Method and device for port scanning detection and computer software product

Abstract

The invention relates to a method and device for port scanning detection and a computer software product. A method includes identifying a set of pairs of source and destination nodes (26) in network data traffic, each pair having a given source node, a given destination node, and one or more ports (40) accessed in traffic between nodes in each pair, and calculating a respective baseline for each pair, the baseline indicates a first number of ports accessed by source nodes other than a given source node in the pair on a given destination node during a first period of time. For each pair, a respective test score is calculated that indicates a difference between a second number of ports accessed by a given source node of the pair on a given destination node during a second period and the baseline, and a preventive action is initiated for a given source node of any of the pairs for which the test score is greater than a threshold.

Description

[0001] This application is a divisional application of the application filed on December 8, 2019, with application number 202310649426.9, entitled "Method, Apparatus and Computer Software Product for Port Scan Detection" (formerly entitled "Port Scan Detection").

[0002] The application filed on December 8, 2019, with application number 202310649426.9 and entitled "Method, Apparatus and Computer Software Product for Port Scanning Detection", is a divisional application of the application filed on December 8, 2019, with application number 201980090243.X and entitled "Port Scanning Detection". Technical Field

[0003] This invention generally relates to computer security, and more particularly to detecting port scanning attacks. Background Technology

[0004] In computer networking, a communication port is a logical communication endpoint on the network. From a software perspective, it is considered equivalent to a specific resource (e.g., a process or service type) executing on a given computer within the network. Communication ports (also referred to herein as ports or port numbers) are typically defined by communication protocols. For example, a port is one of the Layer 4 (Transport Layer) protocols in the Open Systems Interconnection (OSI) model and is used to define network sessions in client-server application architectures.

[0005] A port provides multiplexing services for multiple services or multiple communication sessions at a single network address. In operation, a port is part of the addressing information used to identify the source and destination of messages transmitted over the network. Furthermore, each "open" port is typically associated with a specific service, such as services connected to it, like database services, email services, or communication services.

[0006] Network port scanning is a method used to determine which ports on a network are open. Running a port scan on a network or server reveals which ports are open and configured to receive and / or send information. Network professionals can use port scanning tools to measure their exposure to attackers and monitor devices and services. On the other hand, hackers scan ports to probe for exploitable open ports on a network and determine which services are running on each device. For example, a hacker might send messages to multiple ports and analyze the responses from each given port to determine if that port is being used, and if so, what services are using that port.

[0007] Documents incorporated herein by reference shall be considered part of this application, except where any terminology defined in those incorporated documents in a manner that conflicts with the definitions expressly or implicitly made in this specification shall be taken into account only.

[0008] The above description is presented as a general overview of related technologies in the field and should not be construed as an admission that any information contained herein constitutes prior art to this patent application. Summary of the Invention

[0009] According to an embodiment of the present invention, a method is provided, comprising: identifying a set of source node and destination node pairs in data services transmitted between a plurality of nodes communicating over a network, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in the data services between the source node and the destination node in each pair; for each pair in the set, calculating a corresponding baseline level indicating a first number of communication ports accessed on a given destination node by a source node other than a given source node in the pair during a first time period; for each pair in the set, calculating a corresponding test score indicating the difference between a second number of communication ports accessed on a given destination node by a given source node in the pair during a second time period and the baseline level; and initiating a preventive action for a given source node in any pair whose test score is greater than a specified level.

[0010] In some embodiments, identifying a source node and destination node pair includes collecting data packets transmitted over the network from a probe, aggregating the collected data packets into communication sessions between a given source node and a given destination node, and identifying a given source node that accesses at least one given communication port on a given destination node in each aggregated communication session. In an additional embodiment, the method further includes identifying one or more noisy scanners, each of which includes a given source node that accesses at least a second specified number of destination ports on at least a second specified number of destination nodes. In one embodiment, calculating a baseline level for a given pair includes calculating a first modified number of protocol ports accessed by the source node on the given destination node during a first time period, excluding the given source node in the pair and excluding any of the identified noisy scanners. In a further embodiment, the specified level includes a first specified level, the initiation of preventive action includes initiating a first preventive action, and the method further includes identifying any failed connections during port scanning in a second time period, and for a given source node in any pair that has at least one failed connection among the identified failed connections and whose test score is greater than a second specified level lower than the first specified level, initiating a second preventive action.

[0011] In one embodiment, the second time period follows the first time period. In another embodiment, the first and second time periods have substantially the same duration. In a supplementary embodiment, the first time period comprises multiple sub-time periods, and calculating the test score for a given pair includes calculating an individual baseline level for each sub-time period within the sub-time periods, calculating an average of the individual baseline levels, and subtracting the calculated average from a second number of communication ports. In some embodiments, the second time period and each sub-time period within the sub-time periods have substantially the same duration.

[0012] In an additional embodiment, initiating preventative action includes generating an alert for a given source node. In a further embodiment, initiating preventative action includes restricting the given source node's access to the network.

[0013] According to an embodiment of the present invention, an apparatus is further provided, comprising a network interface device and at least one processor coupled to a data network including a plurality of nodes communicating via the network. The at least one processor is configured to: identify a set of source node and destination node pairs in data traffic transmitted between the plurality of nodes via the network, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in data traffic between the source node and the destination node in each pair; for each pair in the set, calculate a corresponding baseline level indicating a first number of communication ports accessed by a source node other than the given source node in the pair on a given destination node during a first time period; for each pair in the set, calculate a corresponding test score indicating the difference between a second number of communication ports accessed by a given source node in the pair on a given destination node during a second time period and the baseline level; and initiate a preventive action for a given source node in any pair whose test score is greater than a specified level.

[0014] In some embodiments, a given processor is configured to identify the source node and destination node pair by: collecting data packets transmitted through the network from a probe, aggregating the collected data packets into a communication session between a given source node and a given destination node, and identifying a given source node that accesses at least one given communication port on the given destination node in each aggregated communication session.

[0015] In some embodiments, a given processor is further configured to identify one or more noisy scanners, each of which includes a given source node that accesses at least a second specified number of destination ports on at least a second specified number of destination nodes.

[0016] In some embodiments, a given processor is configured to calculate the baseline level of a given pair by calculating a first number of corrections to the communication ports accessed by the source nodes on the given destination node during the first time period, excluding the given source node in the pair and excluding any noisy scanners identified as noisy scanners.

[0017] In some embodiments, the specified level includes a first specified level, wherein a given processor is configured to initiate the prevention action by: initiating a first prevention action and including: identifying any failed connections during port scanning in the second time period, and for a given source node in any pair of the pairs that has at least one failed connection among the identified failed connections and whose test score is greater than a second specified level lower than the first specified level, initiating a second prevention action.

[0018] In some embodiments, the second time period is after the first time period.

[0019] In some embodiments, the first time period and the second time period have substantially the same duration.

[0020] In some embodiments, the first time period includes a plurality of sub-time periods, and wherein a given processor is configured to calculate the test score for a given pair by: calculating an individual baseline level for each sub-time period in the sub-time periods, calculating an average of the individual baseline levels, and subtracting the calculated average from the second number of communication ports.

[0021] In some embodiments, the second time period and each of the sub-time periods have substantially the same duration.

[0022] In some embodiments, a given processor is configured to initiate the preventative action by generating an alert for the given source node.

[0023] In some embodiments, a given processor is configured to initiate the preventative action by restricting the given source node's access to the network.

[0024] According to an embodiment of the present invention, a computer software product is further provided, the product comprising a non-transitory computer-readable medium storing program instructions that, when read by a computer, cause the computer to: identify a set of source node and destination node pairs in a data service transmitted between multiple nodes communicating over a network, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in the data service between the source node and the destination node in each pair; for each pair in the set, calculate a corresponding baseline level indicating a first number of communication ports accessed on a given destination node by a source node other than the given source node in the pair during a first time period; for each pair in the set, calculate a corresponding test score indicating the difference between a second number of communication ports accessed on a given destination node by a given source node in the pair during a second time period and the baseline level; and initiate a preventative action for a given source node in any pair whose test score is greater than a specified level.

[0025] According to embodiments of the present invention, a method is further provided, comprising: identifying a set of port scans in data services transmitted between multiple nodes communicating over a network during a time span comprising multiple predefined time periods, each port scan including accesses by a given source node to multiple communication ports on a given destination node in the data service during a given time period; and for each given source node in the identified port scans, calculating the average number of destination nodes accessed by the given source node to its corresponding communication port during any given port scan of the given source node, and calculating a fraction of the time period during which the given source node accessed at least one destination node in at least one port scan performed by the given source node. The method further comprises aggregating a whitelist of source nodes for which one or more of the following conditions are found to apply: the average number of destination nodes accessed in the identified port scans is greater than a first threshold; and the fraction of the time period is greater than a second threshold during which at least one destination node was accessed in at least one port scan of the port scan. The method further comprises initiating a preventative action when a port scan performed by a node not on the whitelist is detected.

[0026] In one embodiment, identifying a port scan includes: identifying a set of source node and destination node pairs in a data service, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in the data service between the source node and the destination node in each pair; for each pair in the set, calculating a corresponding baseline level indicating a first number of communication ports accessed on a given destination node by a source node other than the given source node in the pair during a first time period; for each pair in the set, calculating a corresponding test score indicating the difference between a second number of communication ports accessed on a given destination node by a given source node in the pair during a second time period and the baseline level; and designating any pair whose test score is greater than a specified level as a port scan.

[0027] In some embodiments, the average number of destination nodes includes the average number of destination nodes accessed by a given source node during each time period in which the given source node accesses at least one of the communication ports. In an additional embodiment, the multiple time periods include a set of first time periods and a second time period following the first time periods. The steps of calculating the average and function and aggregating the whitelist are performed on port scans identified in the first time periods, and the detection of port scans performed by a node not on the whitelist is performed in the second time periods.

[0028] In a further embodiment, each predefined time period has substantially the same duration. In an additional embodiment, initiating preventative action includes generating an alert for a given source node in a detected port scan. In another embodiment, initiating preventative action includes restricting network access for a given source node in a detected port scan.

[0029] According to an embodiment of the present invention, an apparatus is also provided, comprising a network interface device and at least one processor coupled to a data network including a plurality of nodes communicating via the network, the at least one processor being configured to: identify a set of port scans in data traffic transmitted between the plurality of nodes communicating via the network during a time span including a plurality of predefined time periods, each port scan including accesses by a given source node to a plurality of communication ports on a given destination node in the data traffic during a given time period, and for each given source node in the identified port scans, calculate an average number of destination nodes accessed by the given source node to its respective communication ports during any given port scan of the given source node, and calculate a ratio of the time period during which the given source node accesses at least one destination node in at least one port scan performed by the given source node. The processor is also configured to aggregate a whitelist of source nodes for which one or more of the following conditions are found to apply: the average number of destination nodes accessed in identified port scans is greater than a first threshold; and the ratio of this ratio to a time period is greater than a second threshold, during which at least one destination node was accessed in at least one port scan. The processor is further configured to initiate preventative action when a port scan is detected by a node not on the whitelist.

[0030] In some embodiments, a given processor is configured to identify the port scan in the following manner: In the data service, a set of source node and destination node pairs are identified, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in the data service between the source node and the destination node in each pair. For each pair in the group, a corresponding baseline level is calculated, the baseline level indicating a first number of communication ports accessed by a source node other than the given source node in that pair on the given destination node during a first time period. For each pair in the group, a corresponding test score is calculated, the test score indicating the difference between the second number of communication ports accessed by the given source node on the given destination node during the second time period and the baseline level. Any pair in the pair whose test score is greater than a specified level is designated as the port scan.

[0031] In some embodiments, the average number of destination nodes includes the average number of destination nodes accessed by the given source node during each time period in which the given source node accesses at least one of the communication ports.

[0032] In some embodiments, the plurality of time periods include a set of first time periods and a second time period following the first time periods, wherein the steps of calculating the average value and function and aggregating the whitelist are performed on the port scans identified in the first time periods, and wherein a given processor is configured to detect that the port scan performed by a node not on the whitelist is performed in the second time period.

[0033] In some embodiments, each of the predefined time periods has substantially the same duration.

[0034] In some embodiments, a given processor is configured to initiate the preventative action by generating an alert for the given source node in a detected port scan.

[0035] In some embodiments, a given processor is configured to initiate the preventative action by restricting access to the network by the given source node in a detected port scan.

[0036] According to embodiments of the present invention, a computer software product is further provided, comprising a non-transitory computer-readable medium storing program instructions that, when read by a computer, cause the computer to: identify a set of port scans in data services transmitted between multiple nodes communicating over a network during a time span comprising multiple predefined time periods, each port scan including accesses by a given source node to multiple communication ports on a given destination node in the data service during a given time period; and for each given source node in the identified port scans, calculate, for each given source node, the average number of destination nodes accessed by the given source node to its corresponding communication port during any given port scan of the given source node, and calculate a ratio for the time period during which the given source node accessed at least one destination node in at least one port scan performed by the given source node. The computer software product is also configured to aggregate a whitelist of source nodes for which one or more of the following conditions are found to apply: the average number of destination nodes accessed in the identified port scans is greater than a first threshold; and the ratio for the time period is greater than a second threshold, during which at least one destination node was accessed in at least one port scan of the port scans performed by the given source node. The computer software product is further configured to initiate preventative actions when a port scan is detected by a node that is not on the whitelist.

[0037] According to an embodiment of the present invention, a method is further provided, comprising: defining, for a given software category, a corresponding disjoint set of communication ports used by each of a plurality of software systems in the given software category, the disjoint set including at least a first disjoint set and a second disjoint set; identifying a set of port scans in data services transmitted between a plurality of nodes communicating over a network, each port scan including access by a given source node to a plurality of communication ports on a given destination node in the data service during a predefined time period; and initiating a preventive action when a port scan performed by one of the nodes, including access to at least one communication port in the first set and at least one communication port in the second set, is detected.

[0038] In one embodiment, identifying a port scan includes: identifying a set of source node and destination node pairs in a data service, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in the data service between the source node and the destination node in each pair; for each pair in the set, calculating a corresponding baseline level indicating a first number of communication ports accessed on a given destination node by a source node other than the given source node in the pair during a first time period; for each pair in the set, calculating a corresponding test score indicating the difference between a second number of communication ports accessed on a given destination node by a given source node in the pair during a second time period and the baseline level; and designating any pair whose test score is greater than a specified level as a port scan.

[0039] In some embodiments, detecting access to at least one communication port in a first set includes detecting access to at least a specified number of communication ports in the first set, wherein the specified number is greater than one. In an additional embodiment, at least one communication port in the first set and at least one communication port in the second set includes at least a specified number of communication ports in each of the first and second sets, wherein the specified number is greater than one.

[0040] In a first embodiment, the given software category includes an operating system. In a second embodiment, the given software category includes a database server. In a third embodiment, the given software category includes an email server. In a fourth embodiment, the given software category includes a remote session application.

[0041] In a further embodiment, initiating preventative action includes generating an alert for a given source node in the detected port scan. In an additional embodiment, initiating preventative action includes restricting the network access of a given source node in the detected port scan.

[0042] According to an embodiment of the present invention, an apparatus is also provided, comprising a network interface device and at least one processor coupled to a data network including a plurality of nodes communicating via the network, the at least one processor being configured to: for a given software category, define a corresponding disjoint set of communication ports used by each software system in a plurality of software systems within the given software category, the disjoint set including at least a first disjoint set and a second disjoint set; identify a set of port scans in data services transmitted between the plurality of nodes communicating via the network, each port scan including access by a given source node to a plurality of communication ports on a given destination node in the data service during a predefined time period; and initiate a preventative action when a port scan performed by one of the nodes, including access to at least one communication port in the first set and at least one communication port in the second set, is detected.

[0043] In some embodiments, a given processor is configured to identify the port scan in the following manner: In the data service, a set of source node and destination node pairs are identified, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in the data service between the source node and the destination node in each pair. For each pair in the group, a corresponding baseline level is calculated, the baseline level indicating a first number of communication ports accessed by a source node other than the given source node in that pair on the given destination node during a first time period. For each pair in the group, a corresponding test score is calculated, the test score indicating the difference between the second number of communication ports accessed by the given source node on the given destination node during the second time period and the baseline level. Any pair in the pair whose test score is greater than a specified level is designated as the port scan.

[0044] In some embodiments, a given processor is configured to detect access to at least one communication port in the first set of communication ports by detecting access to at least a specified number of communication ports in the first set, wherein the specified number is greater than one.

[0045] In some embodiments, at least one communication port in the first set and at least one communication port in the second set include at least a specified number of communication ports in each of the first set and the second set, wherein the specified number is greater than one.

[0046] In some embodiments, the given software category includes operating systems.

[0047] In some embodiments, the given software category includes database servers.

[0048] In some embodiments, the given software category includes email servers.

[0049] In some embodiments, the given software category includes remote session applications.

[0050] In some embodiments, a given processor is configured to initiate the preventative action by generating an alert for the given source node in a detected port scan.

[0051] In some embodiments, a given processor is configured to initiate the preventative action by restricting access to the network by the given source node in a detected port scan.

[0052] According to an embodiment of the present invention, a computer software product is further provided, the product comprising a non-transitory computer-readable medium storing program instructions that, when read by a computer, cause the computer to: define, for a given software category, a corresponding disjoint set of communication ports used by each of a plurality of software systems in the given software category, the disjoint set including at least a first disjoint set and a second disjoint set; identify a set of port scans in data services transmitted between a plurality of nodes communicating over a network, each of the port scans including access by a given source node to a plurality of communication ports on a given destination node in the data service during a predefined time period; and initiate a preventative action when a port scan performed by one of the nodes, including access to at least one communication port in the first set and at least one communication port in the second set, is detected.

[0053] According to an embodiment of the present invention, a method is further provided, comprising identifying a set of port scans in a data service transmitted between multiple nodes communicating over a network, each port scan comprising access by a given source node to multiple communication ports on a given destination node in the data service during a predefined time period; calculating a corresponding first probability for a communication port accessed in an identified port scan, wherein the corresponding second probability for each pair of communication ports in an identified port scan is accessed during any given port scan; and initiating a preventative action when a port scan involving access to a first and a second communication port on a given destination node by one of the nodes is detected, wherein the corresponding second probability for the first and second communication ports in the pair is lower than a threshold depending on the corresponding first probability for the first and second communication ports.

[0054] In one embodiment, identifying a port scan includes identifying a set of source node and destination node pairs in a data service, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in the data service between the source node and the destination node in each pair; for each pair in the set, calculating a corresponding communication level indicating a first number of communication ports accessed on a given destination node by a source node other than the given source node in the pair during a first time period; for each pair in the set, calculating a corresponding test score indicating the difference between a second number of communication ports accessed on a given destination node by a given source node in the pair during a second time period and a baseline level; and designating any pair whose test score is greater than a specified level as a port scan.

[0055] In some embodiments, the specified time period includes multiple sub-time periods, which include a set of first sub-time periods and a second sub-time period following the first sub-time periods. The steps of identifying groups of high-traffic ports and generating a whitelist are performed on port scans in the first sub-time periods, and port scans on one of the detected nodes are performed on the second sub-time periods. In an additional embodiment, each sub-time period has substantially the same duration.

[0056] In a further embodiment, initiating preventative action includes generating an alert for a given source node in the detected port scan. In an additional embodiment, initiating preventative action includes restricting the network access of a given source node in the detected port scan.

[0057] According to an embodiment of the present invention, an apparatus is also provided, comprising a network interface device and at least one processor coupled to a data network including a plurality of nodes communicating via the network, the at least one processor being configured to: identify a set of port scans in data traffic transmitted between the plurality of nodes communicating via the network, each port scan including access by a given source node to a plurality of communication ports on a given destination node in the data traffic during a predefined time period; for a communication port accessed in an identified port scan, calculate a corresponding first probability of access during any given port scan; for each pair of communication ports in an identified port scan, calculate a corresponding second probability of access to both communication ports in the pair during any given port scan; and initiate a preventative action when a port scan involving access to a first and a second communication port on a given destination node by one of the nodes is detected, such that the corresponding second probability for the first and second communication ports in the pair is lower than a threshold depending on the corresponding first probability for the first and second communication ports.

[0058] In some embodiments, a given processor is configured to identify the port scan in the following manner: In the data service, a set of source node and destination node pairs are identified, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in the data service between the source node and the destination node in each pair. For each pair in the group, a corresponding communication level is calculated, the communication level indicating a first number of communication ports accessed by a source node other than the given source node in that pair on the given destination node during a first time period. For each pair in the group, a corresponding test score is calculated, the test score indicating the difference between the second number of communication ports accessed by the given source node on the given destination node during the second time period and the baseline level. Any pair in the pair whose test score is greater than a specified level is designated as the port scan.

[0059] In some embodiments, the specified time period includes multiple sub-time periods, the multiple sub-time periods including a set of first sub-time periods and a second sub-time period following the first sub-time period, wherein the step of identifying a group of high-traffic ports and generating a whitelist is performed on port scans in the first sub-time period, and wherein a given processor is configured to detect port scans on one of the nodes performed in the second sub-time period.

[0060] In some embodiments, each of the sub-time periods has substantially the same duration.

[0061] In some embodiments, a given processor is configured to initiate the preventative action by generating an alert for the given source node in a detected port scan.

[0062] In some embodiments, a given processor is configured to initiate the preventative action by restricting access to the network by the given source node in a detected port scan.

[0063] According to an embodiment of the present invention, a computer software product is further provided, the product comprising a non-transitory computer-readable medium storing program instructions that, when read by a computer, cause the computer to: identify a set of port scans in a data service transmitted between multiple nodes communicating over a network, each port scan comprising access by a given source node to multiple communication ports on a given destination node in the data service during a predefined time period; calculate, for each communication port accessed in an identified port scan, a corresponding first probability of access during any given port scan; calculate, for each pair of communication ports in an identified port scan, a corresponding second probability of access to both communication ports in that pair during any given port scan; and initiate a preventative action when a port scan by one of the nodes, comprising access to a first communication port and a second communication port on a given destination node, is detected, such that the corresponding second probability for the first and second communication ports in that pair is lower than a threshold depending on the corresponding first probability for the first and second communication ports.

[0064] According to an embodiment of the present invention, a method is further provided, comprising: identifying a set of port scans in a data service transmitted between multiple nodes communicating over a network, each port scan including access to multiple communication ports on a given destination node by a given source node in the data service during a predefined time period; identifying a group of high-volume ports in the data service, high-volume ports including one or more communication ports receiving a corresponding volume of data service exceeding a predefined threshold; for the identified port scans, generating corresponding signatures indicating communication ports other than high-volume ports accessed in each port scan; calculating the corresponding occurrence frequency of each signature in the set of port scans; aggregating a whitelist of signatures with a corresponding occurrence frequency greater than a predefined threshold; and initiating a preventive action when a port scan with a corresponding signature not on the whitelist is detected.

[0065] In one embodiment, identifying a port scan includes identifying a set of source node and destination node pairs in a data service, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in the data service between the source node and the destination node in each pair; for each pair in the set, calculating a corresponding baseline level indicating a first number of communication ports accessed on a given destination node by a source node other than the given source node in the pair during a first time period; for each pair in the set, calculating a corresponding test score indicating the difference between a second number of communication ports accessed on a given destination node by a given source node in the pair during a second time period and the baseline level; and designating any pair whose test score is greater than a specified level as a port scan.

[0066] In some embodiments, the specified time period includes multiple sub-time periods, which include a set of first sub-time periods and a second sub-time period following the first sub-time periods. The steps of calculating the first probability and the second probability are performed on the port scans in the first sub-time periods, and the port scans on one of the detected nodes are performed in the second sub-time periods. In an additional embodiment, each sub-time period has substantially the same duration.

[0067] In an additional embodiment, calculating the corresponding frequency of occurrence of each signature in the signatures on the group of port scans includes, for each given unique signature, determining the scan count that matches that given unique signature, and the whitelist includes unique signatures whose corresponding counts of matching scans are greater than a specified number.

[0068] In a further embodiment, calculating the corresponding frequency of occurrence of each signature in the signature on the set of port scans includes, for each given unique signature, determining the count of unique source nodes in the scan that match the given unique signature, and the whitelist includes unique signatures for which one or more of the following conditions are found to apply: the count of unique source nodes is greater than a first value, and the count of unique source nodes is less than a second value.

[0069] In a supplementary embodiment, calculating the corresponding frequency of occurrence of each signature in the signature on the set of port scans includes, for each given unique signature, determining the count of unique destination nodes in the scan that match the given unique signature, and the whitelist includes unique signatures for which one or more of the following conditions are found to apply: the count of unique destination nodes is greater than a first value, and the count of unique destination nodes is less than a second value.

[0070] In some embodiments, high-traffic ports are associated with a given destination node. In another embodiment, initiating preventative action includes generating an alert for a given source node in a detected port scan. In an additional embodiment, initiating preventative action includes restricting network access for a given source node in a detected port scan.

[0071] According to an embodiment of the present invention, an apparatus is also provided, comprising a network interface device and at least one processor coupled to a data network including a plurality of nodes communicating via the network, the at least one processor being configured to: identify a set of port scans in data traffic transmitted between the plurality of nodes communicating via the network, each port scan comprising access by a given source node to a plurality of communication ports on a given destination node in the data traffic during a predefined time period; identify a group of high-volume ports in the data traffic, high-volume ports comprising one or more communication ports receiving data traffic of a corresponding capacity exceeding a predefined threshold; for the identified port scans, generate corresponding signatures indicating communication ports other than high-volume ports accessed in each port scan; calculate the corresponding occurrence frequency of each signature in the signatures on the set of port scans; aggregate a whitelist of signatures with a corresponding occurrence frequency greater than a predefined threshold; and initiate a preventive action when a port scan with a corresponding signature not on the whitelist is detected.

[0072] In some embodiments, a given processor is configured to identify the port scan in the following manner: In the data service, a set of source node and destination node pairs are identified, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in the data service between the source node and the destination node in each pair. For each pair in the group, a corresponding baseline level is calculated, the baseline level indicating a first number of communication ports accessed by a source node other than the given source node in that pair on the given destination node during a first time period. For each pair in the group, a corresponding test score is calculated, the test score indicating the difference between the second number of communication ports accessed by the given source node on the given destination node during the second time period and the baseline level. Any pair in the pair whose test score is greater than a specified level is designated as the port scan.

[0073] In some embodiments, the specified time period includes a plurality of sub-time periods, the plurality of sub-time periods including a set of first sub-time periods and a second sub-time period following the first sub-time periods, wherein the step of calculating the first probability and the second probability is performed on port scans in the first sub-time period, and wherein a given processor is configured to detect port scans on one of the nodes in the second sub-time period.

[0074] In some embodiments, each of the sub-time periods has substantially the same duration.

[0075] In some embodiments, a given processor is configured to: calculate the corresponding frequency of occurrence of each signature in the signature on a set of port scans by determining the scan count that matches the given unique signature for each given unique signature, and wherein the whitelist includes unique signatures whose corresponding counts of matching scans are greater than a specified number.

[0076] In some embodiments, a given processor is configured to: calculate the frequency of occurrence of each signature in the set of port scans by determining, for each given unique signature, the count of unique source nodes in a scan that matches the given unique signature, and wherein the whitelist includes unique signatures for which one or more of the following conditions are found to apply: The count of the unique source node is greater than the first value, and The count of the unique source node is less than the second value.

[0077] In some embodiments, a given processor is configured to: calculate the frequency of occurrence of each signature in the signatures on the set of port scans by determining, for each given unique signature, the count of unique destination nodes in a scan that match the given unique signature, and wherein the whitelist includes unique signatures for which one or more of the following conditions are found to apply: The count of the unique destination node is greater than the first value; and The count of the unique destination node is less than the second value.

[0078] In some embodiments, the high-volume port is associated with a given destination node.

[0079] In some embodiments, a given processor is configured to initiate the preventative action by generating an alert for the given source node in a detected port scan.

[0080] In some embodiments, a given processor is configured to initiate the preventative action by restricting access to the network by the given source node in a detected port scan.

[0081] According to embodiments of the present invention, a computer software product is further provided, comprising a non-transitory computer-readable medium storing program instructions that, when read by a computer, cause the computer to: identify a set of port scans in a data service transmitted between multiple nodes communicating over a network, each port scan comprising access to multiple communication ports on a given destination node by a given source node in the data service during a predefined time period; identify a group of high-volume ports in the data service, high-volume ports comprising one or more communication ports receiving data services of a corresponding capacity exceeding a predefined threshold; for the identified port scans, generate corresponding signatures indicating communication ports other than high-volume ports accessed in each port scan; calculate the corresponding occurrence frequency of each signature in the set of port scans; aggregate a whitelist of signatures with a corresponding occurrence frequency greater than a predefined threshold; and initiate preventative action when a port scan with a corresponding signature not on the whitelist is detected. Attached Figure Description

[0082] This disclosure is described herein by way of example only with reference to the accompanying drawings, in which: Figure 1 This is a block diagram schematically illustrating a computing facility including a system configured to detect suspected malicious port scans according to an embodiment of the present invention; Figure 2 This is a flowchart schematically illustrating a method for identifying suspicious port scans in data packets transmitted over a network from a source node to a destination node according to an embodiment of the present invention; Figure 3 This is a flowchart schematically illustrating a method for generating a profile score for a destination that can be used to detect port scans, according to an embodiment of the present invention. Figure 4 This is a flowchart schematically illustrating a method for generating source configuration files that can be used to detect and whitelist aggressive and periodic scanners according to an embodiment of the present invention; Figure 5 This is a flowchart schematically illustrating a method for identifying malicious port scans according to an embodiment of the present invention, the malicious port scans including port scans of different software systems in a single category; Figure 6 This is a flowchart schematically illustrating a method for identifying malicious port scans, including anomalous pairs of scanning ports, according to an embodiment of the present invention; and Figure 7This is a flowchart schematically illustrating a method for identifying and whitelisting scanner probes according to an embodiment of the present invention. Detailed Implementation

[0083] Overview Embodiments of the present invention provide a method and system for identifying port scans on a data network. As described below, when monitoring data traffic transmitted between multiple nodes communicating over a network, a set of source and destination node pairs is identified, each pair consisting of a given source node, a given destination node, and one or more communication ports accessed during data traffic between the source and destination nodes in each pair. For each pair in the set, a corresponding baseline level and a corresponding test score are calculated. For each pair in the set, the corresponding baseline level indicates a first number of communication ports accessed by a source node other than the given source node in the pair on a given destination node during a first time period, and the corresponding test score indicates the difference between a second number of communication ports accessed by the given source node in the pair on the given destination node during a second time period and the baseline level. Preventive action can be initiated for a given source node in any pair whose test score is greater than a specified level.

[0084] Embodiments of the present invention also provide methods and systems for detecting whether any port scan in an identified port scan includes anomalous port combinations that may indicate a malicious port scan. Examples of anomalous port combinations include, but are not limited to, port pairs and port groups. As described below, the analysis for detecting suspicious port scans may be based on source profiles, port profiles, port pair profiles, and scanner probe profiles.

[0085] System Description Figure 1 This is a schematic block diagram illustrating a computing facility 20 according to an embodiment of the present invention, which includes a malicious port scan detection system 22 that collects and monitors data packets 24 transmitted between a plurality of nodes 26 coupled to a data network 28 in order to identify malicious port scans. In the embodiments described herein, each node 26 includes any type of device (i.e., physical or virtual) configured to communicate over the network and has an IP address assigned for this purpose. Figure 1 In the example shown, the nodes include workstation 26 and a public network 30, such as the Internet. As described below, embodiments of the invention aggregate data packets into communication sessions, identify any communication session that includes port scan 32, and generate alerts for any port scans suspected of being malicious.

[0086] Although Figure 1The example shown illustrates a node including workstation 26, but nodes 26 including other types of devices communicating via network 28 and the Internet 30 are considered to be within the spirit and scope of the invention. For example, a node may include devices such as servers, wireless devices such as smartphones, routers, and network switches.

[0087] Each workstation 26 may include, for example, a workstation identifier (ID) 34, a workstation processor 36, and a workstation memory 38 storing multiple communication ports 40 (also referred to herein as ports). Unlike physical ports, ports 40 are logical entities defined by communication protocols such as TCP / IP.

[0088] Examples of workstation ID 34 include, but are not limited to, a Media Access Control (MAC) address and an Internet Protocol (IP) address that can be used to uniquely identify each workstation in the workstation group. While each given workstation 26 is assigned a unique IP address at any given time, a given workstation may be associated with multiple IP addresses over an extended period of time. For example, the IP address of a given workstation 26 may change after the given workstation is rebooted. Typically, in operation, processor 36 executes an operating system 42 (e.g., Linux) and one or more software applications 44 (e.g., a database server) from memory 38.

[0089] exist Figure 1 In the configuration shown, memory 38 also stores a whitelist 80, which stores identifiers for one or more workstations 26. See below for reference. Figure 4 and Figure 7 As described in the description, embodiments of the present invention can ignore any suspicious port scans 32 initiated by any workstation 26 in the whitelist.

[0090] Workstation 26 communicates via a data network 28 (e.g., a local area network) that is also coupled to Internet gateway 46. Gateway 46 couples computing facility 20 to a public network 30 such as the Internet and includes a communication circuitry (not shown) that enables communication between workstation 26 and sites / computers (not shown) on the Internet.

[0091] In some embodiments, the malicious port scanning detection system 22 includes a system processor 48 and a system memory 50, which are coupled via a system bus (not shown) to a network interface controller (NIC) 52 that couples the computer system to a network 28. In some embodiments, the malicious port scanning detection system 22 may include a user interface (UI) device 54 (e.g., an LED display) or another type of output interface.

[0092] exist Figure 1In the configuration shown, the malicious port scanning detection system 22 includes probe 56, which collects information about data packets 24 transmitted over network 28. Although Figure 1 The example in the document shows probe 56 as a module of malicious port scanning detection system 22; however, the probe may be implemented as a standalone device coupled to network 28 or as a module in another device coupled to the network. Probe 56 may optionally collect data packets 24 from network 28 and process the collected data packets to extract information using any of the methods described in U.S. Patent Application 2014 / 0165207 to Engel et al. and U.S. Patent Application 2015 / 035834 to Mumcuoglu et al., the disclosures of which are incorporated herein by reference.

[0093] Memory 50 stores the corresponding plurality of communication sessions 68, aggregated communication sessions 58, and port list 60. In the embodiments described herein, processor 48 is configured to collect data packets from probe 56, group the data packets into communication sessions 68, aggregate the communication sessions into aggregated communication sessions 58, and identify any aggregated communication sessions within the aggregated communication sessions that indicate a given port scan 32. The use of port list 60 (which stores the corresponding plurality of ports 40 (i.e., port numbers)) is referred to below. Figure 5 It is described in the description.

[0094] exist Figure 1 In the configuration shown, memory 50 also stores a whitelist 80, which stores identifiers for one or more workstations 26. See below for reference. Figure 4 and Figure 7 As described in the description, embodiments of the present invention can ignore any suspicious port scans 32 initiated by any workstation 26 in the whitelist.

[0095] Each communication session 68 optionally includes a source node identifier 64, a destination port identifier 66, a time 84, a source port identifier 70, a destination port identifier 72, a protocol 74, a state 76, a capacity 88 (source to destination), a reverse-volume 78 (also known as reverse-volume, destination to source), and a time 84. Each aggregated communication session 58 optionally includes a port scan time period 62, a subset 86 of the communication session, and a signature 82.

[0096] In each given communication session 68, the source node 64 stores the identifier of the first given workstation 26, the destination node 66 stores the identifier of the second given workstation 26, the source port 70 refers to the given port 40 on the first given workstation used to communicate with the second given workstation during the given communication session, the destination port 72 refers to the given port 40 on the second given workstation that is being accessed during the given communication session, the protocol 74 refers to the given communication protocol (e.g., NFS, SSH, KERBEROS, LDAP) used by the given communication session, the status 76 indicates whether the given communication session was successfully completed, the capacity 88 indicates the amount of data transferred from the first given workstation to the second given workstation during the given communication session, and the reverse capacity 78 indicates the amount of data transferred from the second given workstation to the first given workstation during the given communication session.

[0097] In the embodiments described herein, source node 64 may be used to refer to a first given workstation, and destination node 66 may be used to refer to a second given workstation. In embodiments where workstations communicate using TCP / IP, the processor may identify the source port and destination port for a given communication session 68 based on information stored in a given data packet 24 storing a TCP header.

[0098] For each aggregated communication session 58, the port scan time period 62 includes a specified time period (e.g., a specific number of hours or days), and the subset 86 refers to multiple communication sessions 68. See below for reference. Figure 7 The description includes signature 82.

[0099] In some embodiments, the tasks of collecting data packets, grouping data packets into communication sessions, aggregating communication sessions, and identifying aggregated communication sessions, including port scan 32, can be split among multiple devices within computing facility 20 (e.g., workstation 26) or outside computing facility (e.g., data cloud-based applications). In some embodiments, some or all of the functionality of workstation 26 and / or malicious port scan detection system 22 can be deployed as virtual machines within computing facility 20.

[0100] Examples of memories 38 and 50 include dynamic random access memory and non-volatile random access memory. In some embodiments, the memory may include non-volatile storage devices such as hard disk drives and solid-state drives.

[0101] Processors 36 and 48 include general-purpose central processing units (CPUs) or dedicated embedded processors, which are programmed in software or firmware to perform the functions described herein. For example, the software can be downloaded electronically to computers 22 and 26 via a network. Alternatively or additionally, the software can be stored on a tangible, non-transitory computer-readable medium, such as optical, magnetic, or electronic storage media. Further, additionally or additionally, at least some of the functions of processors 36 and 48 can be executed by hardwired or programmable digital logic circuitry.

[0102] Port scan collection Figure 2 This is a flowchart schematically illustrating a method for identifying suspicious port scans 32 on network 28 according to an embodiment of the present invention. In the embodiments described herein, a suspicious port scan includes an unusual combination of a source workstation 26 accessing a communication port 40 on a destination workstation 26 within a predefined time period.

[0103] In step 90, processor 48 uses probe 56 to collect data packets 24 transmitted between nodes 26 on network 28 during a time period that includes multiple sub-time periods. For example, the time period may include seven consecutive days (i.e., a week), and each sub-time period may include any 24-hour period within a week (e.g., a day).

[0104] In step 92, the processor 48 groups the collected data packets and stores them as separate communication sessions 68 between each pair of source and destination nodes 26. A communication session typically includes a sequence of data packets 24 transmitted from a first given workstation 26 to a given port 40 on a second given workstation 26. Upon detection of a given data packet sequence, the processor 48 defines a new communication session 68 and stores it in the new communication session 68 by: storing an identifier for the first given workstation in the source node 64; storing an identifier for the second given workstation in the destination node 66; storing the date and time of the collection of the given data packet sequence in the time 84; storing the port number for the first given workstation in the TCP header in the source port 70; storing the port number for the second given workstation in the TCP header in the destination port 72; storing the communication protocol used by the data packet sequence in the protocol 74; storing the state of the communication session (e.g., success / failure) in the state 76; and storing the first amount of data (e.g., 600 bytes) transmitted from the first given workstation to the second given workstation in the data packet sequence in the capacity 88.

[0105] In some cases, the data packet sequence may also include a second data volume (e.g., 200 bytes) transferred from the second given workstation to the first given workstation. Process 48 may store the second data volume in the reverse capacity 78.

[0106] In some embodiments, processor 48 may group packets based on IP addresses (not shown) in the packets, such that the system processor may group packets 24 that have the same source address and destination address or the same source address, source port, destination address, destination port, and protocol together. In alternative embodiments, processor 48 may manage, for example, a table (not shown) that associates addresses in packets with corresponding IDs 34 of nodes 26, as described in U.S. Patent Application 2016 / 0234167, which is incorporated herein by reference, and group packets together based on IDs corresponding to addresses in the packets. An example for grouping collected data packets 68 is described in U.S. Patent Application 15 / 950,234, filed April 11, 2018, which is incorporated herein by reference.

[0107] In step 94, the processor 48 aggregates the communication sessions into multiple aggregated communication sessions 58, such that each aggregated communication session includes data from the communication sessions of each unique source node and destination node pair that communicates with each other during a given sub-period. In embodiments of the invention, each sub-period typically includes a predefined time period (e.g., one hour, two hours, or 24 hours).

[0108] When aggregating communication session 68, processor 48 can identify and mark any communication session in the failed communication sessions to a given port 40. In embodiments herein, these marked communication sessions may be referred to as failed connections. A communication session to a given port 40 can be marked as a failed connection if no response is received from the given port, or if a response indicating that the given port is closed is received. Failed connections are often the result of misconfiguration of a given node 26, and a given port 40 can be identified as a failed port by detecting that a given port on a given node has not been successfully connected. For example, if given node 26 includes an email server configured with an incorrect IP address, other nodes 26 on the network will generate failed connections when they attempt to access the incorrect destination port on the email server.

[0109] In the TCP / IP communication model, a successful communication session includes (a) a given source node 64 transmitting a "SYN" command to a given destination node 66, (b) a given destination node transmitting a "SYN-ACK" command to a given source node in response to receiving a "SYN" command, and (c) a given source node transmitting an "ACK" command to a given destination node in response to receiving a "SYN-ACK" command. In embodiments of the present invention, the processor 48 can identify a failed connection by detecting a given communication session 68 in which a "SYN-ACK" command transmitted from a given destination node 66 to a given source node 64 is lost and / or an "ACK" command transmitted from a given source node to a given destination node is lost.

[0110] In embodiments of the invention, processor 48 can use failed connection information to determine whether any aggregated communication session in the aggregated communication session includes any port scan. For example, if all communication sessions in a given aggregated communication session 58 are successful (i.e., the “SYN,” “SYN-ACK,” and “ACK” commands are successfully transmitted), there is a low probability that the given aggregated communication session includes a port scan. However, if all connections in a given aggregated communication session include failed connections on different ports 40 (as detected using the embodiments described above), there is a high probability that the given aggregated communication session includes a port scan.

[0111] In step 96, processor 48 "cleans" the data in the port scan log to preserve data relevant to the analysis. In one embodiment, processor 48 can clean the data by filtering out any communication sessions that include a port scan with a source port 70 and a protocol 74, which is known to have activity in multiple destination ports 72. For example, based on parameters provided by the system manager, processor 48 can filter out any port scan whose protocol is NFS and whose source port number is "829", "2049", or "20048". In another embodiment, a given port list 60 may include a set of ports 40 used by services available on network 28, and processor 48 can filter out any scans of ports 40 in the given port list.

[0112] In step 98, the processor 48 identifies one or more aggregated port communication sessions 58 including the corresponding port scan 32. In some embodiments, as referenced below... Figure 3 As described in the description, processor 48 can use a destination profile to identify a given port scan.

[0113] In step 100, in response to identifying port scans in step 88, processor 48 may initiate a first preventative action for each source node in the identified port scan 32. In one embodiment, processor 48 may initiate the first preventative action by presenting an alert message on user interface device 54 indicating that the identified source node is performing a suspicious port scan. In another embodiment, processor 48 may initiate the first preventative action by restricting the identified source node's access to network 28 (e.g., by sending instructions to a network switch or firewall that couples the identified source node to network 28).

[0114] In an additional embodiment, processor 48 may initiate a first preventative action by transmitting the identifier of a given source node to an alarm management system (not shown), such as a Security Information and Event Management (SIEM) system. In a further embodiment, processor 8 may generate an alarm by storing the identifier of the given source node in a data structure (not shown) that can be retrieved by the alarm management system (e.g., a SIEM system) via an API (not shown).

[0115] In one variation of the embodiments described above, processor 48 may identify the user of the source node in the identified port scan (e.g., via login credentials) and initiate preventative actions for a given user. In another variation of the embodiments described above, processor 48 may identify software processes accessing ports in the identified port scan on the source node in the identified port scan and initiate preventative actions for the software processes.

[0116] In step 102, processor 48 identifies a given identified port scan including a given source node 64 that scans an anomalous combination of destination ports 72 on a given destination node 66 during a time period (i.e., the test period). Different embodiments for detecting anomalous combinations are referenced below. Figure 4-7 The corresponding description is provided. The port scans identified in step 90 may also be referred to herein as suspicious port scans.

[0117] Finally, in step 104, in response to the identification of an abnormal port scan in step 102, the processor 48 may initiate a second preventative action against the source node in the abnormal port scan, and the method ends. An example of the preventative action has been described above.

[0118] Destination configuration file In embodiments of the invention, processor 48 may use a destination profile to detect port scan 32. As described below, processor 48 may generate a destination profile for each given destination node 66 based on data packets 24 collected during a specified time period, indicating a typical number of ports 40 (i.e., destination ports 72) scanned on the given destination node, and processor 48 may use the destination profile to detect any subsequently collected anomalous port scans.

[0119] Figure 3 This is a flowchart schematically illustrating a method for calculating a destination profile score and using the calculated score to identify port scan 32 according to an embodiment of the present invention. In step 110, the method described in the above reference... Figure 2 In the embodiment described herein, processor 48 identifies a set of port scans. To identify this set of port scans, processor 48 collects communication sessions 68 and aggregates them into aggregated communication sessions 58. Each aggregated communication session 58 includes a given port scan 32 that enables a first given workstation 26 to access at least one given communication port 40 on a second given destination 26.

[0120] Processor 48 collects communication sessions during multiple time periods, including a training period (also referred to herein as a first time period) and a testing period (also referred to herein as a second time period). The testing and training periods may have substantially the same duration (e.g., differing by less than 10%). For example, the testing and training periods may comprise a 24-hour period. In some embodiments, the testing period follows the training period. In additional embodiments, the training and testing periods may partially or completely overlap (i.e., the same time period).

[0121] In step 112, processor 48 identifies any source node in the aggregated communication session that is a "noisy scanner". In embodiments of the invention, a given source node 64 may be classified as a noisy scanner if, during the training period, a given source node accesses (i.e., "scans") at least a second number (e.g., 80, 90, 100, or 110) of destination ports 72 on destination nodes 66, then the given source node 64 may be classified as a noisy scanner. In some embodiments, the second number is greater than the first number. As described below, processor 48 may ignore any source node 64 that the system processor classifies as a noisy scanner.

[0122] In step 114, processor 48 calculates a typical number of baseline scores (also referred to herein as baseline levels) for each pair of given source nodes 64 and given destination nodes 66 in the aggregated communication session, indicating the port 40, which is still the port accessed by the first source node (i.e., excluding the given source node, and in some embodiments, excluding any source nodes identified as noisy scanners) on the given destination node during a given sub-period (e.g., a day) in the training period. In some embodiments, processor 48 may calculate a baseline score (also referred to herein as baseline level) for each pair of source nodes 64 and destination nodes 66. i , j Each of the following formulas is used to calculate the baseline score:

[0123] in - in the d Destination node within a day (i.e., a given sub-time period) j The source node set, which does not include { i , noise_scanners}

[0124] - in the d Tianyuan Node k and destination node j The number of different destination ports 72 between them.

[0125] D - Baseline number of days in the training period d .

[0126] During operation, processor 48 can process a single training session. D Or for those with multiple sub-time periods D The training time period calculation equation is (1). In a single time period... D In some embodiments, training and testing sessions can have substantially the same duration, and there can be multiple sessions. D In some embodiments, sub-periods and test periods can have substantially the same duration.

[0127] In step 116, processor 48 calculates a destination profile score for each pair of given source node 64 and given destination node 66 in the second aggregated communication session. This destination profile score can be used to identify any source node suspected of performing port scan 32 based on the destination ports accessed by the source node on the destination node during the training and testing periods. For example, processor 48 can calculate a destination profile score for each pair (64 and 66) identified during the testing period. i , j ), calculate the following destination profile scores:

[0128] in Including source nodes during the test period i At the destination node j The number of destination ports 72 accessed. In embodiments of the invention, for a given pair ( i , j A higher destination profile score indicates the score of a given source node. i During the test period at a given destination node j The number of ports 40 scanned is greater than the number of ports scanned on a given destination node by a given source node during the training period. Higher Score i,j Indicator source node i Currently processing the destination node j A higher probability of performing a port scan.

[0129] Finally, in step 118, processor 48 can identify a given pair of source and destination nodes whose destination profile score exceeds a specified threshold (i.e., level), thereby indicating a suspicious port scan, and the method ends. In one embodiment, the threshold may include a large score value (e.g., 7, 8, 9, or 10). In another embodiment, the threshold may include a low score value (e.g., 4, 5, or 6), and the number of failed connections between the source and destination nodes during the test period is greater than a low failed connection value (e.g., 0, 1, or 2).

[0130] Source configuration file generation In the second abnormal port scan detection embodiment, processor 48 can use a source profile to detect potential malicious port scans. As described below, processor 48 can generate a source profile for each given source node 64 based on port scans collected during a specified time period, indicating to the node whether the given source node is an offensive scanner or a periodic scanner. In embodiments of the invention, scans from offensive and periodic scanners are not considered suspicious, and offensive and periodic scanners can be whitelisted.

[0131] Computer networks such as network 28 typically include workstations 28 that can perform processes that perform legitimate port scans or legitimate activities similar to port scans (i.e., with different intents). Since these services or activities sometimes originate from the same source node 64, embodiments of the invention can generate and use source profiles to detect these source nodes in order to whitelist their legitimate port scan activities.

[0132] Figure 4This is a flowchart schematically illustrating a method according to an embodiment of the present invention for calculating a source profile and using the calculated source profile to detect any source node 64 that is an offensive or periodic scanner and whitelist it. In step 120, the method described in the above reference... Figure 2 In the embodiment described herein, processor 48 identifies a set of port scans. To identify this set of port scans, processor 48 collects communication sessions 68 over a time span comprising multiple predefined time periods and aggregates them into aggregated communication sessions 58. Each aggregated communication session 58 includes a given port scan 32 that enables a first given workstation 26 to access at least one given communication port 40 on a second given destination 26 during the given time period. The predefined time periods may have substantially the same duration (e.g., one day).

[0133] In step 122, processor 48 computes for each given source node "i" in the port scan. scanned_ dests_average i This indicates the average number of destination nodes 66 whose respective communication ports 40 are accessed by the given source node during any given scan of the given source node. In some embodiments, scannned_dests_ average i Includes the average number of destination nodes scanned by the given source node in each time period, omitting time periods when the given source node did not perform a scan.

[0134] In step 124, for each given source node "i" in the port scan, processor 48 calculates the condition for the given source node. i of Its indicated time period D The ratio of the two values ​​during which a given source node accesses at least one destination node in at least one port scan performed by the given source node.

[0135] In step 126, the processor 48 is based on computation scanned_dests_average i Average and scan_ ratio i The ratio will whitelist any source node classified as an offensive or periodic scanner, as described in the standard below. To whitelist a given source node 64, processor 48 adds the given source node (i.e., the corresponding port number) to whitelist 80.

[0136] In embodiments of the invention, an offensive scanner can be defined as a given source node 64 that scans several destination nodes 66 during each time period (e.g., daily). For example, the offensive scanner might scan a database server and a web server (i.e., two different destination nodes) hourly to check their respective statuses. In some embodiments, for each given source node 64, the processor 48 may first... scan_days i Identify the number of days on which at least one scan was performed for a given source node, and if i : scanned_dests_average i Exceeding the first low threshold (e.g., 2, 3, 4, 5, 6, 7) and / or scan_ratio i A given source node can be classified as an offensive scanner if it exceeds a first high threshold (e.g., 0.5, 0.6, 0.7, 0.8).

[0137] For example, if the first low threshold is 3, the first high threshold is 0.5, and the daily count of the destination node 66 scanned by a given source node 64 is [3, 0, 4, 4, 6, 3], then the given source node is an offensive scanner because... scan_days i =5, scanned_dests_average i = 4, and scan_ratio i = 0.833.

[0138] In embodiments of the invention, a periodic scanner can be defined as scanning a given source node 64 to many destinations at a low frequency (e.g., once a week). For example, a periodic scanner could scan ports 40 on all nodes (e.g., workstation 26) on network 28 weekly to see if there are any changes, such as if any new ports 40 are open or if any corresponding vulnerabilities exist in the nodes. Similar to detecting an offensive scanner, for each given source node 64, the processor 48 can first identify… scan_days i And if i : scanned_dests_average i Exceeding the second highest threshold (e.g., 10, 15, 20, 25, 30, 35) and / or scan_ratio i A given source node can be classified as a periodic scanner if it exceeds the second low threshold (e.g., 0.10, 0.15, 0.2, 0.25).

[0139] For example, if the second high threshold is 30, the first low threshold and the second low threshold are 0.1, and the daily count of the destination node 66 scanned by a given source node 64 is [0, 0, 1314, 0, 0, 0], then the given source node is a periodic scanner because... scan_days i = 1、 scanned_dests_average i = 1314, and scan_ratio i = 0.14.

[0140] In one embodiment, processor 48 may receive input specifying a first low threshold and a second low threshold, as well as a first high threshold and a second high threshold (e.g., from a system manager). In another embodiment, processor 48 may base its input on calculated values ​​(i.e., scanned_dests_average i and scan_ratio i These thresholds are dynamically set based on the corresponding distribution of the calculated values. For example, processor 48 can dynamically set the thresholds based on outliers (e.g., a fixed percentage) in the corresponding distribution of the calculated values.

[0141] Returning to the flowchart, in step 126, processor 48 identifies (i.e., identified in step 120) any source node in the port scan that is not in the whitelist 80, and the method ends.

[0142] In one embodiment, processor 48 may execute step 128 during any given time period to identify a given non-whitelisted source node that performs a port scan during the given time period. In another embodiment, the time period includes one or more first time periods followed by a second time period, and processor 48 may execute steps 120-126 during one or more first time periods and execute step 128 during the second time period.

[0143] Port configuration file The embodiments described herein can use port profiles to detect potential malicious port scans. Port profiles indicate which combinations of ports 40 are unlikely to be part of “normal” user activity, but rather part of a network scan. The concept behind port profiles is that if ports are scanned over a short period of time (e.g., a day), suspicious port combinations are present. For example, if a legitimate user wants to access a specific network service provided by a given workstation 26 on network 28, the user typically knows which software applications are providing the service and which ports 40 the software applications are using.

[0144] In the first port profile embodiment, the service (also referred to herein as a software category) includes the operating system. For example, if a user wants to communicate with a given workstation running the Windows™ operating system (manufactured by Microsoft Corporation in Redmond, Washington), the user can use port number "3389," which is used for the Remote Desktop Protocol (RDP) service. However, if a user attempts to communicate with a given workstation via port number "22," this could be questionable, as port number "22" is typically used by the Secure Shell (SSH) service, which is a service in the Linux™ operating system and rarely exists in the Windows™ operating system.

[0145] In the second port profile embodiment, the service includes a database management system (DBMS). In operation, a first given workstation 26 communicates with a DBMS application running on the second given workstation via a given port 40 associated with the DBMS application on the second given workstation. In this embodiment, a suspicious port scan may include a first given workstation communicating with a large number of ports 40 (i.e., on the second given workstation), each port 40 being associated with a corresponding large number of different DBMS applications. This type of activity may be caused by an attacker performing service enumeration, for example, attempting to identify all available DBMS applications on a particular server.

[0146] It is important to note that suspicious port scanning activity differs between the two embodiments described above. In the operating system embodiment, a small number of port scans across different operating system port groups may be suspicious. This is because a given workstation 26 typically runs a single operating system. However, in the DBMS embodiment, suspicious port scanning may require a large number of port scans across different DBMS port scanning groups to be flagged as suspicious. This is because a given workstation 26 may run more than one DBMS application.

[0147] In the first port profile embodiment, the processor 48 may define multiple port lists 60 for corresponding multiple operating systems 42. Each port list 60 includes multiple port numbers 40 commonly used by a given operating system 42. Thus, each given port list 60 for a given operating system 42 includes port numbers 40 that are typically used by the given operating system and are rarely or never used by other operating systems 42. Examples of operating systems 42 that may have corresponding port lists 60 include, but are not limited to, Windows™ (manufactured by Microsoft Corporation of Redmond, Washington), Linux™, Android™ (manufactured by Alphabet Inc. of Mountain View, California), and macOS™ (also known as OS-X™, manufactured by Apple Inc. of Cupertino, California).

[0148] For example: The first given port list 60 may include port numbers “135”, “137”, and “139”. These ports 40 are typically used by Windows™ services.

[0149] The second given port list 60 may include port numbers “22”, “23”, and “111”. These ports 40 are typically used by Linux™ services.

[0150] The basic principle behind defining the port list in the first port configuration file embodiment is that attackers typically do not know the operating system running on a given workstation 26 they are scanning, and one of the attacker's goals is to identify the operating system 42. Therefore, an attacker can scan several ports 40 from a list 60 of more than one port in order to identify the operating system running on a given workstation.

[0151] For example, if the first given list 60 includes ports used by Windows™, the second given list 60 includes ports used by Linux™, and the third given list 60 includes ports used by macOS™, then for each source node 64 and destination node 66 pair, the processor 48 can compute tuples (N... Windows , N_Linux , N_macOS This tuple represents the corresponding count of port numbers in the port list, which is scanned by the given source node on the given destination node during the test period (no training period is required). In this example: Processor 48 will not tag tuples such as (4, 0, 0) because a given destination node may be running Windows™.

[0152] Processor 48 will label tuples such as (4, 2, 3) because the given source node attempts to access port 40, which is typically used by macOS™ but rarely by Windows™.

[0153] In some embodiments, processor 48 may use a specified threshold for mixing counts in a tuple to identify suspicious port scans 32 “across” multiple operating systems. In a first example, if a given tuple indicates a threshold number of scans (e.g., >3, >4, or >5) of ports 40 associated with one of the operating systems, and a positive number of scans of any ports associated with the remaining operating systems, processor 48 may mark the port scans in the given tuple as suspicious. In another example, if a given tuple indicates a correspondingly large number (e.g., >3, >4, or >5) of scans of ports 40 associated with at least two different operating systems, processor 48 may mark the port scans in the given tuple as suspicious. In the first example, the processor may mark the port scan resulting in tuple (4, 1, 2) as suspicious, and in the second example, the processor may mark the port scan resulting in tuple (0, 4, 3) as suspicious.

[0154] In an additional embodiment, processor 48 can convert the tuple into a probability that the processor can use to identify suspicious port scans. For example, processor 48 can calculate... probabilities tuple = [ p 1, p 2,... , p n ],in

[0155] There may be cases where the port value is small and the probability is suspected to be inaccurate. In other words, even if a given port 40 has not been visited before, its probability of being visited in the future is not zero. In one embodiment, processor 48 may use methods such as confidence intervals or Laplace smoothing to improve the estimation. In another embodiment, processor 48 may compute a given tuple. probabilities_tuple The entropy is calculated, and if the entropy exceeds a specified threshold (e.g., 0.1, 0.2), the port scans in the tuple are marked as suspicious (i.e., because they are accessing suspicious combinations of ports in more than one group).

[0156] In the second port configuration file embodiment, the processor 48 may define multiple port lists 60 for corresponding multiple software applications 44. Each port list 60 includes multiple port numbers 40 that are shared by a specific family of software applications 44. Thus, each given port list 60 for a given software application 44 includes ports that are typically used by the given software application and that are rarely or never used by other software applications 44. Examples of families (also called categories) of software applications 44 in the second port configuration file embodiment include, but are not limited to, database services, email services, and remote access services (also called remote session services).

[0157] For example, if the software application 44 series includes a database server, the list of ports used for the database server could include: The first given port list 60 includes ports used for MySQL. TM One or more port numbers 40 (e.g., "3306").

[0158] The second given port list 60 includes ports for Firebird. TM One or more port numbers 40 (e.g., "1433").

[0159] The third given port list 60 includes ports for PostgreSQL. TM One or more port numbers 40 (e.g., "5432").

[0160] The fourth given port list 60 includes ports for MongoDB. TM One or more port numbers 40 (e.g., "27017").

[0161] The fifth given port list 60 includes ports for Cassandra. TM One or more port numbers 40 (e.g., "9042").

[0162] The sixth given port list 60 includes one or more port numbers 40 used for MemcacheDB™ (e.g., “11211”).

[0163] The seventh given port list 60 includes those used for Aerospike TM One or more port numbers 40 (e.g., "3100").

[0164] Typically, a given node (e.g., a given workstation 26 or server) may be executing a small number (e.g., 1-3) of different database server engines. Therefore, if processor 48 detects that a given source node 64 is scanning ports 40 on a given destination node 66 from at least a threshold number (e.g., at least 3, at least 4, or at least 5) of different port lists 60 used for database servers, this may indicate that the given source node is looking for "any" database server and therefore does not know which one is executing on the given destination profile. When a large number of ports scanned from different port lists 60 for a given network service are detected, having zero or a small number (e.g., fewer than 2, fewer than 3, or fewer than 4) of successful sessions increases suspicion.

[0165] In some embodiments, processor 48 may use additional criteria, such as the number of detected failed connections associated with different ports 40. In one example, processor 48 may flag (i.e., mark as suspicious) a port scan that scans a large number (e.g., at least four or at least five) of ports 40 from a different list of ports 60 used for the database server. In another example, processor 48 may flag a port scan that is suspicious for scanning a small number (e.g., at least two or at least three) of ports 40 from a different list of ports 60 used for the database server, wherein at least one of the port scans has failed connections (as described above). Note that these examples are typically for port scans performed over a short timeframe (e.g., less than one hour, less than two hours, or less than three hours).

[0166] In the first embodiment, the threshold may include a large number, such as at least 5, at least 6, or at least 7. In the second embodiment, the threshold may include a small number (e.g., at least 2, at least 3, or at least 4) of ports in different port lists, and at least one failed connection on any port number in any port list (i.e., for that series). The port scans in the first and second embodiments typically occur over a short period of time (e.g., one hour, two hours, or three hours).

[0167] Figure 5 This is a flowchart schematically illustrating a method for detecting port scans across software systems using port profiles according to an embodiment of the present invention. In step 130, processor 48 defines a plurality of software systems in a specific software category, and in step 132, the system processor defines a given port list 60 for each given software system, the given port list 60 including a set of one or more ports 40 specifically used by the given software system. Thus, each port list 50 includes at least a disjoint first set and a second set of communication ports 40 (i.e., port numbers). The category may include operating systems or software applications that provide network services (such as database servers or email servers). As mentioned above, if the category is an operating system, each port list 60 includes one or more ports 40 used by an operating system such as Windows™, Linux™, or macOS™. Similarly, if the category is a DMBS application, each port list 60 includes ports 40 used by a DBMS application such as MySQL. TM PostgreSQL TM Or Cassandra TM Use one or more ports 40.

[0168] In step 134, the reference above is used. Figure 2In the embodiment described herein, processor 48 identifies a set of port scans. To identify this set of port scans, processor 48 collects communication sessions 68 over a predefined time period (e.g., one hour or one day) and aggregates them into aggregated communication sessions 58. Each aggregated communication session 58 includes a given port scan 32 that enables a first given workstation 26 to access at least one given communication port 40 on a second given destination 26.

[0169] Finally, in step 136, using the embodiment described above, the processor 48 identifies, in the identified port scan (i.e., in step 134), a given source node 64 that accesses at least one communication port in the first port list 60 and at least one communication port in the second port list 60, and the method ends.

[0170] Deviation from independent model The embodiments described herein can calculate the distribution of port usage in network 28 and use the calculated distribution to identify suspicious port scans on the network. For example, during a training period, processor 48 can detect that port numbers "22" and "3389" are frequently used, but rarely used together. During a subsequent testing period, if processor 48 detects that a given source node 64 scans those two ports 40 on a given destination node 66, the system processor can generate an alert for the given source node.

[0171] Figure 6 This is a flowchart schematically illustrating a method for detecting port scan 32, including anomalies to port 40, according to an embodiment of the present invention. In step 140, the method described in the above reference... Figure 2 In the embodiment described herein, processor 48 identifies a set of port scans. To identify this set of port scans, processor 48 collects communication sessions 68 during a predefined time period and aggregates them into aggregated communication sessions 58. Each aggregated communication session 58 includes a given port scan 32 that enables a first given workstation 26 to access at least one given communication port 40 on a second given destination 26.

[0172] In step 142, the processor 48 scans each given port during a predefined time period. p Calculate how a given source node 64 accesses a given port on a given destination node 66 during any port scan 32 within a predefined time period. p probability P p .

[0173] In step 144, processor 48 for each pair of ports p1 and p2Calculate the ports on a given source node 64 and a given destination node 66 in any port scan 32 during a predefined time period. p1 and p2 Joint probability of connections between JP p1,p2 .

[0174] For each pair of ports scanned during the training period, 40 calculations are performed. JP p1,p2 Then, in step 146, processor 48 calculates the port pair score ( PPS The system processor can use it to identify ports with the following characteristics. p1 and p2 right: port p1 It is frequently scanned by any given source node 64 during a predefined time period.

[0175] port p2 It is frequently scanned by any given source node 64 during a predefined time period.

[0176] Given that source node 64 scans ports on a given destination node 66 very rarely during a predefined time period. p1 and p2 both.

[0177] In order to calculate Port to score The processor 48 can use the following formula

[0178] In equation (3), the higher PPS The score indicates a pair of ports 40 that are frequently scanned on the network, but rarely scanned together by a given source node 64 on a given destination node 66 during a predefined time period. In embodiments of the invention, the threshold for a high PPS score can be a high value. For example, the threshold can be greater than 20, greater than 30, or greater than 40.

[0179] Finally, in step 148, the processor 48 identifies scans with high [visibility / activity] during a predefined time period. Port to score The method terminates if any of the source nodes in a pair of port 40 are selected, and the method ends. In embodiments of the invention, having high... port For the score The scanned pair of ports 40 indicates the port pair. p1 and p2 The corresponding JP p1,p2 Lower than depends on the port p1 and p2 The corresponding probability P pThe threshold.

[0180] In one embodiment, the predefined time period may include multiple sub-time periods that may have substantially the same duration. In this embodiment, the processor 48 may execute step 150 during any given sub-time period to identify scans with high... Port to score A given source node 64 with a pair of ports 40. In another embodiment, a sub-period includes one or more first sub-periods followed by a second sub-period, and the processor 48 may execute steps 140-146 in one or more first sub-periods and step 148 in the second sub-period.

[0181] Scanner probe Some scanning tools use port scanning probes, which include a given software application 44 loaded on one or more nodes 26 and configured to scan other nodes 26 on the network and report the scan results to a scanning server (e.g., a given node 26). The scanning probes can be deployed in a network with nodes 26 that the scanning server cannot directly access (e.g., due to firewalls protecting a subset of the network) using all the ports required for the scan. In operation, the probes can be deployed on multiple network endpoints (i.e., nodes 26) to randomly perform port scans and then transmit the scan results back to the given node (i.e., the server). Because scans performed by the scanner probes can generate alerts, embodiments of the present invention enable the processor 48 to whitelist scans performed by a given scanner probe.

[0182] Figure 7 This is a flowchart schematically illustrating a method for detecting any deployed scanner probe according to an embodiment of the present invention. In step 150, the above-referenced... Figure 2 In the embodiment described herein, processor 48 identifies a set of port scans. To identify this set of port scans, processor 48 collects communication sessions 68 during a predefined time period and aggregates them into aggregated communication sessions 58. Each aggregated communication session 58 includes a given port scan 32 that enables a first given workstation 26 to access at least one given communication port 40 on a second given destination 26.

[0183] In step 152, processor 48 identifies a group of high-traffic ports 40 in the identified port scans. In embodiments of the invention, processor 48 may classify a given port 40 as having high traffic if the amount of data traffic through a given port exceeds a predefined threshold during a predefined time period. Examples of the predefined threshold include, but are not limited to, 200, 400, and 600 bytes. In some embodiments, the given port may be on a given node 26. In other words, processor 48 may classify a combination of a given node and a given port as having high traffic.

[0184] In operation, processor 48 can use capacity 88 and / or reverse capacity 78 in a communication session of aggregated port scan (i.e., corresponding to a given port scan 32) to determine whether data traffic in a given port scan 32 exceeds a predefined threshold. In some embodiments, if the maximum amount of data through a given port in any given communication session (i.e., during a given port scan 32) exceeds a predefined threshold, processor 48 can classify the given port 40 as having high traffic volume.

[0185] In step 154, processor 48 generates a corresponding signature 82 for each identified port scan, indicating communication ports other than high-traffic ports that were accessed in each port scan. In other words, a given signature 82 for a given port scan 32 may include a set of communication ports that were accessed during the given port scan and were not classified as having high traffic.

[0186] In step 156, processor 48 calculates the corresponding frequency of occurrence of each signature in the signatures on the group of port scans, and in step 158, processor aggregates whitelist 80 by initializing a whitelist and then adding signatures to the whitelist for which the corresponding frequency of occurrence is greater than a predefined threshold. In one embodiment, the frequency of occurrence for a given signature 82 may include information such as: The number of times a given signature appears in all identified port scans.

[0187] Perform a port scan of the number of sources with the same signature 82 as the given signature (i.e., the group of non-high-capacity ports).

[0188] The number of destinations with the same set of ports as the set of ports in a given signature that have been scanned.

[0189] In this embodiment, examples of specific thresholds include, but are not limited to: The number of occurrences exceeds the first threshold, such as 8, 10, or 12.

[0190] The number of sources is greater than the second threshold, such as 0, 1, or 2.

[0191] The number of sources is less than a third threshold, such as 30, 40, or 50.

[0192] Number of destinations > fourth threshold, such as 0, 1, 2 or 3.

[0193] The number of destinations is less than the fifth threshold, such as 10, 20, 30, or 40.

[0194] In some embodiments, the processor 48 may use a combination of thresholds to identify a signature for addition to a whitelist. For example, a given combination could be: The number of occurrences is greater than 10, and Number of sources > 1, and Number of sources < 40, and Number of destinations > 2, and Number of destinations < 20.

[0195] Finally, in step 160, the processor 48 identifies any source node in the identified port scan with the corresponding signature that is not in the whitelist, and the method ends.

[0196] In one embodiment, the predefined time period may include multiple sub-time periods that may have substantially the same duration. In this embodiment, the processor 48 may perform step 160 during any given sub-time period to identify an identified port scan 32 with a corresponding signature not in a whitelist within that given sub-time period. In another embodiment, the sub-time period includes one or more first sub-time periods followed by second sub-time periods, and the processor 48 may perform steps 150-158 during one or more first sub-time periods and step 160 during the second sub-time period.

[0197] It should be understood that the above embodiments are cited by way of example, and the invention is not limited to what has been specifically shown and described above. Rather, the scope of the invention includes combinations and sub-combinations of the various features described above, as well as variations and modifications of the invention that would occur to those skilled in the art after reading the foregoing description and that are not disclosed in the prior art.

Claims

1. A method comprising: identifying a set of port scans in data traffic transmitted between a plurality of nodes that communicate over a network, each of the port scans comprising access to a plurality of communication ports on a given destination node by a given source node in the data traffic during a predefined time period; for a communication port that is accessed in the identified port scans, computing a respective first probability of being accessed during any given port scan; for each pair of communication ports in the identified port scans, computing a respective second probability of both communication ports in the pair being accessed during any given port scan; and initiating a preventive action when a port scan by one of the nodes comprising access to a first communication port and a second communication port on a given destination node is detected, for which the respective second probability for the pair of the first communication port and the second communication port is below a threshold that depends on the respective first probabilities of the first communication port and the second communication port.

2. The method of claim 1, wherein, Identifying the port scans comprises: identifying a set of the source node and destination node pairs in the data traffic, each pair consisting of a given source node and a given destination node and one or more of the communication ports that are accessed in the data traffic between the source and destination nodes in each pair, for each pair in the set, computing a respective communication level indicating a first number of communication ports that are accessed on the given destination node by source nodes other than the given source node in the pair during a first time period, for each pair in the set, computing a respective test score indicating a difference between a second number of communication ports that are accessed on the given destination node by the given source node in the pair during a second time period and the baseline level, and designating any pair in which the test score for the pair is greater than a specified level as the port scans.

3. The method of claim 1, wherein, The specified time period comprises a plurality of sub-periods, the plurality of sub-periods comprising a set of first sub-periods and a second sub-period that follows the first sub-periods, wherein the steps of identifying a group of high-traffic ports and generating a whitelist are performed on port scans in the first sub-periods, and wherein detecting a port scan on one of the nodes is performed in the second sub-period.

4. The method of claim 3, wherein, Each of the sub-periods has substantially the same duration.

5. The method of any one of claims 1 to 4, wherein, Initiating the preventive action comprises generating an alert for the given source node in the detected port scan.

6. The method of any one of claims 1 to 4, wherein, Initiating the preventive action comprises limiting access to the network by the given source node in the detected port scan.

7. An apparatus comprising: a network interface device coupled to a data network, the network comprising a plurality of nodes that communicate via the network; and at least one processor configured to: identifying a set of port scans among data traffic transmitted between a plurality of nodes communicating over a network, each of the port scans comprising accesses, by a given source node, to a plurality of communication ports on a given destination node in the data traffic during a predefined time period, for each communication port accessed in the identified port scans, computing a respective first probability of being accessed during any given port scan, for each pair of communication ports in the identified port scans, computing a respective second probability of both communication ports in the pair being accessed during any given port scan, and initiating a preventive action when a port scan comprising accesses to a first communication port and a second communication port on a given destination node by one of the nodes is detected, for which the respective second probability for the pair of the first and second communication ports is below a threshold depending on the respective first probabilities of the first and second communication ports.

8. The apparatus of claim 7, wherein, The given processor is configured to identify the port scans by: identifying a set of pairs of the source and destination nodes in the data traffic, each pair consisting of a given source node and a given destination node and one or more of the communication ports accessed between the source and destination nodes in the pair in the data traffic, for each pair in the set, computing a respective communication level indicating a first number of communication ports accessed on the given destination node by source nodes other than the given source node in the pair during a first time period, for each pair in the set, computing a respective test score indicating a difference between a second number of communication ports accessed on the given destination node by the given source node in the pair during a second time period and the baseline level, and designating any pair in which the test score is greater than a specified level as the port scans.

9. The apparatus of claim 7, wherein, The specified time period comprises a plurality of sub-periods, the plurality of sub-periods comprising a set of first sub-periods and a second sub-period following the first sub-periods, wherein the steps of identifying a group of high-traffic ports and generating a whitelist are performed on port scans in the first sub-periods, and wherein the given processor is configured to detect that a port scan on one of the nodes is performed in the second sub-period.

10. The apparatus of claim 9, wherein, Each of the sub-periods has substantially the same duration.

11. The apparatus of any one of claims 7 to 10, wherein, The given processor is configured to initiate the preventive action by generating an alert for the given source node in the detected port scans.

12. The apparatus of any one of claims 7-10, wherein, The given processor is configured to initiate the preventive action by limiting access to the network by the given source node in the detected port scans.

13. A computer software product, the product comprising a non-transitory computer readable medium having stored therein program instructions that, when read by a computer, cause the computer to: A set of port scans is identified among data traffic transmitted between a plurality of nodes communicating through a network, each of the port scans comprising accesses, by a given source node, to a plurality of communication ports on a given destination node in the data traffic during a predefined time period; For each pair of communication ports in the identified port scans, a respective second probability is computed that both communication ports in the pair are accessed during any given port scan; and A preventive action is initiated when a port scan is detected, by one of the nodes, comprising accesses to a first communication port and a second communication port on a given destination node, for which the respective second probability for the pair of the first communication port and the second communication port is below a threshold depending on the respective first probabilities of the first communication port and the second communication port.

14. A method comprising: For a given software category, defining a first and a second mutually disjoint sets of logical communication port numbers used by different respective first and second software systems in the given software category; A set of port scans is identified among data traffic transmitted between a plurality of nodes communicating through a network, each of the port scans comprising accesses, by a given source node, to a plurality of communication ports on a given destination node in the data traffic during a predefined time period; Upon detecting that the given source node accessed at least one logical communication port number in the first set and at least one logical communication port number in the second set on the given destination node in a given port scan, the given port scan is classified as suspicious; And Upon classifying the given port scan as suspicious, a protective action is initiated. Identifying the port scans comprises detecting failed connections between the given source node and a given logical port number in the first set on the given destination node.

15. The method of claim 14, wherein, Identifying the port scans comprises detecting accesses to at least a specified number of logical communication port numbers in the first set, wherein the specified number is greater than 1.

16. The method of claim 14, wherein, Identifying the port scans comprises detecting accesses to at least a specified number of logical communication port numbers in each of the first and second sets, wherein the specified number is greater than 1.

17. The method of claim 14, wherein, The first set consists of logical communication port numbers used by a first operating system, and the second set consists of logical communication port numbers used by a second operating system different from the first operating system.

18. The method of claim 14, wherein, The first set consists of logical communication port numbers used by a first database server, and the second set consists of logical communication port numbers used by a second database server different from the first database server.

19. The method of claim 14, wherein, The first set consists of logical communication port numbers used by a first email server, and the second set consists of logical communication port numbers used by a second email server different from the first email server.

20. The method of claim 14, wherein, ​ 21. The method of claim 14, wherein, The first set consists of logical communication port numbers used by a first remote session application, and the second set consists of logical communication port numbers used by a second remote session application different from the first remote session application.

22. The method of claim 14, wherein, Initiating the preventive action includes generating an alert for the given source node in the detected port scan.

23. The method of claim 14, wherein, Initiating the preventive action includes limiting access of the given source node in the detected port scan to the network.

24. An apparatus comprising: a network interface device coupled to a data network, the network comprising a plurality of nodes that communicate via the network; and at least one processor configured to: receive a definition of mutually disjoint first and second sets of logical communication port numbers used by different respective first and second software systems in a given software category; identify, in data traffic transmitted between the plurality of nodes that communicate via a network, port scans, each of the port scans comprising access by a given source node in the data traffic to a plurality of the logical communication port numbers on a given destination node during a predefined time period; classify a given port scan as suspicious upon detecting that the given source node accessed at least one logical communication port number in the first set and at least one logical communication port number in the second set on the given destination node in the given port scan; and initiate a protective action upon classifying the given port scan as suspicious.

25. The apparatus of claim 24, wherein, The at least one processor is configured to detect a failed connection between the given source node and a given logical port number in the first set on the given destination node.

26. The apparatus of claim 24, wherein, Identifying the port scans includes detecting access to at least a specified number of logical communication port numbers in the first set, wherein the specified number is greater than 1.

27. The apparatus of claim 24, wherein, Identifying the port scans includes detecting access to at least a specified number of logical communication port numbers in each of the first and second sets, wherein the specified number is greater than 1.

28. The apparatus of claim 24, wherein, The first set consists of logical communication port numbers used by a first operating system, and the second set consists of logical communication port numbers used by a second operating system different from the first operating system.

29. The apparatus of claim 24, wherein, The first set consists of logical communication port numbers used by a first database server, and the second set consists of logical communication port numbers used by a second database server different from the first database server.

30. The apparatus of claim 24, wherein, The first set consists of logical communication port numbers used by a first email server, and the second set consists of logical communication port numbers used by a second email server different from the first email server.

31. The apparatus of claim 24, wherein, The first set consists of logical communication port numbers used by a first remote session application, and the second set consists of logical communication port numbers used by a second remote session application different from the first remote session application.

32. The apparatus of claim 24, wherein the preventive action includes generating an alert for the given source node in the detected port scan.

33. The apparatus of claim 24, wherein, The protective action includes limiting access of the given source node in the detected port scans to the network.

34. A computer software product, the product comprising a non-transitory computer readable medium having stored therein program instructions that, when read by a computer, cause the computer to: receive a definition of mutually disjoint first and second sets of logical communication port numbers used by different respective first and second software systems in a given software category; identify, in data traffic transmitted between a plurality of nodes that communicate over a network, port scans, each of the port scans including access by a given source node in the data traffic to a plurality of the logical communication port numbers on a given destination node during a predefined time period; and classify the given port scan as suspicious upon detecting that the given source node accessed at least one logical communication port number in the first set and at least one logical communication port number in the second set on the given destination node in the given port scan; and initiate a protective action upon classifying the given port scan as suspicious.

Images