Data Flow Collection for Port Scan Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current port scan detection systems in datacenters face challenges in real-time detection due to the vast amount of data that needs to be processed, lack of native support from hypervisors, and evolving techniques used by attackers to evade detection, such as timing scans to avoid statistical detection methods.
Innovation Solution
A data flow collection system that collects and reports attributes of data flows from host computers to a centralized analysis appliance, which uses flow attributes like source and destination IP addresses, transport layer ports, and connection errors to identify and differentiate between slow and vertical port scans, adjusting security threat likelihood scores and applying filters to reduce false positives and memory usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If packet or data flow inspection is used to detect port scans, then detection capability is improved, but data processing load increases significantly
Solution Approach 1:
The patent segments the detection task by having each host computer independently analyze its own network flows and generate port scan indicators, rather than centralizing all flow inspection in one system. This distributes the processing load across multiple hosts while maintaining detection capability.
Solution Approach 2:
The patent performs preliminary analysis of network flows at the host level before central aggregation. Each host pre-processes its flows to identify potential port scan indicators, reducing the amount of data that needs to be processed centrally and improving overall system throughput.
2Measurement precision
If custom agents are deployed in VMs to feed packet information to central processing, then detection detail is improved, but real-time detection becomes difficult
Solution Approach 1:
The patent enables host computers to automatically generate and send port scan indicators to the central system without requiring custom agents inside VMs. The hypervisor's native capabilities are leveraged to collect flow information, eliminating the need for additional software layers that would increase detection latency.
3Reliability
If statistical detection schemes are used with single port checking per day, then false positives are reduced, but attackers can evade detection by timing scans
Solution Approach 1:
The patent implements a unified detection framework that handles multiple port scan types (horizontal, vertical, slow) through a single system that analyzes flow attributes across all ports and protocols. This multi-functional approach prevents attackers from evading detection by switching between different scan techniques or timing strategies.
4Measurement precision
If flow attribute aggregation is performed for all sources, then detection accuracy is improved, but memory usage increases
Solution Approach 1:
The patent applies different processing treatments to different sources based on their behavior patterns. Sources exhibiting suspicious activity receive more detailed analysis and aggregation, while normal sources are processed with less overhead. This localized quality approach maintains detection accuracy for threats while reducing memory usage for benign traffic.
Data Source
AI summary
Some embodiments provide a method for identifying security threats to a datacenter. From multiple host computers in the datacenter, the method receives attribute sets for multiple flows. Each respective attribute set for a respective flow includes at least (i) a source identifier for the respective flow and (ii) an indicator as to whether the respective flow is indicative of the source of the respective flow being a security threat. For each of multiple source identifiers, the method aggregates the received attribute sets to generate an aggregate attribute set for the source identifier that includes a combined measurement of security threat indicators. For a particular source identifier, the method adjusts a security threat likelihood score for the source corresponding to the particular source identifier based on the combined measurement of security threat indicators for the source identifier.