Method, apparatus, and computer software product for port scan detection

By identifying and analyzing communication port access between network nodes, calculating baseline levels and test scores, the challenges of identifying and defending against port scanning attacks are solved, thereby improving network security.

CN116527390BActive Publication Date: 2026-01-06PALO ALTO NETWORKS INC
6 Cites 1 Cited by

Patent Information

Application Number
CN202310649426.9
Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Priority Date
2019-01-30
Filing Date
2019-12-08
Publication Date
2026-01-06
Estimated Expiration
2039-12-08

AI Technical Summary

Technical Problem

Existing technologies are insufficient to effectively identify and defend against port scanning attacks, especially the scanning behavior of hackers on available open ports in the network.

Method used

By identifying communication port access between source and destination node pairs, baseline levels and test scores are calculated to identify abnormal access behavior and initiate preventative actions, such as generating alerts or restricting access, to defend against port scanning.

Benefits of technology

Effectively identify and defend against port scanning attacks, reduce network exposure, and improve security.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

This application relates to port scan detection. A method includes identifying, in network data traffic, a set of source node and destination node (26) pairs, each pair having a given source node, a given destination node, and one or more ports (40) accessed in traffic between the nodes in each pair, and computing, for each pair, a respective baseline indicating a first number of ports accessed on the given destination node by source nodes other than the given source node in the pair during a first time period. For each pair, a respective test score is computed indicating a difference between a second number of ports accessed on the given destination node by the given source node in the pair during a second time period and the baseline, and a preventive action is initiated for the given source node for which the test score for any of the pairs is greater than a threshold.
Need to check novelty before this filing date? Find Prior Art