Parallel Port Scanning via Source IP Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large organizations face challenges in configuring network security appliances to allow ethical port scanning due to technical, organizational, or operational reasons, leading to unfeasible detection of malicious activities and vulnerabilities, as existing port scanning techniques are often detected and blocked by security appliances, requiring stealthy methods that are time-consuming and inefficient.
Innovation Solution
The method involves parallelizing port scan processes on a single machine using different source IP addresses to send probe requests to sets of ports, reducing overall scan time and avoiding detection by security appliances, while synchronizing processes to minimize overhead and adjusting probe rates to evade detection thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If port scanning is performed using traditional sequential methods to evade detection by security appliances, then the scanning can remain undetected, but the scanning time becomes excessively long (e.g., 17 hours for a single target)
Solution Approach 1:
The patent segments the port scanning task into multiple parallel processes, each responsible for scanning a specific subset of ports from different source IP addresses. This allows the scanning to be distributed across multiple channels simultaneously, reducing total scanning time while maintaining stealth by keeping individual process rates below detection thresholds
Solution Approach 2:
The patent combines multiple scanning processes into a coordinated parallel operation system. Multiple source IP addresses and multiple target port subsets are merged into a unified scanning framework that manages synchronization and resource allocation, achieving both speed and stealth through coordinated parallel execution
2Productivity
If the probe rate is increased to reduce scanning time, then scanning efficiency improves, but the likelihood of detection by security appliances increases
Solution Approach 1:
The patent applies partial action by having each individual scanning process send probes at a rate below the detection threshold, while the aggregate of all parallel processes achieves high overall scanning efficiency. Each process performs 'partial' scanning of a port subset at low intensity, but the combined effect covers the entire port range rapidly
Solution Approach 2:
The patent changes multiple parameters simultaneously: it varies source IP addresses, divides target port ranges into subsets, and adjusts probe timing intervals. By modifying these parameters across multiple parallel processes, the system achieves high productivity while each individual process maintains parameters that avoid detection
3Measurement precision
If multiple target hosts are scanned sequentially to ensure thorough coverage, then all targets are scanned completely, but the total scanning time increases proportionally with the number of targets
Solution Approach 1:
The patent segments both the target host list and port ranges into multiple subsets, assigning different combinations to parallel processes. This allows comprehensive coverage of all targets while distributing the workload across multiple simultaneous scanning operations, reducing total time from linear to near-parallel execution
Solution Approach 2:
The patent creates a universal scanning framework that can simultaneously handle multiple target hosts, multiple port subsets, and multiple source IP addresses. This multi-functional system can adapt to scan any combination of targets and ports in parallel, achieving complete coverage efficiency regardless of the number of targets
Data Source
Figure 1
Figure 2~4
Figure 3A
AI summary
A method of scanning a plurality of ports at one or more target IP addresses is disclosed. Each of the plurality of ports corresponds to a port number at one of the one or more target IP addresses, for example an IPv4 or IPv6 address. The method comprises assigning each port to one of a plurality of sets of ports and executing a plurality of port scanning processes at the same time on a common source machine (virtual or physical). Each port scanning process sends port probe requests to the ports of a respective set of the plurality of sets from a different respective source IP addresses. Thus, a different respective source IP address is associated with each set of the plurality of sets of ports, different from the source IP addresses associated with the remaining sets, and each set of target IP addresses receives probe requests from a different respective source IP address. The sets may be aligned with target addresses or may spread several target addresses or only part of the ports of a target address. For example, one or more of the plurality of port scanning processes may send port probe requests to more than one target IP address and/or two or more of the plurality of port scanning processes may send port probe requests to the same target IP address.