Port Profile Scan Detection for Lower False Positives
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to effectively detect malicious port scans, which are used by hackers to probe networks for exploitable ports and map services, lacking robust methods to differentiate between legitimate and suspicious port scan activities.
Innovation Solution
The method involves defining disjoint sets of communication ports used by software categories, identifying port scans through access patterns, and initiating preventive actions when anomalous combinations are detected, using baseline levels and test scores to flag potential malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional port scan detection methods are used, then detection capability is limited, but false positives increase and legitimate traffic is misclassified
Solution Approach 1:
The patent segments the detection approach by creating separate port profile databases for different software categories (e.g., web servers, database servers, mail servers). Each category has its own characteristic port patterns, allowing the system to analyze traffic against category-specific profiles rather than using a single generic detection method, thereby improving accuracy while reducing false positives
Solution Approach 2:
The patent changes the detection parameters by transitioning from simple port number matching to analyzing combinations of ports within categorized software groups. The system evaluates multiple parameters simultaneously including port category, port combinations, access frequency, and temporal patterns, enabling more precise detection with fewer false alarms
2Difficulty of detecting and measuring
If comprehensive port monitoring is implemented, then detection coverage improves, but system complexity increases
Solution Approach 1:
The patent reduces system complexity through segmentation by organizing ports into categorical groups (web services, database services, mail services, etc.). This structured approach allows comprehensive monitoring to be broken down into manageable category-specific analyses, making the overall system more tractable while maintaining wide detection coverage
Solution Approach 2:
The patent applies universality by creating a multi-functional port profile database that serves multiple detection purposes simultaneously. The same categorized port profiles are used for various types of traffic analysis, pattern matching, and anomaly detection across different software categories, reducing the need for separate detection mechanisms for each scenario
Data Source
AI summary
Methods, apparatus and computer software products implement embodiments of the present invention that include defining, for a given software category, respective, disjoint sets of communication ports that are used by each of a plurality of software systems in the given software category, including at least first and second disjoint sets. A set of port scans are identified in data traffic transmitted between multiple nodes that communicate over a network, each of the port scans including an access, in the data traffic, of a plurality of the communication ports on a given destination node by a given source node during a predefined time period. Upon detecting a port scan by one of the nodes including accesses of at least one of the communication ports in the first set and at least one of the communication ports in the second set, a preventive action is initiated.