Port Scan Detection via Modified Reply Packets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current port scan protection software fails to block the actual IP address of hackers using fake source IP addresses during port scans, allowing them to launch denial-of-service attacks on open ports, leading to service unavailability and associated losses.
Innovation Solution
A method and apparatus that generate a modified reply data packet with a modified header, such as a bad sequence number or reset flag, to elicit a response from the actual source of a port scan, allowing identification and blocking of the true source IP address to prevent further attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current port scan protection software blocks the source IP address identified in port scan messages, then port scans are prevented, but hackers can circumvent by using fake source IP addresses, allowing attacks to continue
Solution Approach 1:
The system performs preliminary actions by sending a probe packet with a modified header (different source IP than the actual attacker) before blocking. This preliminary probe elicits a response from the attacker's real IP address, allowing the system to identify and block the actual source before the attacker can launch a full attack. The probe packet is sent to the IP address found in the port scan message, and if a response is received, that responding IP is identified as the real attacker.
Solution Approach 2:
The system uses an intermediary probe packet as a mediator between the detected port scan and the blocking action. The probe packet contains a modified header that acts as an intermediary mechanism - it's sent from the server but with a different source IP than the actual attacker, creating a intermediary communication channel that reveals the attacker's real identity without directly exposing the server's IP.
2Measurement precision
If the system sends probe packets to identify real hacker IP addresses, then accurate blocking is achieved, but network traffic and system resources are consumed
Solution Approach 1:
The system applies partial action by sending only a single probe packet with a modified header instead of multiple probes or comprehensive scanning. This partial action is sufficient to elicit a response from the attacker's real IP address without consuming excessive network resources. The probe packet is deliberately minimal - just enough to trigger a response and identify the real attacker.
Solution Approach 2:
The system rushes through the identification process by sending a single probe packet that quickly reveals the attacker's real IP address. Rather than performing extensive analysis or multiple probing steps, the system rapidly sends the probe and immediately blocks the responding IP, skipping unnecessary intermediate steps and reducing resource consumption while maintaining identification accuracy.
3Measurement precision
If modified reply data packets with bad sequence numbers or reset flags are sent, then hacker responses are elicited for identification, but protocol compliance is violated
Solution Approach 1:
The system applies preliminary anti-action by intentionally introducing protocol violations (bad sequence numbers, reset flags) into the probe packet header. These deliberate violations serve as a counter-measure to elicit a response from the attacker, who will typically respond to such anomalies. The protocol violation is the preliminary action that triggers the attacker's response, allowing identification of the real IP address.
Solution Approach 2:
The system converts the harm of protocol violation into a benefit. By deliberately sending packets with bad sequence numbers or reset flags, the system creates an anomaly that triggers the attacker's response mechanism. The protocol violation, which would normally be harmful or erroneous, becomes a useful tool for eliciting a response and identifying the attacker's real IP address.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
A computer implemented method, apparatus, and computer program product for port scan protection. A reply data packet having a modified transmission control protocol header is generated to form a modified reply data packet, in response to detecting a port scan. The modified reply data packet will illicit a response from a recipient of the modified data packet. The reply data packet is sent to a first Internet protocol address associated with the port scan. A second Internet protocol address is identified from a header of the response to the modified reply data packet. The second Internet protocol address is an actual Internet protocol address of a source of the port scan. All network traffic from the second Internet protocol address may be blocked to prevent an attack on any open ports from the source of the port scan.