Through actively leam the distribution of ports and flags of TCP packets that arrive at the protected network, people can compute the anomaly score of each TCP packet to detect various TCP scans including slow scans and stealthy scans.

• 通过主动学习被保护网络提供的服务端口和TCP标志字段的分布特征,判断出每个到达数据包的异常性,检测各种基于TCP的扫描行为包括慢扫描和隐蔽扫描等多种系统扫描行为。