Port Scan Detection Using Source Access Profiles
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting port scan attacks in computer networks are inadequate in distinguishing between legitimate and malicious activities, leading to potential false alarms and missed threats.
Innovation Solution
A method that identifies port scans by computing average access rates and access frequencies of source nodes to destination nodes over predefined time periods, assembling a whitelist of normal behavior, and initiating preventive actions for nodes not on the whitelist.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional port scan detection methods are used, then port scan attacks can be detected, but false alarms occur due to inability to distinguish legitimate and malicious activities
Solution Approach 1:
The patent changes the detection parameters from simple port access counting to computing average access rates and access frequencies over multiple time periods. This transforms the detection approach by introducing temporal dimensions (average over time periods, frequency of access) to distinguish legitimate scanning from malicious port scanning attacks
Solution Approach 2:
The system performs preliminary actions by computing baseline metrics (average number of destination nodes accessed, fraction of time periods with access) during a training phase before actual detection. These pre-computed metrics form the basis for comparing against new port scan activities, enabling the system to establish normal behavior patterns before evaluating suspicious activities
2Reliability
If comprehensive port scan detection is implemented, then security is improved, but system complexity increases due to multiple computations and thresholds
Solution Approach 1:
The patent segments the detection process into distinct computational stages: (1) identifying port scans in data traffic, (2) computing average destination nodes accessed, (3) computing fraction of time periods with access, (4) comparing against two separate thresholds. This segmentation makes the complex detection system more manageable and implementable by breaking it into discrete, sequential operations
3Speed
If real-time port scan detection is performed, then threats are detected promptly, but computational overhead increases due to continuous analysis of data traffic
Solution Approach 1:
The patent applies partial action by computing only two specific metrics (average destination nodes and time period fraction) rather than analyzing all possible port scan characteristics. This selective computation reduces the computational overhead while maintaining effective detection capability, balancing real-time performance with resource consumption
Data Source
AI summary
A method, including identifying, in network traffic during multiple periods, scans, each scan including an access of multiple ports on a given destination node by a given source node, and computing, for each given source in the scans, an average of destinations whose ports were accessed by the given source during any scan by the given source, and a fraction of periods when the given source accessed at least one of the destinations in at least one scan performed by the given source node. A whitelist is assembled sources for which one or more of the following conditions applies: the average of destinations accessed in the scans was greater than a first threshold, and the fraction of periods during which at least one destination was accessed in at least one scan was greater than a second threshold. Upon detecting a scan by any non-whitelisted node, a preventive action is initiated.