Port Scan Detection via Destination Profile Baselines
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting port scan attacks in computer networking are inadequate in identifying malicious activity, as they fail to effectively differentiate between legitimate and malicious port scans, leading to potential false alarms and missed threats.
Innovation Solution
A method that identifies pairs of source and destination nodes in network traffic, computes baseline and test scores for communication ports, and initiates preventive actions when abnormal access patterns are detected, using data traffic analysis to distinguish between legitimate and malicious port scans.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional port scan detection methods are used, then detection capability is provided, but false alarms increase and detection precision deteriorates
Solution Approach 1:
The patent segments the detection process into multiple independent components: destination profile creation, source behavior analysis, and multi-criteria evaluation. By dividing the detection system into these modular segments, it can analyze different aspects of port scan behavior separately and combine results for more accurate detection, reducing false alarms while maintaining detection precision.
Solution Approach 2:
The patent changes detection parameters by establishing baseline profiles of normal port access patterns and comparing test patterns against these profiles. It uses multiple parameters including number of ports accessed, time duration, source node history, and destination node characteristics. This multi-parameter approach enables more precise differentiation between legitimate and malicious scans, improving detection precision while reducing false alarms.
2Measurement precision
If comprehensive traffic analysis is performed, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent performs preliminary actions by pre-establishing destination profiles that capture normal port access patterns before actual detection begins. These profiles include baseline statistics about which ports are typically accessed, by whom, and under what conditions. This preliminary preparation reduces the complexity of real-time analysis by providing ready-made reference data for comparison.
Solution Approach 2:
The patent introduces an intermediary destination profile as a mediator between raw traffic data and detection decisions. Instead of directly analyzing complex traffic patterns, the system compares traffic against the intermediary profile, which simplifies the detection process. This intermediary layer handles the complexity of comprehensive analysis while presenting simplified results for decision-making.
3Reliability
If baseline comparison method is used, then false alarms are reduced, but computational requirements increase
Solution Approach 1:
The patent applies partial action by selecting only the most relevant baseline parameters for comparison rather than analyzing all possible traffic attributes. It focuses on key indicators such as the number of ports accessed within a time window and comparison against destination profiles, rather than performing exhaustive analysis of every packet. This selective approach reduces computational requirements while maintaining false alarm reduction effectiveness.
Data Source
AI summary
A method, including identifying, in network data traffic, a set of pairs of source and destination nodes, each pair having a given source node, a given destination node, and one or more ports accessed in the traffic between the nodes in each pair, and computing, for each pair, a respective baseline that indicates a first number of the ports that source nodes other than the given source node in the pair accessed on the given destination node during a first period. For each pair, a respective test score is computed that indicates a difference between a second number of the ports that the given source node in the pair accessed on the given destination node during a second period and the baseline, and a preventive action is initiated with respect to the given source node in any of the pairs for which the test score is greater than a threshold.