Port scanning detection

Abstract

This application relates to port scan detection. A method includes identifying, in network data traffic, a set of source node and destination node (26) pairs, each pair having a given source node, a given destination node, and one or more ports (40) accessed in traffic between the nodes in each pair, and computing, for each pair, a respective baseline indicating a first number of ports accessed on the given destination node by source nodes other than the given source node in the pair during a first time period. For each pair, a respective test score is computed indicating a difference between a second number of ports accessed on the given destination node by the given source node in the pair during a second time period and the baseline, and a preventive action is initiated for the given source node for which the test score for any of the pairs is greater than a threshold.

Description

[0001] This application is a divisional application of the application with the application date of December 8, 2019, the application number of 201980090243.X, and the application title of “Port Scan Detection”. TECHNICAL FIELD

[0002] The present invention relates generally to computer security, and in particular to detecting port scanning attacks. BACKGROUND

[0003] In computer networking, a communication port is a logical communication endpoint on a network, which from a software perspective is considered equivalent to a particular resource (e.g., process or service type) executing on a given computer in the network. A communication port (also simply referred to herein as a port or port number) is typically defined by a communication protocol. For example, a port is one in the Layer 4 (i.e., transport layer) protocol in the Open Systems Interconnection (OSI) model and is used to define a network session in a client-server application architecture.

[0004] Ports provide multiplexing services for multiple services or multiple communication sessions at one network address. In operation, a port is part of the addressing information used to identify the source and destination of messages transmitted over a network. In addition, each “open” port is typically associated with a particular service, such as having a service connected to them, such as a database service, email service, or communication service.

[0005] Network port scanning is a method used to determine which ports on a network are open. Running a port scan on a network or server reveals which ports are open and configured to receive and / or send information. Network professionals can use port scanning tools to measure their exposure to attackers and monitor devices and services. On the other hand, hackers will scan ports to probe for open ports that can be exploited in a network and to determine what services are running on each device. For example, a hacker can send a message to multiple ports and analyze the response from each given port in order to determine whether the port is being used and, if so, what service is using the given port.

[0006] The documents incorporated by reference in the present patent application should be considered an integral part of the application unless the definition of any term in these incorporated documents conflicts with the explicit or implicit definition of such term in the present specification, in which case the definition provided in the present specification should be considered the controlling definition.

[0007] The above description is presented to enable any person skilled in the art to practice the concepts presented herein and is provided as a general overview of related technology and should not be construed as admitting that any of the information contained therein constitutes prior art relative to this patent application. SUMMARY

[0008] According to embodiments of the invention, there is provided a method comprising: identifying a set of source node and destination node pairs in data traffic transmitted between a plurality of nodes communicating over a network, each pair consisting of a given source node and a given destination node and one or more communication ports accessed in the data traffic between the source and destination nodes in each pair; for each pair in the set, computing a respective baseline level indicating a first number of communication ports accessed on the given destination node by source nodes other than the given source node in the pair during a first time period; for each pair in the set, computing a respective test score indicating a difference between a second number of communication ports accessed on the given destination node by the given source node in the pair during a second time period and the baseline level; and initiating a preventive action for a given source node for which the test score in any pair is greater than a specified level.

[0009] In some embodiments, identifying the source node and destination node pairs comprises collecting data packets transmitted over the network from probes, aggregating the collected data packets into communication sessions between given source nodes and given destination nodes, and identifying in each aggregated communication session a given source node that accesses at least one given communication port on the given destination node. In additional embodiments, the method further comprises identifying one or more noisy scanners, each of the noisy scanners comprising a given source node that accesses at least a specified first number of destination ports on at least a second specified number of destination nodes. In one embodiment, computing the baseline level for a given pair comprises computing a modified first number of protocol ports accessed on the given destination node by source nodes other than the given source node in the pair and other than any of the identified noisy scanners during the first time period;

[0010] In further embodiments, the specified level comprises a first specified level, initiating the preventive action comprises initiating a first preventive action, and the method further comprises identifying any failed connections in a port scan during the second time period, and initiating a second preventive action for a given source node in any pair that has at least one of the identified failed connections and for which the test score is greater than a second specified level that is lower than the first specified level.

[0011] In one embodiment, the second time period is after the first time period. In another embodiment, the first time period and the second time period have substantially the same duration. In a supplemental embodiment, the first time period includes a plurality of sub-periods, and computing the test score for a given pair includes computing a separate baseline level for each of the sub-periods, computing an average of the separate baseline levels, and subtracting the computed average from the second number of communication ports. In some embodiments, the second time period and each of the sub-periods have substantially the same duration.

[0012] In an additional embodiment, initiating the preventative action includes generating an alert for the given source node. In a further embodiment, initiating the preventative action includes restricting access to the network by the given source node.

[0013] According to embodiments of the present invention, there is additionally provided an apparatus comprising a network interface device coupled to a data network, the data network comprising a plurality of nodes that communicate via the network, and at least one processor configured to: identify a set of source node and destination node pairs among data traffic transmitted between the plurality of nodes over the network, each pair consisting of a given source node and a given destination node and one or more communication ports accessed in the data traffic between the source node and the destination node in each pair; for each pair in the set, compute a respective baseline level indicating a first number of communication ports accessed at the given destination node by source nodes other than the given source node in the pair during a first time period; for each pair in the set, compute a respective test score indicating a difference between a second number of communication ports accessed at the given destination node by the given source node in the pair during a second time period and the baseline level; and for a given source node for which the test score in any pair is greater than a specified level, initiate a preventative action.

[0014] In some embodiments, the given processor is configured to identify the source node and destination node pairs by: collecting data packets transmitted over the network from probes, aggregating the collected data packets into communication sessions between a given source node and a given destination node, and identifying in each aggregated communication session a given source node that accessed at least one given communication port on the given destination node.

[0015] In some embodiments, the given processor is further configured to identify one or more noisy scanners, each of the noisy scanners including a given source node that accessed at least a specified first number of destination ports on at least a second specified number of destination nodes.

[0016] In some embodiments, the given processor is configured to calculate the baseline level for a given pair by calculating a modified first number of communication ports accessed by source nodes other than the given source node in the pair and other than any noisy scanner that has been identified on the given destination node during the first time period.

[0017] In some embodiments, the specified level comprises a first specified level, wherein the given processor is configured to initiate the preventative action by initiating a first preventative action, and comprising: identifying any failed connections in the port scan during the second time period, and initiating a second preventative action for a given source node in any of the pairs that has at least one of the identified failed connections and that has a test score greater than a second specified level that is lower than the first specified level.

[0018] In some embodiments, the second time period is after the first time period.

[0019] In some embodiments, the first time period and the second time period have substantially the same duration.

[0020] In some embodiments, the first time period comprises a plurality of sub-periods, and wherein the given processor is configured to calculate the test score for a given pair by calculating a separate baseline level for each of the sub-periods, calculating an average of the separate baseline levels, and subtracting the calculated average from the second number of communication ports.

[0021] In some embodiments, the second time period and each of the sub-periods have substantially the same duration.

[0022] In some embodiments, the given processor is configured to initiate the preventative action by generating an alert for the given source node.

[0023] In some embodiments, the given processor is configured to initiate the preventative action by limiting access of the given source node to the network.

[0024] According to embodiments of the invention, there is additionally provided a computer software product comprising a non-transitory computer readable medium having stored therein program instructions that, when read by a computer, cause the computer to: identify, in data traffic transmitted between a plurality of nodes communicating over a network, a set of source and destination node pairs, each pair consisting of a given source node and a given destination node and one or more communication ports accessed in the data traffic between the source and destination nodes in each pair; for each pair in the set, compute a respective baseline level indicating a first number of communication ports accessed on the given destination node by source nodes other than the given source node in the pair during a first time period; for each pair in the set, compute a respective test score indicating a difference between a second number of communication ports accessed on the given destination node by the given source node in the pair during a second time period and the baseline level; and initiate a preventive action for a given source node for which the test score in any pair is greater than a specified level.

[0025] According to embodiments of the invention, there is further provided a method comprising: identifying, in data traffic transmitted between a plurality of nodes communicating over a network, a set of port scans during a time span comprising a plurality of predefined time periods, each port scan in the set of port scans comprising access by a given source node in the data traffic to a plurality of communication ports on a given destination node during a given time period; and for each given source node in the identified port scans, computing an average number of destination nodes whose respective communication ports are accessed by the given source node during any given port scan by the given source node, and computing a fraction of the time period during which the given source node accesses at least one of the destination nodes in at least one of the port scans performed by the given source node. The method further comprises aggregating a whitelist of source nodes for which one or more of the following conditions is found to apply: the average number of destination nodes accessed in the identified port scans is greater than a first threshold; and the fraction of the time period during which at least one of the destination nodes is accessed in at least one of the port scans is greater than a second threshold. The method further comprises initiating a preventive action upon detection of a port scan by one of the nodes that is not on the whitelist.

[0026] In one embodiment, identifying port scanning includes: identifying, in the data traffic, a set of source node and destination node pairs, each pair consisting of a given source node and a given destination node and one or more of the communication ports visited in the data traffic between the source node and the destination node in each pair; for each pair in the set, computing a respective baseline level indicating a first number of communication ports visited on the given destination node by source nodes other than the given source node in the pair during a first time period; for each pair in the set, computing a respective test score indicating a difference between a second number of communication ports visited on the given destination node by the given source node in the pair during a second time period and the baseline level; and designating as port scanning any pair in the pairs for which the test score is greater than a specified level.

[0027] In some embodiments, the average number of destination nodes includes an average number of destination nodes visited by the given source node during each of a plurality of time periods in which the given source node accesses at least one of the communication ports. In additional embodiments, the plurality of time periods includes a set of first time periods and a second time period after the first time periods, the steps of computing the average and function and aggregating the whitelist are performed on port scanning identified in the first time periods, and detecting port scanning by one of the nodes not on the whitelist is performed in the second time period.

[0028] In further embodiments, each of the predefined time periods has substantially the same duration. In supplemental embodiments, initiating the preventative action includes generating an alert for the given source node in the detected port scanning. In another embodiment, initiating the preventative action includes restricting access to the network by the given source node in the detected port scanning.

[0029] According to embodiments of the application, there is also provided an apparatus comprising a network interface device coupled to a data network comprising a plurality of nodes communicating via the network, and at least one processor configured to: identify, in data traffic communicated between the plurality of nodes via the network during a time span comprising a plurality of predefined time periods, a set of port scans, each of the port scans comprising access, by a given source node, to a plurality of communication ports on a given destination node in the data traffic during a given time period, and for each given source node in the identified port scans, compute an average number of destination nodes whose respective communication ports are accessed by the given source node during any given port scan of the given source node, and compute a ratio for the time period during which the given source node accesses at least one of the destination nodes in at least one of the port scans performed by the given source node. The processor is further configured to aggregate a whitelist of source nodes for which one or more of the following conditions is found to apply: the average number of destination nodes accessed in the identified port scans is greater than a first threshold; and the ratio for the time period during which at least one of the destination nodes is accessed in at least one of the port scans is greater than a second threshold. The processor is further configured to initiate a preventive action upon detection of a port scan by one of the nodes not on the whitelist.

[0030] In some embodiments, the given processor is configured to identify the port scans by:

[0031] identifying, in the data traffic, a set of the source node and destination node pairs, each pair consisting of a given source node and a given destination node and one or more of the communication ports accessed in the data traffic between the source and destination nodes in each pair,

[0032] for each pair in the set, computing a respective baseline level indicative of a first number of communication ports accessed on the given destination node by source nodes other than the given source node in the pair during a first time period,

[0033] for each pair in the set, computing a respective test score indicative of a difference between a second number of communication ports accessed on the given destination node by the given source node in the pair during a second time period and the baseline level, and

[0034] designating as the port scans any pairs in which the test score for the pair is greater than a specified level.

[0035] In some embodiments, the average number of destination nodes comprises an average number of destination nodes accessed by the given source node during each of the time periods in which the given source node accessed at least one of the communication ports.

[0036] In some embodiments, the plurality of time periods comprises a set of first time periods and a second time period after the first time periods, wherein the steps of calculating the average value function and aggregating the whitelist are performed on the port scans identified in the first time periods, and wherein the given processor is configured to detect that the port scan by one of the nodes not on the whitelist is performed in the second time period.

[0037] In some embodiments, each of the predefined time periods has substantially the same duration.

[0038] In some embodiments, the given processor is configured to initiate the preventive action by generating an alert for the given source node in the detected port scan.

[0039] In some embodiments, wherein the given processor is configured to initiate the preventive action by limiting access of the given source node in the detected port scan to the network.

[0040] According to an embodiment of the invention, there is additionally provided a computer software product comprising a non-transitory computer-readable medium having stored therein program instructions that, when read by a computer, cause the computer to: identify, in data traffic transmitted between a plurality of nodes communicating over a network during a time span comprising a plurality of predefined time periods, a set of port scans, each of the port scans comprising accesses, by a given source node, to a plurality of communication ports on a given destination node in the data traffic during a given time period; and for each given source node in the identified port scans, compute an average number of destination nodes whose respective communication ports are accessed by the given source node during any given port scan of the given source node, and compute a ratio of the time period during which the given source node accessed at least one of the destination nodes in at least one of the port scans performed by the given source node. The computer software product is further configured to aggregate a whitelist of source nodes for which one or more of the following conditions is found to apply: the average number of destination nodes accessed in the identified port scans is greater than a first threshold; and the ratio of the time period during which at least one of the destination nodes is accessed in at least one of the port scans is greater than a second threshold. The computer software product is further configured to initiate a preventive action upon detection of a port scan by one of the nodes that is not on the whitelist.

[0041] According to an embodiment of the invention, there is additionally provided a computer software product comprising a non-transitory computer-readable medium having stored therein program instructions that, when read by a computer, cause the computer to: identify, in data traffic transmitted between a plurality of nodes communicating over a network during a time span comprising a plurality of predefined time periods, a set of port scans, each of the port scans comprising accesses, by a given source node, to a plurality of communication ports on a given destination node in the data traffic during a given time period; and for each given source node in the identified port scans, compute an average number of destination nodes whose respective communication ports are accessed by the given source node during any given port scan of the given source node, and compute a ratio of the time period during which the given source node accessed at least one of the destination nodes in at least one of the port scans performed by the given source node. The computer software product is further configured to aggregate a whitelist of source nodes for which one or more of the following conditions is found to apply: the average number of destination nodes accessed in the identified port scans is greater than a first threshold; and the ratio of the time period during which at least one of the destination nodes is accessed in at least one of the port scans is greater than a second threshold. The computer software product is further configured to initiate a preventive action upon detection of a port scan by one of the nodes that is not on the whitelist.

[0042] In one embodiment, identifying the port scan includes: identifying, in the data traffic, a set of source node and destination node pairs, each pair consisting of a given source node and a given destination node and one or more of the communication ports visited in the data traffic between the source node and the destination node in each pair; for each pair in the set, computing a respective baseline level indicating a first number of the communication ports visited on the given destination node by source nodes other than the given source node in the pair during a first time period; for each pair in the set, computing a respective test score indicating a difference between a second number of the communication ports visited on the given destination node by the given source node in the pair during a second time period and the baseline level; and designating as the port scan any pair in the pairs for which the test score is greater than a specified level.

[0043] In some embodiments, detecting access to at least one of the communication ports in the first set includes detecting access to at least a specified number of the communication ports in the first set, where the specified number is greater than one. In additional embodiments, the at least one of the communication ports in the first set and the at least one of the communication ports in the second set includes at least a specified number of the communication ports in each of the first set and the second set, where the specified number is greater than one.

[0044] In a first embodiment, the given software category includes an operating system. In a second embodiment, the given software category includes a database server. In a third embodiment, the given software category includes an email server. In a fourth embodiment, the given software category includes a remote session application.

[0045] In further embodiments, initiating the preventative action includes generating an alert for the given source node in the detected port scan. In supplemental embodiments, initiating the preventative action includes restricting access to the network by the given source node in the detected port scan.

[0046] According to embodiments of the invention, there is also provided an apparatus comprising a network interface device coupled to a data network, the data network comprising a plurality of nodes communicating via a network, and at least one processor configured to: for a given software category, define respective disjoint sets of communication ports used by each of a plurality of software systems in the given software category, the disjoint sets comprising at least a first disjoint set and a second disjoint set; identify a set of port scans in data traffic transmitted between the plurality of nodes communicating via the network, each of the port scans comprising accesses to a plurality of communication ports on a given destination node by a given source node in the data traffic during a predefined time period; and initiate a preventive action upon detecting a port scan by one of the nodes comprising accesses to at least one of the communication ports in the first set and at least one of the communication ports in the second set.

[0047] In some embodiments, the given processor is configured to identify the port scans by:

[0048] identifying a set of pairs of the source nodes and the destination nodes in the data traffic, each pair consisting of a given source node and a given destination node and one or more of the communication ports accessed in the data traffic between the source and destination nodes in each pair,

[0049] for each pair in the set, computing a respective baseline level indicating a first number of communication ports accessed on the given destination node by source nodes other than the given source node in the pair during a first time period,

[0050] for each pair in the set, computing a respective test score indicating a difference between a second number of communication ports accessed on the given destination node by the given source node in the pair during a second time period and the baseline level, and

[0051] designating as the port scans any pairs in which the test score for the pair is greater than a specified level.

[0052] In some embodiments, the given processor is configured to detect the accesses to at least one of the communication ports in the first set by detecting accesses to at least a specified number of the communication ports in the first set, wherein the specified number is greater than one.

[0053] In some embodiments, at least one of the communication ports in the first set and at least one of the communication ports in the second set comprises at least a specified number of communication ports in each of the first set and the second set, wherein the specified number is greater than one.

[0054] In some embodiments, the given software category comprises an operating system.

[0055] In some embodiments, the given software category comprises a database server.

[0056] In some embodiments, the given software category comprises an email server.

[0057] In some embodiments, the given software category comprises a remote session application.

[0058] In some embodiments, the given processor is configured to initiate the preventive action by generating an alert for the given source node in the detected port scan.

[0059] In some embodiments, the given processor is configured to initiate the preventive action by limiting access of the given source node in the detected port scan to the network.

[0060] According to embodiments of the present invention, there is additionally provided a computer software product, the product comprising a non-transitory computer readable medium having stored therein program instructions that, when read by a computer, cause the computer to: for a given software category, define respective disjoint sets of communication ports used by each of a plurality of software systems in the given software category, the disjoint sets comprising at least a first disjoint set and a second disjoint set; identify a set of port scans in data traffic transmitted between a plurality of nodes communicating over a network, each of the port scans comprising access by a given source node to a plurality of communication ports on a given destination node in the data traffic during a predefined time period; and initiate a preventive action upon detecting a port scan by one of the nodes comprising access to at least one of the communication ports in the first set and at least one of the communication ports in the second set.

[0061] According to embodiments of the present invention, there is further provided a method comprising identifying a set of port scans in data traffic communicated between a plurality of nodes communicating over a network, each of the port scans comprising accesses to a plurality of communication ports on a given destination node by a given source node in the data traffic during a predefined time period; computing, for communication ports accessed in the identified port scans, a respective first probability of being accessed during any given port scan; computing, for each pair of communication ports in the identified port scans, a respective second probability of both communication ports in the pair being accessed during any given port scan; and initiating a preventive action when a port scan comprising accesses to a first communication port and a second communication port on the given destination node by one of the nodes is detected, for which the respective second probability with respect to the first communication port and the second communication port in the pair is below a threshold value dependent on the respective first probabilities of the first communication port and the second communication port.

[0062] In one embodiment, identifying the port scans comprises identifying a set of source node and destination node pairs in the data traffic, each pair consisting of a given source node and a given destination node and one or more of the communication ports accessed in the data traffic between the source node and the destination node in each pair; computing, for each pair in the set, a respective communication level indicative of a first number of communication ports accessed on the given destination node by source nodes other than the given source node in the pair during a first time period; computing, for each pair in the set, a respective test score indicative of a difference between a second number of communication ports accessed on the given destination node by the given source node in the pair during a second time period and a baseline level; and designating as a port scan any pair in the pairs for which the test score is greater than a specified level.

[0063] In some embodiments, the specified time period comprises a plurality of sub-periods, the plurality of sub-periods comprising a set of first sub-periods and a second sub-period following the first sub-periods, the steps of identifying a group of high-traffic ports and generating a whitelist are performed on the port scans in the first sub-periods, and the detected port scan on one of the nodes is performed in the second sub-period. In additional embodiments, each of the sub-periods has substantially the same duration.

[0064] In further embodiments, initiating the preventive action comprises generating an alert for the given source node in the detected port scan. In supplemental embodiments, initiating the preventive action comprises restricting access to the network by the given source node in the detected port scan.

[0065] According to an embodiment of the application, there is also provided an apparatus comprising a network interface device coupled to a data network comprising a plurality of nodes communicating via the network, and at least one processor configured to: identify a set of port scans in data traffic transmitted between the plurality of nodes communicating via the network, each of the port scans comprising accesses to a plurality of communication ports on a given destination node by a given source node in the data traffic during a predefined time period; for communication ports accessed in the identified port scans, compute a respective first probability of being accessed during any given port scan; for each pair of communication ports in the identified port scans, compute a respective second probability of both communication ports in the pair being accessed during any given port scan; and initiate a preventive action when a port scan comprising accesses to a first communication port and a second communication port on the given destination node by one of the nodes is detected, for which the respective second probability with respect to the first communication port and the second communication port in the pair is below a threshold value depending on the respective first probabilities of the first communication port and the second communication port.

[0066] In some embodiments, the given processor is configured to identify the port scans by:

[0067] identifying a set of the source node and destination node pairs in the data traffic, each pair consisting of a given source node and a given destination node and one or more of the communication ports accessed in the data traffic between the source node and the destination node in each pair,

[0068] for each pair in the set, computing a respective communication level indicating a first number of communication ports accessed on the given destination node by source nodes other than the given source node in the pair during a first time period,

[0069] for each pair in the set, computing a respective test score indicating a difference between a second number of communication ports accessed on the given destination node by the given source node in the pair during a second time period and the baseline level, and

[0070] designating any pair in which the test score is greater than a specified level as the port scans.

[0071] In some embodiments, the specified time period comprises a plurality of sub-periods, the plurality of sub-periods comprising a set of first sub-periods and a second sub-period following the first sub-periods, wherein the steps of identifying a group of high traffic ports and generating a whitelist are performed on port scans in the first sub-periods, and wherein the given processor is configured to detect that a port scan on one of the nodes is performed in the second sub-period.

[0072] In some embodiments, each of the sub-periods has substantially the same duration.

[0073] In some embodiments, the given processor is configured to initiate the preventive action by generating an alert for the given source node in the detected port scan.

[0074] In some embodiments, the given processor is configured to initiate the preventive action by limiting access of the given source node in the detected port scan to the network.

[0075] According to embodiments of the application, there is additionally provided a computer software product comprising a non-transitory computer readable medium having stored therein program instructions that, when read by a computer, cause the computer to: identify a set of port scans in data traffic transmitted between a plurality of nodes communicating over a network, each of the port scans comprising access by a given source node to a plurality of communication ports on a given destination node in the data traffic during a predefined time period; for communication ports accessed in the identified port scans, compute a respective first probability of being accessed during any given port scan; for each pair of communication ports in the identified port scans, compute a respective second probability of both communication ports in the pair being accessed during any given port scan; and initiate a preventive action when a port scan comprising access to a first communication port and a second communication port on the given destination node by one of the nodes is detected, for which the respective second probability with respect to the first communication port and the second communication port in the pair is below a threshold value that depends on the respective first probabilities of the first communication port and the second communication port.

[0076] According to embodiments of the present invention, there is further provided a method comprising: identifying a set of port scans in data traffic communicated between a plurality of nodes communicating over a network, each of the port scans comprising access by a given source node in the data traffic to a plurality of communication ports on a given destination node during a predefined time period; identifying a group of high volume ports in the data traffic, the high volume ports comprising one or more of the communication ports that receive data traffic in excess of a predefined threshold volume; for the identified port scans, generating respective signatures indicative of the communication ports in each of the port scans that are accessed other than the high volume ports; calculating respective frequencies of occurrence of each of the signatures over the set of port scans; aggregating a whitelist of the signatures having respective frequencies of occurrence greater than a predefined threshold; and initiating a preventive action upon detecting a port scan having a respective signature not on the whitelist.

[0077] In one embodiment, identifying the port scans comprises identifying a set of source node and destination node pairs in the data traffic, each pair consisting of a given source node and a given destination node and one or more of the communication ports accessed in the data traffic between the source node and the destination node in each pair; for each pair in the set, calculating a respective baseline level indicative of a first number of the communication ports accessed on the given destination node by source nodes other than the given source node in the pair during a first time period; for each pair in the set, calculating a respective test score indicative of a difference between a second number of the communication ports accessed on the given destination node by the given source node in the pair during a second time period and the baseline level; and designating any pair in the pairs having a test score greater than a specified level as a port scan.

[0078] In some embodiments, the specified time period comprises a plurality of sub-periods, the sub-periods comprising a set of first sub-periods and second sub-periods following the first sub-periods, the steps of calculating the first probability and the second probability are performed on the port scans in the first sub-periods, and the detecting the port scans on one of the nodes is performed in the second sub-periods. In additional embodiments, each of the sub-periods has substantially the same duration.

[0079] In additional embodiments, calculating respective frequencies of occurrence of each of the signatures over the set of port scans comprises, for each given unique signature, determining a count of scans matching the given unique signature, and the whitelist comprises unique signatures having respective counts of matching scans greater than a specified number.

[0080] In further embodiments, computing the respective frequency of occurrence of each of the signatures on the set of port scans includes, for each given unique signature, determining a count of unique source nodes in scans that match the given unique signature, and the whitelist includes unique signatures for which one or more of the following conditions is found to apply: the count of unique source nodes is greater than a first value, and the count of unique source nodes is less than a second value.

[0081] In supplemental embodiments, computing the respective frequency of occurrence of each of the signatures on the set of port scans includes, for each given unique signature, determining a count of unique destination nodes in scans that match the given unique signature, and the whitelist includes unique signatures for which one or more of the following conditions is found to apply: the count of unique destination nodes is greater than a first value, and the count of unique destination nodes is less than a second value.

[0082] In some embodiments, the high-traffic port is associated with a given destination node. In another embodiment, initiating the preventive action includes generating an alert for the given source node in the detected port scan. In additional embodiments, initiating the preventive action includes limiting access to the network for the given source node in the detected port scan.

[0083] According to embodiments of the invention, there is also provided an apparatus comprising a network interface device coupled to a data network, the data network comprising a plurality of nodes that communicate via a network, and at least one processor configured to: identify a set of port scans in data traffic transmitted between the plurality of nodes that communicate via the network, each of the port scans comprising access by a given source node to a plurality of communication ports on a given destination node in the data traffic during a predefined time period; identify a group of high-traffic ports in the data traffic, the high-traffic ports comprising one or more of the communication ports that receive data traffic that exceeds a respective capacity of the communication port by a predefined threshold; for the identified port scans, generate respective signatures that indicate communication ports other than the high-traffic ports that are accessed in each of the port scans; compute a respective frequency of occurrence of each of the signatures on the set of port scans; aggregate a whitelist of signatures for which the respective frequency of occurrence is greater than a predefined threshold; and initiate a preventive action upon detecting a port scan for which a respective signature is not on the whitelist.

[0084] In some embodiments, the given processor is configured to identify the port scans by:

[0085] identifying, in the data traffic, a set of pairs of the source nodes and the destination nodes, each pair consisting of a given source node and a given destination node and one or more of the communication ports visited in the data traffic between the source and destination nodes in each pair,

[0086] for each pair in the set, computing a respective baseline level indicating a first number of the communication ports visited on the given destination node by source nodes other than the given source node in the pair during a first time period,

[0087] for each pair in the set, computing a respective test score indicating a difference between a second number of the communication ports visited on the given destination node by the given source node in the pair during a second time period and the baseline level, and

[0088] designating as the port scans any of the pairs in which the test score is greater than a specified level.

[0089] In some embodiments, the specified time period comprises a plurality of sub-periods, the plurality of sub-periods comprising a set of first sub-periods and a second sub-period following the first sub-periods, wherein the steps of computing the first probability and the second probability are performed on port scans in the first sub-periods, and wherein the given processor is configured to detect that a port scan on one of the nodes is performed in the second sub-period.

[0090] In some embodiments, each of the sub-periods has substantially the same duration.

[0091] In some embodiments, the given processor is configured to compute a respective frequency of occurrence of each of the signatures on the set of port scans by, for each given unique signature, determining a count of scans matching the given unique signature, and wherein the whitelist comprises unique signatures for which the respective count of matching scans is greater than a specified number.

[0092] In some embodiments, the given processor is configured to compute a respective frequency of occurrence of each of the signatures on the set of port scans by, for each given unique signature, determining a count of unique source nodes in scans matching the given unique signature, and wherein the whitelist comprises unique signatures for which one or more of the following conditions is found to apply:

[0093] the count of unique source nodes is greater than a first value, and

[0094] the count of unique source nodes is less than a second value.

[0095] In some embodiments, the given processor is configured to compute a respective frequency of occurrence of each of the signatures on the set of port scans by, for each given unique signature, determining a count of unique destination nodes in scans that match the given unique signature, and wherein the whitelist comprises unique signatures for which one or more of the following conditions is found to apply:

[0096] the count of unique destination nodes is greater than a first value; and

[0097] the count of unique destination nodes is less than a second value.

[0098] In some embodiments, the high-traffic port is associated with a given destination node.

[0099] In some embodiments, the given processor is configured to initiate the preventative action by generating an alert for the given source node in the detected port scans.

[0100] In some embodiments, wherein the given processor is configured to initiate the preventative action by limiting access of the given source node in the detected port scans to the network.

[0101] According to embodiments of the present invention, there is additionally provided a computer software product, the product comprising a non-transitory computer readable medium having stored therein program instructions that, when read by a computer, cause the computer to: identify a set of port scans in data traffic transmitted between a plurality of nodes that communicate over a network, each of the port scans comprising access by a given source node to a plurality of communication ports on a given destination node in the data traffic during a predefined time period; identify a group of high-traffic ports in the data traffic, the high-traffic ports comprising one or more of the communication ports that receive data traffic that exceeds a respective capacity of the communication port by more than a predefined threshold; for the identified port scans, generate a respective signature that indicates the communication ports in each of the port scans that are accessed other than the high-traffic ports; compute a respective frequency of occurrence of each of the signatures on the set of port scans; aggregate a whitelist of signatures for which the respective frequency of occurrence is greater than a predefined threshold; and initiate a preventative action upon detecting a port scan for which the respective signature is not on the whitelist. SUMMARY

[0102] The present disclosure is described herein, by way of example only, with reference to the accompanying drawings, in which:

[0103] Figure 1 is a block diagram schematically illustrating a computing facility comprising a system configured to detect port scans suspected to be malicious, according to embodiments of the present invention;

[0104] Figure 2 is a flowchart schematically illustrating a method of identifying suspicious port scanning in data packets transmitted from source nodes to destination nodes over a network, according to an embodiment of the present application;

[0105] Figure 3 is a flowchart schematically illustrating a method of generating a profile score of a destination that can be used for detecting port scanning, according to an embodiment of the present application;

[0106] Figure 4 is a flowchart schematically illustrating a method of generating a source profile that can be used for detecting aggressive and periodic scanners and whitelisting them, according to an embodiment of the present application;

[0107] Figure 5 is a flowchart schematically illustrating a method of identifying malicious port scanning comprising port scanning of different software systems in a single category, according to an embodiment of the present application;

[0108] Figure 6 is a flowchart schematically illustrating a method of identifying malicious port scanning comprising anomalous pairs of scanned ports, according to an embodiment of the present application; and

[0109] Figure 7 is a flowchart schematically illustrating a method of identifying scanner probes and whitelisting them, according to an embodiment of the present application. DETAILED DESCRIPTION

[0110] SUMMARY

[0111] Embodiments of the present application provide methods and systems for identifying port scanning on a data network. As described below, in monitoring data traffic transmitted between a plurality of nodes communicating over a network, a set of source node and destination node pairs is identified, each pair consisting of a given source node and a given destination node and one or more communication ports accessed in the data traffic between the source node and the destination node in each pair. For each pair in the set, a respective baseline level is computed and a respective test score is computed. The respective baseline level for each pair in the set indicates a first number of communication ports accessed at the given destination node by source nodes other than the given source node in the pair during a first time period, and the respective test score indicates a difference between a second number of communication ports accessed at the given destination node by the given source node in the pair during a second time period and the baseline level. A preventive action can be initiated for the given source node in any pair in which the test score for the pair is greater than a specified level.

[0112] Embodiments of the present invention also provide methods and systems for detecting whether any of the identified port scans include anomalous port combinations that can indicate a malicious port scan. Examples of anomalous port combinations include, but are not limited to, port pairs and port groups. As described below, the analysis to detect suspicious port scans can be based on a source profile, a port profile, a port pair profile, and a scanner probe profile.

[0113] System Description

[0114] Figure 1 is a block diagram schematically illustrating a computing facility 20 including a malicious port scan detection system 22 that collects and monitors data packets 24 transmitted between a plurality of nodes 26 coupled to a data network 28 in order to identify malicious port scans, in accordance with embodiments of the present invention. In the embodiments described herein, each node 26 includes any type of device (i.e., physical or virtual) configured to communicate over a network and has an IP address assigned for that purpose. In the embodiments described herein, the data packets 24 are transmitted between the nodes 26 via the network 28. Figure 1 The example shown in FIG. 1 includes nodes comprising workstations 26 and a public network 30, such as the Internet. As described below, embodiments of the present invention aggregate data packets into communication sessions, identify any of the communication sessions that include port scans 32, and generate alerts for any of the port scans suspected to be malicious.

[0115] While the example shown in FIG. 1 illustrates nodes comprising workstations 26, nodes 26 comprising other types of devices that communicate over the network 28 and the Internet 30 are considered to be within the spirit and scope of the present invention. For example, the nodes can include devices such as servers, wireless devices such as smart phones, routers, and network switches. Figure 1

[0116] Each workstation 26 can include, for example, a workstation identifier (ID) 34, a workstation processor 36, a workstation memory 38 that stores a plurality of communication ports 40 (also referred to herein simply as ports). Unlike physical ports, the ports 40 are logical entities defined by a communication protocol such as TCP / IP.

[0117] ​Examples of workstation IDs 34 include, but are not limited to, media access control (MAC) addresses and Internet Protocol (IP) addresses that can be used to uniquely identify each of the workstations. While each given workstation 26 is assigned a unique IP address at any given time, a given workstation can be associated with multiple IP addresses over an extended period of time. For example, the IP address of a given workstation 26 can change after the given workstation is rebooted. Typically, in operation, the processor 36 executes an operating system 42 (e.g., Linux) and one or more software applications 44 (e.g., a database server) from the memory 38.

[0118] In the configuration shown in Figure 1 the memory 38 also stores a white list 80 that stores identifiers for one or more workstations 26. As described below with reference to the description of Figure 4 and Figure 7 Embodiments of the present application can ignore any suspicious port scans 32 initiated by any workstations 26 in the white list.

[0119] The workstations 26 communicate over a data network 28 (e.g., a local area network) that is also coupled to an Internet gateway 46. The gateway 46 couples the computing facility 20 to a public network 30 such as the Internet, and includes communication circuitry (not shown) that enables communication between the workstations 26 and sites / computers (not shown) on the Internet.

[0120] In some embodiments, the malicious port scan detection system 22 includes a system processor 48 and a system memory 50 that are coupled to a network interface controller (NIC) 52 that couples the computer system to the network 28 by a system bus (not shown). In some embodiments, the malicious port scan detection system 22 can include a user interface (UI) device 54 (e.g., an LED display) or another type of output interface.

[0121] In the configuration shown in Figure 1 the malicious port scan detection system 22 includes a probe 56 that collects information about the data packets 24 transmitted over the network 28. While Figure 1 the example in shows the probe 56 as a module of the malicious port scan detection system 22, the probe can be implemented as a standalone device coupled to the network 28 or as a module in another device coupled to the network. The probe 56 optionally collects data packets 24 from the network 28 and processes the collected data packets to extract information using any of the methods described in U.S. Patent Application 2014 / 0165207 to Engel et al. and U.S. Patent Application 2015 / 035834 to Mumcuoglu et al., the disclosures of which are incorporated herein by reference.

[0122] Memory 50 stores a respective plurality of communication sessions 68, aggregated communication sessions 58, and port lists 60. In the embodiments described herein, processor 48 is configured to collect data packets from probes 56, group the data packets into communication sessions 68, aggregate the communication sessions into aggregated communication sessions 58, and identify any of the aggregated communication sessions that are indicative of a given port scan 32. The use of port lists 60, which store a respective plurality of ports 40 (i.e., port numbers), is described below in reference to the description of Figure 5 .

[0123] In the configuration shown in Figure 1 , memory 50 also stores a whitelist 80, which stores identifiers for one or more workstations 26. As described below in reference to the description of Figure 4 and Figure 7 , embodiments of the present application can ignore any suspicious port scans 32 initiated by any of the workstations 26 in the whitelist.

[0124] Each communication session 68 optionally includes a source node identifier 64, a destination port identifier 66, a time 84, a source port identifier 70, a destination port identifier 72, a protocol 74, a status 76, a volume 88 (source to destination), a reverse volume 78 (also referred to as rvolume, destination to source), and a time 84. Each aggregated communication session 58 optionally includes a port scan time period 62, a subset of communication sessions 86, and a signature 82.

[0125] In each given communication session 68, source node 64 stores an identifier of a first given workstation 26, destination node 66 stores an identifier of a second given workstation 26, source port 70 refers to a given port 40 on the first given workstation that was used to communicate with the second given workstation during the given communication session, destination port 72 refers to a given port 40 on the second given workstation that was being accessed during the given communication session, protocol 74 refers to a given communication protocol (e.g., NFS, SSH, KERBEROS, LDAP) that was used by the given communication session, status 76 indicates whether the given communication session was successfully completed, volume 88 indicates an amount of data that was transmitted from the first given workstation to the second given workstation during the given communication session, and reverse volume 78 indicates an amount of data that was transmitted from the second given workstation to the first given workstation during the given communication session.

[0126] In embodiments described herein, source node 64 can be used to refer to a first given workstation, and destination node 66 can be used to refer to a second given workstation. In embodiments in which the workstations communicate using TCP / IP, the processor can identify the source port and the destination port for a given communication session 68 based on information stored in a given data packet 24 that stores a TCP header.

[0127] For each aggregated communication session 58, the port scan time period 62 comprises a specified time period (e.g., a particular number of hours or days), and the subset 86 refers to a plurality of communication sessions 68. Signatures 82 are described below in the description of Figure 7

[0128] In some embodiments, the tasks of collecting data packets, grouping data packets into communication sessions, aggregating communication sessions, and identifying aggregated communication sessions that include port scans 32 can be split among multiple devices within the computing facility 20 (e.g., workstations 26) or outside the computing facility (e.g., a data cloud-based application). In some embodiments, some or all of the functionality of the workstations 26 and / or the malicious port scan detection system 22 can be deployed as virtual machines in the computing facility 20.

[0129] Examples of the memories 38 and 50 include dynamic random access memory and nonvolatile random access memory. In some embodiments, the memories can include nonvolatile storage devices such as hard disk drives and solid state disk drives.

[0130] The processors 36 and 48 include general-purpose central processing units (CPUs) or special-purpose embedded processors that are programmed in software or firmware to perform the functions described herein. For example, the software can be downloaded to the computers 22 and 26 in electronic form over a network. Additionally or alternatively, the software can be stored on a tangible, non-transitory computer-readable medium, such as optical, magnetic, or electronic memory. Further additionally or alternatively, at least some of the functionality of the processors 36 and 48 can be performed by hardwired or programmable digital logic circuits.

[0131] Port scan collection

[0132] Figure 2 is a flowchart schematically illustrating a method for identifying suspicious port scans 32 on the network 28 according to embodiments of the present application. In embodiments described herein, a suspicious port scan includes a source workstation 26 that accesses an abnormal combination of communication ports 40 on a destination workstation 26 within a predefined time period.

[0133] ​In step 90, the processor 48 uses the probe 56 to collect data packets 24 transmitted between the nodes 26 on the network 28 during a time period comprising a plurality of sub-periods. For example, the time period can comprise seven consecutive days (i.e., a week), and each sub-period can comprise any 24-hour period (e.g., a day) during the week.

[0134] In step 92, the processor 48 groups and stores the collected data packets as individual communication sessions 68 between pairs of source and destination nodes 26. A communication session generally comprises a sequence of data packets 24 transmitted by a first given workstation 26 to a given port 40 on a second given workstation 26. Upon detecting a given sequence of data packets, the processor 48 defines a new communication session 68 and stores in the new communication session 68 by storing an identifier for the first given workstation to the source node 64, an identifier for the second given workstation to the destination node 66, the date and time at which the given sequence of data packets was collected to the time 84, the port number for the first given workstation in the TCP header to the source port 70, the port for the second given workstation in the TCP header to the destination port 72, the communication protocol used by the sequence of data packets to the protocol 74, the status of the communication session (e.g., success / failure) to the status 76, and the first amount of data (e.g., 600 bytes) transmitted by the first given workstation to the second given workstation in the sequence of data packets to the volume 88.

[0135] In some cases, the sequence of data packets can also include a second amount of data (e.g., 200 bytes) transmitted by the second given workstation to the first given workstation. The processor 48 can store the second amount of data to the reverse volume 78.

[0136] In some embodiments, the processor 48 can group the packets according to the IP addresses (not shown) in the packets, such that the system processor can group packets 24 having the same source and destination addresses or having the same source address, source port, destination address, destination port, and protocol together. In alternative embodiments, the processor 48 can manage a table (not shown) correlating addresses in the packets and respective IDs 34 of the nodes 26, e.g., as described in U.S. Patent Application 2016 / 0234167, which is incorporated by reference herein, and group the packets together according to the IDs corresponding to the addresses in the packets. An example of grouping the collected data packets 68 is described in U.S. Patent Application 15 / 950,234, filed April 11, 2018, which is incorporated by reference herein.

[0137] In step 94, the processor 48 aggregates the communication sessions into a plurality of aggregated communication sessions 58 such that each of the aggregated communication sessions includes data from the communication sessions of each unique source node and destination node pair that communicated with each other during a given sub-period. In embodiments of the application, each sub-period generally includes a predefined period of time (e.g., one hour, two hours, or 24 hours).

[0138] When aggregating the communication sessions 68, the processor 48 can identify and flag any of the communication sessions that are failed communication sessions to a given port 40. In embodiments herein, these flagged communication sessions can be referred to as failed connections. A communication session to a given port 40 can be flagged as a failed connection if no response is received from the given port or if a response is received indicating that the given port is closed. Failed connections are generally a result of an error configuration of a given node 26 and can identify a given port 40 as a failed port by detecting that the given port on the given node does not successfully connect. For example, if a given node 26 includes an email server that is configured with an incorrect IP address, other nodes 26 on the network will generate failed connections when they attempt to access the incorrect destination port on the email server.

[0139] In the TCP / IP communication model, a successful communication session includes (a) a given source node 64 transmitting a "SYN" command to a given destination node 66, (b) the given destination node transmitting a "SYN-ACK" command to the given source node in response to receiving the "SYN" command, and (c) the given source node transmitting an "ACK" command to the given destination node in response to receiving the "SYN-ACK" command. In embodiments of the application, the processor 48 can identify a failed connection by detecting that a given communication session 68 is missing the "SYN-ACK" command transmitted from the given destination node 66 to the given source node 64 and / or missing the "ACK" command transmitted from the given source node to the given destination node.

[0140] In embodiments of the application, the processor 48 can use the failed connection information to determine whether any of the aggregated communication sessions includes any port scanning. For example, if all of the communication sessions in a given aggregated communication session 58 are successful (i.e., the "SYN", "SYN-ACK", and "ACK" commands are successfully transmitted), there is a low likelihood that the given aggregated communication session includes port scanning. However, if all of the connections in a given aggregated communication session include failed connections on different ports 40 (as detected using the embodiments described above), there is a high likelihood that the given aggregated communication session includes port scanning.

[0141] In step 96, processor 48 "cleans" the data in the port scan record to retain data relevant to the analysis. In one embodiment, processor 48 can clean the data by filtering out any communication session that includes a port scan with source port 70 and protocol 74 that is known to have activity in multiple destination ports 72. For example, based on parameters provided by the system manager, processor 48 can filter out any of the port scans with a protocol of NFS and a source port number of "829," "2049," or "20048." In another embodiment, given port list 60 can include a set of ports 40 used by services available on network 28, and processor 48 can filter out any scans to ports 40 in the given port list.

[0142] In step 98, processor 48 identifies one or more aggregated port communication sessions 58 that include respective port scans 32. In some embodiments, as described below in the description of FIG. 4, processor 48 can use a destination profile to identify a given port scan. Figure 3

[0143] In step 100, in response to identifying a port scan in step 88, processor 48 can initiate a first preventative action for each identified source node in the identified port scan 32. In one embodiment, processor 48 can initiate the first preventative action by presenting an alert message on user interface device 54 indicating that the identified source node is performing a suspicious port scan. In another embodiment, processor 48 can initiate the first preventative action by restricting the identified source node's access to network 28 (e.g., by transmitting an instruction to a network switch or firewall that couples the identified source node to network 28).

[0144] In additional embodiments, processor 48 can initiate the first preventative action by transmitting an identifier of the given source node to an alert management system (not shown), such as a security information and event management (SIEM) system. In further embodiments, processor 8 can generate an alert by storing an identifier of the given source node to a data structure (not shown) that the alert management system (e.g., SIEM system) can extract via an API (not shown).

[0145] In one variation of the embodiments described above, processor 48 can identify a user of the source node in the identified port scan (e.g., via login credentials), and initiate the preventative action for the given user. In another variation of the embodiments described above, processor 48 can identify a software process that accessed the ports in the identified port scan on the source node in the identified port scan, and initiate the preventative action for the software process.

[0146] ​In step 102, processor 48 identifies a given identified port scan that includes a given source node 64 that scans an abnormal combination of destination ports 72 on a given destination node 66 during a time period (i.e., a test period). Different embodiments for detecting abnormal combinations are described below with reference to the respective descriptions of Figures 4-7 Port scans identified in step 90 can also be referred to herein as suspicious port scans.

[0147] Finally in step 104, in response to identifying an abnormal port scan in step 102, processor 48 can initiate a second preventative action for the source node in the abnormal port scan, and the method ends. Examples of preventative actions are described above.

[0148] Destination profile

[0149] In embodiments of the application, processor 48 can use a destination profile to detect port scans 32. As described below, processor 48 can generate a destination profile for each given destination node 66 based on data packets 24 collected during a specified time period that indicates a typical number of ports 40 (i.e., destination ports 72) scanned on the given destination node, and processor 48 uses the destination profile to detect any subsequently collected abnormal port scans.

[0150] Figure 3 is a flowchart schematically illustrating a method for calculating a destination profile score and using the calculated score to identify port scans 32 according to embodiments of the application. In step 110, processor 48 identifies a set of port scans using embodiments described above with reference to the description of Figure 2 To identify the set of port scans, processor 48 collects communication sessions 68 and aggregates them into aggregated communication sessions 58. Each aggregated communication session 58 includes a given port scan 32 that causes a first given workstation 26 to access at least one given communication port 40 on a second given destination 26.

[0151] Processor 48 collects communication sessions during a plurality of time periods including a training period (also referred to herein as a first time period) and a test period (also referred to herein as a second time period). The test and training periods can have substantially the same duration (e.g., within 10% of each other). For example, the test and training periods can include 24 hour periods. In some embodiments, the test period is after the training period. In additional embodiments, the training and test periods can partially or completely overlap (i.e., the same time period).

[0152] In step 112, the processor 48 identifies any of the source nodes in the aggregated communication session that are "noisy scanners." In embodiments of the application, a given source node 64 can be classified as a noisy scanner if it accesses (i.e., "scans") at least a first number (e.g., at least 20, at least 25, at least 30, at least 35, or at least 40) of destination ports 72 on at least a second number (e.g., 80, 90, 100, or 110) of destination nodes 66 during the training period. In some embodiments, the second number is greater than the first number. As described below, the processor 48 can ignore any source nodes 64 that the system processor classifies as noisy scanners.

[0153] In step 114, the processor 48 computes, for each pair of a given source node 64 and a given destination node 66 in the aggregated communication session, a baseline score (also referred to herein as a baseline level) indicative of a typical number of ports 40 that are still accessed by the first source nodes (i.e., not including the given source node, and in some embodiments, not including any of the source nodes identified as noisy scanners) on the given destination node during a given sub-period (e.g., a day) in the training period. In some embodiments, the processor 48 can compute the baseline score for each of the source node 66 and destination node 66 pairs (i,j) using the following formula:

[0154]

[0155] where

[0156] - the set of source nodes of destination node j in day d (i.e., the given sub-period), not including {i, noise scanners}.

[0157] - the number of different destination ports 72 between source node k and destination node j on day d.

[0158] D - the baseline day d in the training period.

[0159] In operation, the processor 48 can compute equation (1) for a single training period D or for a training period having multiple sub-periods D. In embodiments having a single period D, the training and test periods can have substantially the same duration, and in embodiments having multiple periods D, the sub-periods and the test period can have substantially the same duration.

[0160] In step 116, the processor 48 computes a destination profile score for each given pair of source node 64 and given destination node 66 in the second aggregated communication session, which can be used to identify any of the source nodes suspected of performing port scanning 32 based on the destination ports on which the source node visited during the training and testing periods. For example, the processor 48 can compute the following destination profile score for each pair (i, j) identified during the testing period:

[0161]

[0162] wherein includes the number of destination ports 72 visited by the source node i on the destination node j during the testing period. In embodiments of the application, a higher destination profile score for a given pair (i, j) indicates that the given source node i scanned a greater number of ports 40 on the given destination node j during the testing period than the given destination node on which the given source node scanned during the training period. A higher Score i,j indicates a higher probability that the source node i is performing a port scan on the destination node j.

[0163] Finally, in step 118, the processor 48 can identify a given pair of source node and destination node whose destination profile score exceeds a specified threshold (i.e., level) indicating a suspicious port scan, and the method ends. In one embodiment, the threshold can include a high score value for the score (e.g., 7, 8, 9, or 10). In another embodiment, the threshold can include a low score value (e.g., 4, 5, or 6), and a number of failed connections between the source node and the destination node during the testing period is greater than a low failed connection value (e.g., 0, 1, or 2).

[0164] Source profile generation

[0165] In a second anomalous port scanning detection embodiment, the processor 48 can use a source profile to detect potential malicious port scanning. As described below, the processor 48 can generate a source profile for each given source node 64 based on the port scanning 24 collected during a specified period of time, which indicates to the node whether the given source node is an aggressive scanner or a periodic scanner. In embodiments of the application, scans from aggressive and periodic scanners are not considered suspicious, and aggressive and periodic scanners can be whitelisted.

[0166] Computer networks such as network 28 often include workstations 26 that can perform processes that perform legitimate port scans or perform legitimate activities similar to port scans (i.e., with different intent). Since these services or activities sometimes originate from the same source nodes 64, embodiments of the present invention can generate and use source profiles to detect these source nodes in order to whitelist their legitimate port scanning activities.

[0167] Figure 4 is a flowchart schematically illustrating a method for computing source profiles and using the computed source profiles to detect any source nodes 64 that are offensive or periodic scanners and whitelist them, in accordance with embodiments of the present invention. In step 120, processor 48 identifies a set of port scans using embodiments described above with reference to Figure 2 In order to identify the set of port scans, processor 48 collects communication sessions 68 during a time span that includes a plurality of predefined time periods and aggregates them into aggregated communication sessions 58. Each aggregated communication session 58 includes a given port scan 32 that causes a first given workstation 26 to access at least one given communication port 40 on a second given destination 26 during a given time period. The predefined time periods can have substantially the same duration (e.g., one day).

[0168] In step 122, processor 48 computes scanned_dests_average i for each given source node "i" in the port scans, which indicates an average number of destination nodes 66 whose respective communication ports 40 were accessed by the given source node during any given scan by the given source node. In some embodiments, scanned_dests_average i includes the average number of destination nodes scanned by the given source node per time period, omitting time periods in which the given source node did not perform a scan.

[0169] In step 124, processor 48 computes scan_ratio for each given source node "i" in the port scans, which indicates a ratio of time periods D during which the given source node accessed at least one of the destination nodes in at least one of the port scans performed by the given source node.

[0170] In step 126, processor 48 whitelists a given source node "i" in the port scans based on the computed scanned_dests_average i average and scan_ratio iA ratio, scan_ratio, is calculated for each source node 64 as follows: scan_ratio = scan_days / scan_dests_average. Any source node in the source nodes that will be classified as an aggressive or periodic scanner is placed on a whitelist, as described in the criteria below. To whitelist a given source node 64, the processor 48 adds the given source node (i.e., the corresponding port number) to the whitelist 80.

[0171] In embodiments of the application, an aggressive scanner can be defined as a given source node 64 that scans several destination nodes 66 during each time period (e.g., each day). For example, an aggressive scanner can scan a database server and a web server (i.e., two different destination nodes) every hour to check their respective statuses. In some embodiments, for each given source node 64, the processor 48 can first identify scan_days i and if exceeds a first low threshold (e.g., 2, 3, 4, 5, 6, 7) and / or scan_ratio i exceeds a first high threshold (e.g., 0.5, 0.6, 0.7, 0.8), the given source node can be classified as an aggressive scanner.

[0172] For example, if the first low threshold is 3, the first high threshold is 0.5, and the daily number of destination nodes 66 scanned by the given source node 64 is [3, 0, 4, 4, 6, 3], the given source node is an aggressive scanner because scan_days i = 5, scanned_dests_average i = 4, and scan_ratio i = 0.833.

[0173] In embodiments of the application, a periodic scanner can be defined as a given source node 64 that scans many destinations at a lower frequency (e.g., once a week). For example, a periodic scanner can scan all nodes (e.g., workstations 26) on the network 28 every week to see if there are any changes, such as whether any new ports 40 are open or any corresponding vulnerabilities exist in the nodes. In a similar manner to detecting aggressive scanners, for each given source node 64, the processor 48 can first identify scan_days i and if exceeds a second high threshold (e.g., 10, 15, 20, 25, 30, 35) and / or scan_ratio i exceeds a second low threshold (e.g., 0.10, 0.15, 0.2, 0.25), the given source node can be classified as a periodic scanner.

[0174] For example, if the second high threshold is 30, the first and second low thresholds are 0.1, and the given source node 64 scans the destination nodes 66 with a daily quantity of [0, 0, 1314, 0, 0, 0], the given source node is a periodic scanner because scan_days i = 1, scanned_dests_average i = 1314, and scan_ratio i = 0.14.

[0175] In one embodiment, the processor 48 can receive input (e.g., from a system manager) specifying the first and second low thresholds and the first and second high thresholds. In another embodiment, the processor 48 can dynamically set these thresholds based on respective distributions of the computed values (i.e., scanned_dests_average i and scan_ratio i ). For example, the processor 48 can dynamically set the thresholds based on outliers (e.g., a fixed percentage) in the respective distributions of the computed values.

[0176] Returning to the flowchart, in step 126, the processor 48 identifies any of the source nodes in the port scan that are not in the whitelist 80 (i.e., identified in step 120), and the method ends.

[0177] In one embodiment, the processor 48 can perform step 128 during any given time period in order to identify a given non-whitelist source node that performed a port scan during the given time period. In another embodiment, the time period includes one or more first time periods followed by a second time period, and the processor 48 can perform steps 120-126 during the one or more first time periods and perform step 128 during the second time period.

[0178] Port profile

[0179] The embodiments described herein can use a port profile to detect potential malicious port scans. The port profile indicates which combinations of ports 40 are unlikely to be part of “normal” user activity and are instead part of a network scan. The concept behind the port profile is that if ports are scanned during a short period of time (e.g., a day), there are suspicious port combinations. For example, if a legitimate user wants to access a particular network service provided by a given workstation 26 on the network 28, the user typically knows what software application is providing the service and any ports 40 that the software application is using.

[0180] In the first port profile embodiment, the service (also referred to herein as a software category) comprises an operating system. For example, if a user wants to communicate with a given workstation running Windows® TM operating system (produced by Microsoft Corporation of Redmond, Washington), the user can use port number "3389," which is used for the Remote Desktop Protocol (RDP) service. However, if the user attempts to communicate with the given workstation via port number "22," this can be suspicious because port number "22" is typically used by the Secure Shell (SSH) service, which is a service in Linux® TM operating systems and is rarely present in Windows® TM operating systems.

[0181] In the second port profile embodiment, the service comprises a database management system (DBMS). In operation, a first given workstation 26 communicates with a DBMS application executing on a second given workstation 26 via a given port 40 on the second given workstation that is associated with the DBMS application. In this embodiment, suspicious port scanning can comprise the first given workstation communicating with (i.e., on the second given workstation) a large number of ports 40 that are associated with a corresponding large number of different DBMS applications. This type of activity can be caused by an attacker performing service enumeration, e.g., who is attempting to identify all available DBMS applications on a particular server.

[0182] It is important to note that suspicious port scanning activity is different in the two embodiments described above. In the operating system embodiment, a small amount of port scanning across different operating system port groups can be suspicious. This is because a given workstation 26 typically executes a single operating system. However, in the DBMS embodiment, a large amount of port scanning across different DBMS port scanning groups can be required for suspicious port scanning to be flagged as suspicious. This is because a given workstation 26 can execute more than one DBMS application.

[0183] In the first port profile embodiment, the processor 48 can define a plurality of port lists 60 for a corresponding plurality of operating systems 42. Each port list 60 comprises a plurality of port numbers 40 that are commonly used by a given operating system 42. Thus, each given port list 60 for a given operating system 42 comprises port numbers 40 that are typically used by the given operating system and are never or rarely used by other operating systems 42. Examples of operating systems 42 that can have corresponding port lists 60 include, but are not limited to, Windows® TM (produced by Microsoft Corporation of Redmond, Washington), Linux® TM , Android® TM (produced by Alphabet Inc. of Mountain View, California), macOS®TM (also known as OS-X TM , produced by Apple Inc. of Cupertino, California).

[0184] For example:

[0185] The first given port list 60 can include port numbers "135", "137", and "139". These ports 40 are commonly used by Windows TM services.

[0186] The second given port list 60 can include port numbers "22", "23", and "111". These ports 40 are commonly used by Linux TM services.

[0187] The basic principle for defining the port lists in the first port profile embodiment is that an attacker typically does not know the operating system being executed on a given workstation 26 that they are scanning, and one of the attacker's goals is to identify the operating system 42. Thus, the attacker can scan a few ports 40 from more than one port's list 60 in order to identify the operating system being executed on the given workstation.

[0188] For example, if the first given list 60 includes ports used by Windows TM services, the second given list 60 includes ports used by Linux TM services, and the third given list 60 includes ports used by macOS TM services, then for each source node 66 and destination node 66 pair, the processor 48 can compute the tuple (N_Windows, N_Linux, N_macOS) that represents the respective counts of port numbers in the port list that is scanned by the given source node on the given destination node during the test period (no training period is needed). In this example:

[0189] The processor 48 will not flag tuples like (4, 0, 0) because the given destination node can be running Windows TM .

[0190] The processor 48 will flag tuples like (4, 2, 3) because the given source node attempted to access a port 40 that is commonly used by macOS TM services, but rarely used by Windows TM services.

[0191] In some embodiments, the processor 48 can use a specified threshold for the count mix in a tuple to identify suspicious port scanning 32 "across" multiple operating systems. In a first example, if a given tuple indicates a threshold number (e.g., >3, >4, or >5) of scans to ports 40 associated with one of the operating systems, and a positive number of scans to any ports associated with the remaining operating systems, the processor 48 can flag the port scanning in the given tuple as suspicious. In another example, if a given tuple indicates a respective large number (e.g., >3, >4, or >5) of scans to ports 40 associated with at least 2 different operating systems, the processor 48 can flag the port scanning in the given tuple as suspicious. In the first example, the processor can flag the port scanning resulting in the tuple (4, 1, 2) as suspicious, and in the second example, the processor can flag the port scanning resulting in the tuple (0, 4, 3) as suspicious.

[0192] In additional embodiments, the processor 48 can convert the tuples into probabilities that the processor can use to identify suspicious port scanning. For example, the processor 48 can compute probabilities_tuple = [pi, p2,..., pn], where n ], where

[0193]

[0194] There can be cases where the port values are small and the probabilities are suspected to be inaccurate. In other words, even if a given port 40 has not been accessed before, the probability that it will be accessed in the future is not zero. In one embodiment, the processor 48 can use methods such as confidence intervals or Laplace smoothing in order to improve the estimates. In another embodiment, the processor 48 can compute the entropy of the probabilities_tuple for a given tuple, and if the entropy exceeds a specified threshold (e.g., 0.1, 0.2), flag the port scanning in the tuple as suspicious (i.e., because they are accessing a suspicious combination of ports in more than one group).

[0195] In a second port profile embodiment, the processor 48 can define multiple port lists 60 for corresponding multiple software applications 44. Each port list 60 includes multiple port numbers 40 that are commonly used by a particular family of software applications 44. Thus, each given port list 60 for a given software application 44 includes ports that are typically used by the given software application, and that are never or rarely used by other software applications 44. In the second port profile embodiment, examples of families (also referred to as categories) of software applications 44 include, but are not limited to, database services, email services, and remote access services (also referred to as remote session services).

[0196] For example, if the family of software applications 44 includes database servers, the list of ports for database servers can include:

[0197] The first given list of ports 60 includes one or more port numbers 40 (e.g., “3306”) for MySQL TM .

[0198] The second given list of ports 60 includes one or more port numbers 40 (e.g., “1433”) for Firebird TM .

[0199] The third given list of ports 60 includes one or more port numbers 40 (e.g., “5432”) for PostgreSQL TM .

[0200] The fourth given list of ports 60 includes one or more port numbers 40 (e.g., “27017”) for MongoDB TM .

[0201] The fifth given list of ports 60 includes one or more port numbers 40 (e.g., “9042”) for Cassandra TM .

[0202] The sixth given list of ports 60 includes one or more port numbers 40 (e.g., “11211”) for MemcacheDB TM .

[0203] The seventh given list of ports 60 includes one or more port numbers 40 (e.g., “3100”) for Aerospike TM .

[0204] In general, a given node (e.g., a given workstation 26 or server) can execute a small number (e.g., 1-3) of different database server engines. Thus, if the processor 48 detects that a given source node 64 is scanning at least a threshold number (e.g., at least 3, at least 4, or at least 5) of ports 40 from different lists of ports 60 for database servers on a given destination node 66, this can indicate that the given source node is looking for “any” database server, and thus does not know which one is executing on the given destination profile. Having zero or a small number (e.g., fewer than 2, fewer than 3, or fewer than 4) of successful sessions can increase suspiciousness when detecting a large number of scans from different lists of ports 60 for a given network service.

[0205] In some embodiments, the processor 48 can use additional criteria, such as the number of detected failed connections associated with different ports 40. In one example, the processor 48 can flag a port scan (i.e., as suspicious) that scans a large number (e.g., at least four or at least five) of ports 40 from the different port list 60 for a database server. In another example, the processor 48 can flag a port scan as suspicious that scans a small number (e.g., at least two or at least three) of ports 40 from the different port list 60 for a database server, where at least one of the port scans has a failed connection (as described above). Note that these examples are generally for port scans that are performed over a short time range (e.g., less than one hour, less than two hours, or less than three hours).

[0206] In a first embodiment, the threshold can include a large number, such as at least 5, at least 6, or at least 7. In a second embodiment, the threshold can include a small number (e.g., at least 2, at least 3, or at least 4) of ports in the different port list, and at least 1 failed connection (i.e., for that series) on any of the port numbers in any of the port lists. The port scans in the first and second embodiments generally occur over a short time period (e.g., one hour, two hours, or three hours).

[0207] Figure 5 is a flowchart schematically illustrating a method of detecting port scans across software systems using port profiles, according to embodiments of the present application. In step 130, the processor 48 defines a plurality of software systems in a particular software class, and in step 132, the system processor defines, for each given software system, a given port list 60 that includes a set of one or more ports 40 that are exclusively used by the given software system. Thus, each port list 50 includes at least a first and second disjoint set of communication ports 40 (i.e., port numbers). The class can include an operating system or software application that provides a network service, such as a database server or an email server. As described above, if the class is an operating system, each port list 60 includes one or more ports 40 used by the operating system, such as Windows TM , Linux TM , or macOS TM . Likewise, if the class is a DBMS application, each port list 60 includes one or more ports 40 used by the DBMS application, such as MySQL TM , PostgreSQL TM , or Cassandra TM .

[0208] In step 134, the processor 48 uses the port lists 60 to detect port scans across the software systems in the class. In one embodiment, the processor 48 detects a port scan by determining that a number of failed connections (e.g., at least 1, at least 2, or at least 3) are associated with a given port 40 in a given port list 60. In another embodiment, the processor 48 detects a port scan by determining that a number of failed connections (e.g., at least 1, at least 2, or at least 3) are associated with a given port 40 in a given port list 60, where the given port 40 is in a given port list 60 for a given software system in the class.Figure 2 Using the embodiments described above in the description of FIG. 1, the processor 48 identifies a set of port scans. To identify the set of port scans, the processor 48 collects the communication sessions 68 during a predefined time period (e.g., an hour or a day) and aggregates them into aggregated communication sessions 58. Each aggregated communication session 58 includes a given port scan 32 that causes a first given workstation 26 to access at least one given communication port 40 on a second given destination 26.

[0209] Finally, in step 136, using the embodiments described above, the processor 48 identifies, among the identified port scans (i.e., in step 134), a given source node 64 that accesses at least one of the communication ports in the first port list 60 and at least one of the communication ports in the second port list 60, and the method ends.

[0210] Bias with independent models

[0211] The embodiments described herein can compute a distribution of port usage in the network 28 and use the computed distribution to identify suspicious port scans on the network. For example, during a training period, the processor 48 can detect that the port numbers “22” and “3389” are frequently used, but rarely used together. During a subsequent testing period, if the processor 48 detects that a given source node 64 scans both of those ports 40 on a given destination node 66, the system processor can generate an alert for the given source node.

[0212] Figure 6 is a flowchart schematically illustrating a method of detecting port scans 32 that include anomalous pairs of ports 40, according to embodiments of the present application. In step 140, using the embodiments described above in the description of FIG. 1, the processor 48 identifies a set of port scans. To identify the set of port scans, the processor 48 collects the communication sessions 68 during a predefined time period and aggregates them into aggregated communication sessions 58. Each aggregated communication session 58 includes a given port scan 32 that causes a first given workstation 26 to access at least one given communication port 40 on a second given destination 26. Figure 2 Using the embodiments described above in the description of FIG. 1, the processor 48 identifies a set of port scans. To identify the set of port scans, the processor 48 collects the communication sessions 68 during a predefined time period (e.g., an hour or a day) and aggregates them into aggregated communication sessions 58. Each aggregated communication session 58 includes a given port scan 32 that causes a first given workstation 26 to access at least one given communication port 40 on a second given destination 26.

[0213] In step 142, the processor 48 computes, for each given port p that is scanned during the predefined time period, a probability P that a given source node 64 accesses a given port p on a given destination node 66 in any port scan 32 during the predefined time period. p .

[0214] In step 144, processor 48 computes, for each pair of ports pi and p2, a joint probability JP between the connection between a given source node 64 and ports pi and p2 on a given destination node 66 in any port scan 32 during a predefined time period p1,p2 .

[0215] JP is computed for each pair of ports 40 scanned during the training period p1,p2 Afterwards, in step 146, processor 48 computes a port pair score (PPS) which the system processor can use to identify pairs of ports pi and p2 with the following properties:

[0216] Port pi is frequently scanned by any given source node 64 during the predefined time period.

[0217] Port p2 is frequently scanned by any given source node 64 during the predefined time period.

[0218] Both ports pi and p2 on a given destination node 66 are rarely scanned by a given source node 64 during the predefined time period.

[0219] To compute the port pair score, processor 48 can use the following formula

[0220]

[0221] In equation (3), a higher PPS score indicates a pair of ports 40 that (each) are frequently scanned on the network but rarely scanned together by a given source node 64 on a given destination node 66 during the predefined time period. In embodiments of the invention, a threshold for a high PPS score can be a high value. For example, the threshold can be greater than 20, greater than 30, or greater than 40.

[0222] Finally, in step 148, processor 48 identifies any of the source nodes that scan a pair of ports 40 with a high port pair score during the predefined time period, and the method ends. In embodiments of the invention, a scanned pair of ports 40 with a high port pair score indicates that the respective JP p1,p2 is below a threshold value that depends on the respective probabilities P p of ports pi and p2.

[0223] In one embodiment, the predefined time period can include a plurality of sub-periods that can have substantially the same duration. In this embodiment, the processor 48 can perform step 150 during any given sub-period in order to identify a given source node 64 that scanned a pair of ports 40 having a high port pair score during the given sub-period. In another embodiment, the sub-periods include one or more first sub-periods followed by a second sub-period, and the processor 48 can perform steps 140-146 during the one or more first sub-periods and perform step 148 during the second sub-period.

[0224] Scanner probe

[0225] Some scanning tools use a port scanning probe that includes a given software application 44 loaded on one or more nodes 26 and is configured to scan other nodes 26 on the network and report the scan results to a scanning server (e.g., a given node 26). The scanning probe can be deployed on a network having nodes 26 that the scanning server cannot directly access using all ports required for scanning (e.g., because a firewall protects a subset of the network). In operation, the probe can be deployed on a plurality of network endpoints (i.e., nodes 26) to randomly perform port scanning and then transmit the scan results back to the given node (i.e., server). Because the scans performed by the scanner probe can generate alerts, embodiments of the present invention enable the processor 48 to whitelist scans performed by a given scanner probe.

[0226] Figure 7 FIG. 1 is a flowchart schematically illustrating a method of detecting any deployed scanner probes in accordance with embodiments of the present invention. In step 150, the processor 48 identifies a set of port scans using embodiments described above with reference to Figure 2 In order to identify the set of port scans, the processor 48 collects communication sessions 68 during a predefined time period and aggregates them into aggregated communication sessions 58. Each aggregated communication session 58 includes a given port scan 32 that causes a first given workstation 26 to access at least one given communication port 40 on a second given destination 26.

[0227] In step 152, the processor 48 identifies a group of high-traffic ports 40 in the identified port scans. In embodiments of the present invention, the processor 48 can classify a given port 40 as having high traffic if the amount of data traffic through the given port during the predefined time period exceeds a predefined threshold. Examples of the predefined threshold include, but are not limited to, 200, 400, and 600 bytes. In some embodiments, the given port can be on a given node 26. In other words, the processor 48 can classify a combination of a given node and a given port as having high traffic.

[0228] In operation, the processor 48 can use the capacity 88 and / or the reverse capacity 78 in the communication sessions of the aggregated port scans (i.e., corresponding to the given port scans 32) to determine whether the data traffic in the given port scans 32 exceeds a predefined threshold. In some embodiments, if the maximum amount of data through a given port in any given communication session (i.e., during a given port scan 32) exceeds the predefined threshold, the processor 48 can classify the given port 40 as having a large amount of traffic.

[0229] In step 154, the processor 48 generates, for the identified port scans, respective signatures 82 that indicate the communication ports, other than the large traffic ports, that were visited in each of the port scans. In other words, a given signature 82 for a given port scan 32 can include a set of communication ports that were visited during the given port scan and that were not classified as having a large amount of traffic.

[0230] In step 156, the processor 48 calculates a respective frequency of occurrence of each of the signatures across the set of port scans, and in step 158, the processor aggregates the whitelist 80 by initializing the whitelist and then adding a signature to the whitelist for which the respective frequency of occurrence is greater than a predefined threshold. In one embodiment, the frequency of occurrence for a given signature 82 can include information such as:

[0231] The number of occurrences that the given signature appeared in all of the identified port scans.

[0232] The number of sources that performed a port scan 32 having the same signature 82 as the given signature (i.e., the set of non-high capacity ports).

[0233] The number of destinations that had the same set of scanned ports as the set of ports in the given signature.

[0234] In this embodiment, examples of specific thresholds include, but are not limited to:

[0235] The number of occurrences > a first threshold, such as 8, 10, or 12.

[0236] The number of sources > a second threshold, such as 0, 1, or 2.

[0237] The number of sources < a third threshold, such as 30, 40, or 50.

[0238] The number of destinations > a fourth threshold, such as 0, 1, 2, or 3.

[0239] The number of destinations < a fifth threshold, such as 10, 20, 30, or 40.

[0240] In some embodiments, the processor 48 can use a combination of thresholds to identify signatures to add to the whitelist. For example, a given combination can be:

[0241] occurrences > 10, and

[0242] source quantity > 1, and

[0243] source quantity < 40, and

[0244] destination quantity > 2, and

[0245] destination quantity < 20.

[0246] Finally, in step 160, the processor 48 identifies any of the source nodes in the identified port scans having respective signatures not in the whitelist, and the method ends.

[0247] In one embodiment, the predefined time period can include a plurality of sub-periods that can have substantially the same duration. In this embodiment, the processor 48 can perform step 160 during any given sub-period in order to identify, in the given sub-period, the identified port scans 32 having respective signatures not in the whitelist. In another embodiment, the sub-periods include one or more first sub-periods followed by a second sub-period, and the processor 48 can perform steps 150-158 during the one or more first sub-periods and step 160 during the second sub-period.

[0248] It is to be understood that the embodiments described above are cited by way of example, and that the present application is not limited to what has been particularly shown and described hereinabove. Rather, the scope of the present application includes both combinations and sub-combinations of the various features described above, as well as modifications and variations thereof which would occur to persons of ordinary skill in the art upon reading the foregoing description.

Claims

1. A method for port scanning detection, comprising: For a given software category, define a corresponding disjoint set of communication ports used by each of a plurality of software systems in the given software category, the disjoint set including at least a first disjoint set and a second disjoint set; In a data service transmitted between multiple nodes communicating over a network, a set of port scans is identified, each of the port scans comprising accesses by a given source node to multiple communication ports on a given destination node during a predefined time period in the data service. as well as When a port scan is detected by one of the nodes, including access to at least one communication port in the first disjoint set and at least one communication port in the second disjoint set, a preventive action is initiated. The identification of the port scan includes: In the data service, a set of source node and destination node pairs are identified, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in the data service between the source node and the destination node in each pair. For each pair in the group, a corresponding baseline level is calculated, the baseline level indicating a first number of communication ports accessed by a source node other than the given source node in that pair on the given destination node during a first time period. For each pair in the group, a corresponding test score is calculated, the test score indicating the difference between the second number of communication ports accessed by the given source node on the given destination node during the second time period and the baseline level. Any pair in the pair whose test score is greater than a specified level is designated as the port scan.

2. The method according to claim 1, wherein, Detecting access to at least one communication port in the first disjoint set includes detecting access to at least a specified number of communication ports in the first disjoint set, wherein the specified number is greater than one.

3. The method according to claim 1, wherein, At least one communication port in the first disjoint set and at least one communication port in the second disjoint set include at least a specified number of communication ports in each of the first disjoint set and the second disjoint set, wherein the specified number is greater than one.

4. The method according to any one of claims 1 to 3, wherein, The given software category includes operating systems.

5. The method according to any one of claims 1 to 3, wherein, The given software category includes database servers.

6. The method according to any one of claims 1 to 3, wherein, The given software category includes email servers.

7. The method according to any one of claims 1 to 3, wherein, The given software category includes remote session applications.

8. The method according to any one of claims 1 to 3, wherein, Initiating the preventative action includes generating an alert for the given source node detected in a port scan.

9. The method according to any one of claims 1 to 3, wherein, Initiating the preventative action includes restricting the network access of the given source node detected in a port scan.

10. An apparatus for port scanning detection, comprising: A network interface device coupled to a data network, the network including multiple nodes communicating via the network; as well as At least one processor is configured as follows: For a given software category, define a corresponding disjoint set of communication ports used by each of multiple software systems within that given software category. This disjoint set includes at least a first disjoint set and a second disjoint set. In a data service transmitted between multiple nodes communicating over a network, a set of port scans is identified, each port scan comprising accesses by a given source node to multiple communication ports on a given destination node within the data service during a predefined time period. When a port scan is detected by one of the nodes, including access to at least one communication port in the first disjoint set and at least one communication port in the second disjoint set, a preventive action is initiated. The given processor is configured to identify the port scan in the following manner: In the data service, a set of source node and destination node pairs are identified, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in the data service between the source node and the destination node in each pair. For each pair in the group, a corresponding baseline level is calculated, the baseline level indicating a first number of communication ports accessed by a source node other than the given source node in that pair on the given destination node during a first time period. For each pair in the group, a corresponding test score is calculated, the test score indicating the difference between the second number of communication ports accessed by the given source node on the given destination node during the second time period and the baseline level. Any pair in the pair whose test score is greater than a specified level is designated as the port scan.

11. The apparatus according to claim 10, wherein, A given processor is configured to detect access to at least one communication port in the first disjoint set by detecting access to at least a specified number of communication ports in the first disjoint set, wherein the specified number is greater than one.

12. The apparatus according to claim 10, wherein, At least one communication port in the first disjoint set and at least one communication port in the second disjoint set include at least a specified number of communication ports in each of the first disjoint set and the second disjoint set, wherein the specified number is greater than one.

13. The apparatus according to any one of claims 10 to 12, wherein, The given software category includes operating systems.

14. The apparatus according to any one of claims 10 to 12, wherein, The given software category includes database servers.

15. The apparatus according to any one of claims 10 to 12, wherein, The given software category includes email servers.

16. The apparatus according to any one of claims 10 to 12, wherein, The given software category includes remote session applications.

17. The apparatus according to any one of claims 10 to 12, wherein, The given processor is configured to initiate the preventative action by generating an alert for the given source node detected in a port scan.

18. The apparatus according to any one of claims 10 to 12, wherein, A given processor is configured to initiate the preventative action by restricting access to the network by the given source node in a detected port scan.

19. A computer software product comprising a non-transitory computer-readable medium storing program instructions that, when read by a computer, cause the computer to: For a given software category, define a corresponding disjoint set of communication ports used by each of a plurality of software systems in the given software category, the disjoint set including at least a first disjoint set and a second disjoint set; In a data service transmitted between multiple nodes communicating over a network, a set of port scans is identified, each of the port scans comprising accesses by a given source node to multiple communication ports on a given destination node during a predefined time period in the data service. as well as When a port scan is detected by one of the nodes, including access to at least one communication port in the first disjoint set and at least one communication port in the second disjoint set, a preventive action is initiated. The identification of the port scan includes: In the data service, a set of source node and destination node pairs are identified, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in the data service between the source node and the destination node in each pair. For each pair in the group, a corresponding baseline level is calculated, the baseline level indicating a first number of communication ports accessed by a source node other than the given source node in that pair on the given destination node during a first time period. For each pair in the group, a corresponding test score is calculated, the test score indicating the difference between the second number of communication ports accessed by the given source node on the given destination node during the second time period and the baseline level. Any pair in the pair whose test score is greater than a specified level is designated as the port scan.

Images