Automatic Scanning Detection via Weighted Request Response Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for determining automatic scanning actions in networks suffer from poor applicability and accuracy, as they either rely on matching known characteristic information or frequency-based alarms, failing to effectively identify unknown scanning actions.
Innovation Solution
A method and device that collect access request and response messages over a set period, divide the period into sub-periods to count messages, calculate confidence values for request and response messages, and use weights to determine an overall evaluation value, which is then compared to a threshold to judge if an automatic scanning action is occurring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If characteristic information matching method is used to determine automatic scanning actions, then the determination can be made for tools with known characteristic information, but it cannot handle unknown characteristic information, resulting in poor applicability
Solution Approach 1:
The patent changes the determination parameters from static characteristic information matching to dynamic behavior parameter analysis. It monitors multiple parameters including access frequency, time intervals, message types, and response patterns, then dynamically adjusts determination thresholds based on these parameter variations. This allows the system to adapt to both known and unknown scanning tools by analyzing their behavioral parameters rather than relying on pre-defined characteristic signatures.
2Ease of operation
If frequency-based alarm method is used to determine automatic scanning actions, then the determination process is simple, but the accuracy is poor due to simple judgment criteria
Solution Approach 1:
The patent segments the determination process into multiple independent analysis modules: access frequency analysis module, time interval analysis module, message type analysis module, and response pattern analysis module. Each module independently evaluates specific behavioral aspects and generates separate assessment results. These segmented analyses are then integrated through weighted synthesis to produce the final determination, maintaining operational simplicity while significantly improving accuracy through multi-dimensional evaluation.
3Device complexity
If only access request message frequency is considered for determination, then the judgment process is simple, but it lacks comprehensive analysis of both request and response patterns, resulting in poor accuracy
Solution Approach 1:
The patent merges the analysis of access request messages and access response messages into a unified determination framework. It simultaneously monitors request frequency, request time intervals, response message types, response content patterns, and the correlation between requests and responses. By combining these multiple dimensions of analysis and synthesizing them through weighted evaluation, the system achieves comprehensive accuracy while managing complexity through modular architecture.
Data Source
AI summary
Disclosed are a method and an apparatus for determining an automatic scanning action. The method comprises: in a set period, collecting access request messages sent from a selected send end to a selected network server and access response messages returned from the selected network server to the selected sending end; equally dividing the set period into at least two set sub-periods, successively counting the number of the access request messages in each set sub-periods and determining a request credible value of the selected sending end; counting the number of response success messages and the number of response failure messages in the collected access response messages, and determining a request credible value of the selected sending end; calculating a general accessed value of the selected send end in the set period according to the determined request credible value, the response credible value, first weight, and second weight; and comparing the general accessed value with a first set threshold, and determining whether is the selected sending end performs automatic scanning This solution is more applicable and more accurate than the prior art.