores are evaluated using a threshold established during model development and validation. Observations exceeding the configured threshold are flagged for investigation rather than automatically classified as confirmed attacks.
Publicly available network traffic data supports model development and evaluation, while controlled Kali Linux port-scanning activity provides a separate practical test of the complete monitoring workflow.
The security concept defines the overall security strategy. The following are the specific defensive mechanisms implemented.
Zeek continuously monitors the designated laboratory network and records relevant connection events.
Python extracts connection-related features and aggregates relevant events within defined time windows.
Half-Space Trees analyses incoming feature records and identifies observations that differ from the learned baseline.
The detection threshold is selected using development and validation data rather than assumed in advance.
Publicly available network traffic data is checked for feature compatibility, data quality, and suitability for the detection objective.
Authorized scanning activity is generated from Kali Linux against the isolated Ubuntu target.
Firewall rules and network restrictions are reviewed to limit unnecessary access to the Ubuntu server's services.
Events with qualifying anomaly scores are recorded with timestamps and supporting network details.
Anomaly results are compared against known controlled test activity and the available evaluation labels.
The network monitoring and detection workflow is repeated after applying appropriate access-control changes.
Zeek monitors network traffic and generates structured connection logs. The connection records contain fields such as source and destination addresses, destination ports, protocols, timestamps, and connection states.
River provides the Half-Space Trees algorithm for streaming anomaly detection. The model processes feature records incrementally and produces anomaly scores for analysis.
Python connects Zeek log processing, feature extraction, machine-learning analysis, and alert generation.
pandas is used to organise, clean, transform, and inspect network records before they are supplied to the model.
Nmap is used from Kali Linux to conduct authorized port-scanning tests against the Ubuntu Linux server.
Kali Linux provides the controlled testing environment for generating network-scanning activity.
Ubuntu Linux provides the target server and the environment in which required network services operate.
VirtualBox provides the isolated laboratory infrastructure for Ubuntu and Kali Linux virtual machines.
Streamlit provides a local dashboard for presenting the monitoring results generated by the Python pipeline.
Python and pandas are used to prepare publicly available network traffic data and evaluate the model using suitable reference labels where available.
An isolated Ubuntu Linux server and Kali Linux testing environment are established in VirtualBox for controlled network-security assessment.
Zeek monitors the laboratory network and records connection events that provide visibility into communication involving the Ubuntu target.
Publicly available network traffic data is prepared and evaluated using features compatible with the selected anomaly-detection pipeline.
Python extracts and aggregates network-behaviour features, including connection frequency and distinct destination-port counts within defined time windows.
Half-Space Trees analyses the prepared network features and generates anomaly scores for observations that differ from the learned baseline.
Controlled port-scanning activity generated from Kali Linux provides practical test evidence for evaluating the detection pipeline.
Detected anomalies are compared with the controlled test activity to assess whether the model identifies unusual network patterns associated with port scanning.
The Streamlit dashboard presents anomaly scores, event timestamps, and relevant connection details to support security investigation.
Network-access controls are reviewed and reassessed to evaluate changes in exposed services while preserving required legitimate connectivity.
The complete workflow demonstrates continuous Zeek-based network monitoring, streaming anomaly detection with Half-Space Trees, dataset evaluation, controlled port-scanning assessment, anomaly investigation, and post-remediation validation.
Research Breakthrough Possible @S-Logix