A method and system for identifying port scanning events
By filtering and aggregating statistics on the intranet traffic logs, port scanning events for intranet hosts are identified, which solves the problem of insufficient identification efficiency and accuracy in the existing technology, and improves the effectiveness of network security defense.
Patent Information
- Application Number
- CN202311281417.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-10-07
- Publication Date
- 2025-04-08
AI Technical Summary
The prior art is difficult to quickly and accurately identify port scanning events against intranet hosts, resulting in the failure to detect attack signs in time, the attack may actually occur, and the effectiveness of network security defense is insufficient.
By filtering the traffic logs with the session status of RST and the destination IP belongs to the intranet, sorting the port data based on the number of visits, aggregating the source IP and destination IP, and determining abnormal behaviors to identify port scanning events.
It improves the efficiency and accuracy of identification of intranet host port scanning events, promptly detects attack signs, prevents the actual occurrence of attacks, and improves the effectiveness of network security defense.
Smart Images
Figure FT_1 
Figure FT_2
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of network security event detection, and in particular relates to a method and system for identifying a port scanning event initiated by an intranet host. Background Art
[0002] Network reconnaissance refers to the detection activities of the target host by hackers before or during the attack in order to carry out the attack more effectively. Common reconnaissance includes: the domain name, IP address, operating system, port and open applications or services of the target host.
[0003] Among them, port scanning, as the name suggests, is to scan a section of ports or specified ports one by one. The services provided on the target host are analyzed through the scanning results, and then attacks are attempted through the known vulnerabilities of these services. The role of port scanning is not a direct attack network vulnerability program, it only helps to discover some weaknesses inside the target host, and then launch attacks on the discovered weaknesses through corresponding attack tools, making the attack more targeted and improving the attack efficiency.
[0004] Therefore, quickly and accurately identifying port scanning events targeting intranet hosts plays an important role in timely discovering signs of attacks, preventing the actual occurrence of attacks, and improving the effectiveness of network security defense. Summary of the invention
[0005] In view of the above background, the present invention aims to propose a method for identifying port scanning events initiated by an intranet host and an identification system using the method, so as to effectively utilize traffic logs and improve the efficiency of identifying security events.
[0006] In a first aspect, a method for identifying a port scanning event is proposed, including identifying scanning events of the same port of multiple intranet hosts and scanning events of multiple ports of the same host.
[0007] The scanning event identification process of the same port of multiple intranet hosts includes: Filter traffic logs whose session status is RST and whose destination IP belongs to the intranet; Sort the port data according to the number of accesses, and mark the top several ports as the first risk ports; Taking the first risk port as the screening condition, aggregate statistics are performed on the destination IPs. If there are at least two destination IPs, the destination IP with the first risk port is marked as the first suspicious destination IP, and the port is marked as the second risk port; Taking the second risk port as the screening condition, performing aggregation statistics on the source IPs to obtain the first abnormal source IP; Taking the first abnormal source IP as the screening condition, aggregate statistics on the second risk port to obtain the first abnormal port; It is determined that the first abnormal source IP performs a scanning operation on the first abnormal port.
[0008] Preferably, the first abnormal source IP performs a scanning operation on the abnormal port, including the first abnormal source IP scanning the first abnormal port of the first suspicious destination IP.
[0009] Further, the ports ranked in the top several places include the top ten ports.
[0010] The process of identifying scanning events of multiple ports of the same host includes: Filter traffic logs whose session status is RST and whose destination IP belongs to the intranet; Taking the source IP with the most visits as the screening condition, aggregate and count the destination IPs to obtain the second suspicious destination IP; Taking the second suspicious destination IP as the screening condition, aggregate statistics are performed on the destination ports. If the same suspicious destination IP has at least two destination ports, the second suspicious destination IP is marked as an abnormal destination IP, the corresponding source IP is marked as a second abnormal source IP, and the destination port is marked as a second abnormal port; It is determined that the second abnormal source IP performs a scanning operation on the port of the abnormal destination IP.
[0011] Preferably, the second abnormal source IP performs a scanning operation on the port of the abnormal destination IP, including scanning the second abnormal port of the abnormal destination IP.
[0012] Furthermore, the identification method also includes identifying a scanning event for a specific port, specifically including: Taking the specific destination port as the screening condition, the destination IP and the source IP are aggregated and counted to obtain a destination IP list and a source IP list; Taking the IP in the source IP list as the screening condition, the IP in the destination IP list is aggregated and counted. If the number of destination IPs that meet the conditions finally exceeds a preset threshold, it is determined that a scanning event exists on the current destination port.
[0013] Preferably, the above-mentioned aggregate statistics include aggregate statistics of a preset time range and a preset number of destination ports, destination IPs or source IPs.
[0014] In a second aspect, a system for identifying a port scanning event is provided, the system comprising: Log filtering module, used to filter traffic logs whose session status is RST and whose destination IP belongs to the intranet; The data aggregation module is used to aggregate statistics of the destination ports, destination IPs or source IPs within a preset time range and a preset number according to a preset target; The event identification module is used to determine whether a port scanning event occurs based on the aggregated statistical results.
[0015] Preferably, the system identifies events in which the same port of multiple destination IPs is scanned, including: Sort the port data according to the number of accesses, and mark the top several ports as the first risk ports; Taking the first risk port as the screening condition, aggregate statistics are performed on the destination IPs. If there are at least two destination IPs, the destination IP with the first risk port is marked as the first suspicious destination IP, and the port is marked as the second risk port; Taking the second risk port as the screening condition, performing aggregation statistics on the source IPs to obtain the first abnormal source IP; Taking the first abnormal source IP as the screening condition, aggregate statistics on the second risk port to obtain the first abnormal port; It is determined that the first abnormal source IP has performed a scanning operation on the first abnormal port of the first suspicious destination IP.
[0016] Preferably, the system identifies events where multiple ports of the same destination IP are scanned, including: Taking the source IP with the most visits as the screening condition, aggregate and count the destination IPs to obtain the second suspicious destination IP; Taking the second suspicious destination IP as the screening condition, aggregate statistics are performed on the destination ports. If the same suspicious destination IP has at least two destination ports, the second suspicious destination IP is marked as an abnormal destination IP, the corresponding source IP is marked as a second abnormal source IP, and the destination port is marked as a second abnormal port; It is determined that the second abnormal source IP performs a scanning operation on the second abnormal port of the abnormal destination IP.
[0017] The present invention adopting the above technical scheme has at least the following beneficial effects: the traffic log data is aggregated and counted according to preset screening conditions, and according to the aggregated statistical results, events such as scanning of the same port of multiple hosts in the intranet, scanning of different ports of the same host, and scanning of specific ports can be identified, and an effective analysis and recognition model is established, which is of positive significance for improving the recognition efficiency and accuracy of port scanning events, and thus ensuring the security of intranet hosts. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] Figure 1 This is a schematic diagram of a working process of a method for identifying a port scanning event according to an embodiment of the present invention; Figure 2 The present invention is a schematic diagram of a module composition of a system embodiment of a port scanning event identification system. Implementation
[0019] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant contents of the present application, rather than to limit the application. It is also necessary to explain that, for ease of description, only the parts related to the application are shown in the accompanying drawings.
[0020] The principle of port scanning is that when a host makes a request to establish a connection to a port of a remote server, if the other party has this service, it will respond. If this service is not installed, even if you want to send a request to the corresponding port, the other party will still not respond. Using this principle, if you establish connections to all well-known ports or well-known ports within a certain range selected by yourself, and record the responses given by the remote server, you can identify the service. This is port scanning, and you can obtain a lot of valuable information about the host through port scanning.
[0021] By utilizing the relevant characteristics of port scanning, the embodiment of the present invention provides a technical solution for identifying port scanning events. Embodiment 1
[0022] like Figure 1 As shown, an embodiment of a method for identifying a port scanning event, identifying a scanning event of the same port of multiple intranet hosts, includes: Filter traffic logs whose session status is RST and whose destination IP belongs to the intranet; Sort the port data according to the number of accesses, and mark the top several ports as the first risk ports; Taking the first risk port as the screening condition, aggregate statistics are performed on the destination IPs. If there are at least two destination IPs, the destination IP with the first risk port is marked as the first suspicious destination IP, and the port is marked as the second risk port; Taking the second risk port as the screening condition, performing aggregation statistics on the source IPs to obtain the first abnormal source IP; Taking the first abnormal source IP as the screening condition, aggregate statistics on the second risk port to obtain the first abnormal port; It is determined that the first abnormal source IP performs a scanning operation on the first abnormal port.
[0023] Preferably, the first abnormal source IP performs a scanning operation on the abnormal port, including the first abnormal source IP scanning the first abnormal port of the first suspicious destination IP.
[0024] Further, the ports ranked in the top several places include the top ten ports. Embodiment 2
[0025] An embodiment of a method for identifying a port scanning event includes: Filter traffic logs whose session status is RST and whose destination IP belongs to the intranet; Taking the source IP with the most visits as the screening condition, aggregate and count the destination IPs to obtain the second suspicious destination IP; Taking the second suspicious destination IP as the screening condition, aggregate statistics are performed on the destination ports. If the same suspicious destination IP has at least two destination ports, the second suspicious destination IP is marked as an abnormal destination IP, the corresponding source IP is marked as a second abnormal source IP, and the destination port is marked as a second abnormal port; It is determined that the second abnormal source IP performs a scanning operation on the port of the abnormal destination IP.
[0026] As a preferred implementation, the second abnormal source IP performs a scanning operation on the port of the abnormal destination IP, including scanning the second abnormal port of the abnormal destination IP. Embodiment 3
[0027] An embodiment of a method for identifying a port scanning event includes identifying a scanning event for a specific port, specifically including: Taking the specific destination port as the screening condition, the destination IP and the source IP are aggregated and counted to obtain a destination IP list and a source IP list; Taking the IP in the source IP list as the screening condition, the IP in the destination IP list is aggregated and counted. If the number of destination IPs that meet the conditions finally exceeds a preset threshold, it is determined that a scanning event exists on the current destination port.
[0028] Preferably, the above-mentioned aggregate statistics include aggregate statistics of a preset time range and a preset number of destination ports, destination IPs or source IPs. Embodiment 4
[0029] like Figure 2 As shown, a system for identifying a port scanning event, the system comprising: Log filtering module, used to filter traffic logs whose session status is RST and whose destination IP belongs to the intranet; The data aggregation module is used to aggregate statistics of the destination ports, destination IPs or source IPs within a preset time range and a preset number according to a preset target; The event identification module is used to determine whether a port scanning event occurs based on the aggregated statistical results.
[0030] Preferably, the system identifies events in which the same port of multiple destination IPs is scanned, including: Sort the port data according to the number of accesses, and mark the top several ports as the first risk ports; Taking the first risk port as the screening condition, aggregate statistics are performed on the destination IPs. If there are at least two destination IPs, the destination IP with the first risk port is marked as the first suspicious destination IP, and the port is marked as the second risk port; Taking the second risk port as the screening condition, performing aggregation statistics on the source IPs to obtain the first abnormal source IP; Taking the first abnormal source IP as the screening condition, aggregate statistics on the second risk port to obtain the first abnormal port; It is determined that the first abnormal source IP has performed a scanning operation on the first abnormal port of the first suspicious destination IP.
[0031] Preferably, the system identifies events where multiple ports of the same destination IP are scanned, including: Taking the source IP with the most visits as the screening condition, aggregate and count the destination IPs to obtain the second suspicious destination IP; Taking the second suspicious destination IP as the screening condition, aggregate statistics are performed on the destination ports. If the same suspicious destination IP has at least two destination ports, the second suspicious destination IP is marked as an abnormal destination IP, the corresponding source IP is marked as a second abnormal source IP, and the destination port is marked as a second abnormal port; It is determined that the second abnormal source IP performs a scanning operation on the second abnormal port of the abnormal destination IP.
[0032] The technical solution of the present invention and its embodiments as described above aggregates and counts the traffic log data according to preset screening conditions, and can identify events such as scanning the same port of multiple hosts in the intranet, scanning different ports of the same host, and scanning of specific ports based on the aggregated statistical results, and establish an effective analysis and recognition model, which is of positive significance for improving the recognition efficiency and accuracy of port scanning events, and further ensuring the security of intranet hosts.
[0033] A person skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc.
[0034] The above description of the above disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will conform to the broadest scope consistent with the principles disclosed herein.
Claims
1. A method for identifying port scanning events, screening traffic logs whose session status is RST and whose destination IP belongs to the intranet; characterized in that: include: Sort the port data according to the number of accesses, and mark the top several ports as the first risk ports; Taking the first risk port as the screening condition, aggregate statistics are performed on the destination IPs. If there are at least two destination IPs, the destination IP with the first risk port is marked as the first suspicious destination IP, and the port is marked as the second risk port; Taking the second risk port as the screening condition, performing aggregation statistics on the source IPs to obtain the first abnormal source IP; Taking the first abnormal source IP as the screening condition, aggregate statistics on the second risk port to obtain the first abnormal port; It is determined that the first abnormal source IP performs a scanning operation on the first abnormal port.
2. The port scanning event identification method according to claim 1, characterized in that: The first abnormal source IP performs a scanning operation on the abnormal port, including the first abnormal source IP scanning the first abnormal port of the first suspicious destination IP.
3. The port scanning event identification method according to claim 1, characterized in that: Taking the source IP with the most visits as the screening condition, aggregate and count the destination IPs to obtain the second suspicious destination IP; Taking the second suspicious destination IP as the screening condition, aggregate statistics are performed on the destination ports. If the same suspicious destination IP has at least two destination ports, the second suspicious destination IP is marked as an abnormal destination IP, the corresponding source IP is marked as a second abnormal source IP, and the destination port is marked as a second abnormal port; It is determined that the second abnormal source IP performs a scanning operation on the port of the abnormal destination IP.
4. The port scanning event identification method according to claim 3, characterized in that: The second abnormal source IP performs a scanning operation on the port of the abnormal destination IP, including scanning the second abnormal port of the abnormal destination IP.
5. The port scanning event identification method according to claim 1, characterized in that: The ports ranked in the top several places include the top ten ports.
6. The port scanning event identification method according to claim 1, characterized in that: It also includes identifying scanning events for specific ports, including: Taking the specific destination port as the screening condition, the destination IP and the source IP are aggregated and counted to obtain a destination IP list and a source IP list; Taking the IP in the source IP list as the screening condition, the IP in the destination IP list is aggregated and counted. If the number of destination IPs that meet the conditions finally exceeds a preset threshold, it is determined that a scanning event exists on the current destination port.
7. The port scanning event identification method according to any one of claims 1 to 6, characterized in that: The aggregate statistics include aggregate statistics of a preset number of destination ports, destination IPs or source IPs within a preset time range.
8. A port scanning event identification system, characterized in that: The system includes: Log filtering module, used to filter traffic logs whose session status is RST and whose destination IP belongs to the intranet; The data aggregation module is used to aggregate statistics of the destination ports, destination IPs or source IPs within a preset time range and a preset number according to a preset target; The event identification module is used to determine whether a port scanning event occurs based on the aggregated statistical results.
9. The port scanning event identification system according to claim 8, characterized in that: The system identifies scans of the same port from multiple destination IPs, including: Sort the port data according to the number of accesses, and mark the top several ports as the first risk ports; Taking the first risk port as the screening condition, aggregate statistics are performed on the destination IPs. If there are at least two destination IPs, the destination IP with the first risk port is marked as the first suspicious destination IP, and the port is marked as the second risk port; Taking the second risk port as the screening condition, performing aggregation statistics on the source IPs to obtain the first abnormal source IP; Taking the first abnormal source IP as the screening condition, aggregate statistics on the second risk port to obtain the first abnormal port; It is determined that the first abnormal source IP has performed a scanning operation on the first abnormal port of the first suspicious destination IP.
10. The port scanning event identification system according to claim 8, characterized in that: The system identifies incidents where multiple ports of the same destination IP are scanned, including: Taking the source IP with the most visits as the screening condition, aggregate and count the destination IPs to obtain the second suspicious destination IP; Taking the second suspicious destination IP as the screening condition, aggregate statistics are performed on the destination ports. If the same suspicious destination IP has at least two destination ports, the second suspicious destination IP is marked as an abnormal destination IP, the corresponding source IP is marked as a second abnormal source IP, and the destination port is marked as a second abnormal port; It is determined that the second abnormal source IP performs a scanning operation on the second abnormal port of the abnormal destination IP.