Distributed Port Scan Detection via Terminal Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting unauthorized port scanning in computer networks require significant central terminal resources, limiting the ability to maintain a long history of connections and detecting distributed scans, which are often ineffective in preventing cyber attacks.
Innovation Solution
A distributed method where each terminal in the network analyzes connections and stores security information in a shared memory, allowing for real-time detection of unauthorized port scans and alerting mechanisms, thereby reducing the burden on central resources and enhancing detection capabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a centralized method is used where a central terminal analyzes all connections, then detection capability is improved, but resource consumption and device complexity increase significantly
Solution Approach 1:
The patent divides the centralized detection system into distributed analysis units deployed at multiple terminals throughout the network. Each terminal runs a local analysis unit that independently analyzes connections to and from that terminal, segmenting the detection function across multiple nodes rather than concentrating it at a single central terminal. This reduces the resource burden on any single device while maintaining comprehensive detection coverage.
Solution Approach 2:
The patent introduces a new dimension of detection by analyzing connections from the perspective of each individual terminal rather than only from a central viewpoint. This distributed perspective allows the system to detect port scans that may be targeted at specific terminals without overwhelming any single analysis unit with all network traffic data.
2Measurement precision
If a central terminal stores and analyzes all connection information, then detection accuracy is improved, but the ability to maintain long connection history is limited due to resource constraints
Solution Approach 1:
The patent segments the connection history storage function across multiple terminals rather than centralizing it. Each terminal maintains its own connection history locally, allowing the network as a whole to retain comprehensive historical data without overloading a single central storage system. This distributed storage approach enables longer retention periods while managing resource constraints at each node.
3Measurement precision
If centralized detection is implemented, then port scan detection is improved, but distributed scans from multiple terminals cannot be detected
Solution Approach 1:
The patent deploys analysis units at multiple segmented locations throughout the network, enabling each terminal to detect scans targeted at it. This segmentation allows the system to detect distributed scans originating from multiple terminals, as each terminal's analysis unit can identify scan patterns emanating from other nodes.
Solution Approach 2:
The patent implements feedback mechanisms where analysis units at different terminals exchange information about detected connections and scan patterns. This feedback loop enables the distributed system to correlate data across terminals and identify coordinated scan activities originating from multiple sources, improving detection of distributed attacks.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
The network consists of a plurality of terminals, each defining a plurality of ports. Each terminal is associated with a terminal identifier, and each port with a port identifier. At least some of the terminals, called initiating terminals, are capable of initiating a connection with another terminal, called a receiving terminal, via at least one port of that receiving terminal. The process (100) comprises the following steps: - detection (110) of each connection initiated by an initiating terminal; - identification (120) of rejected connections among all initiated connections; - for each rejected connection, generation (130) of a security information including the identifiers of the receiving terminal and one of its ports, and addition (140) of the security information to a shared database; - analysis (150) of the database to determine unauthorized port scans.