Port scan detection using destination profiles

1. A method, comprising:

identifying, in data traffic transmitted between multiple nodes that communicate over a network, a set of pairs of source and destination nodes, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in the data traffic between the source and destination nodes in each pair;

identifying one or more noisy scanners, each of the noisy scanners comprising a given source node that accesses at least a specified first number of destination ports on at least a second specified number of destination nodes;

computing, for each pair in the set, a respective baseline level that is indicative of a first number of the communication ports that source nodes, other than the given source node in the pair and other than any of the identified noisy scanners, accessed on the given destination node during a first time period;

computing, for each pair in the set, a respective test score that is indicative of a difference between a second number of the communication ports that the given source node in the pair accessed on the given destination node during a second time period and the baseline level; and

initiating a preventive action with respect to the given source node in any of the pairs for which the test score is greater than a specified level.

2. The method according to claim 1 , wherein identifying the pairs of source and destination nodes comprises collecting, from a probe, data packets transmitted over the network, aggregating the collected data packets into communication sessions between a given source node and a given destination node, and identifying, in each the aggregated communication sessions, the given source node accessing at least one given communication port on the given destination node.

3. The method according to claim 1 , wherein the specified level comprises a first specified level, wherein initiating the preventive action comprises initiating a first preventive action, and comprising identifying any failed connections in the port scans during the second time period, and initiating a second preventive action with respect to the given source node in any of the pairs having at least one of the identified failed connections and for which the test score is greater than a second specified level lower than the first specified level.

4. The method according to claim 1 , wherein the second time period is subsequent to the first time period.

5. The method according to claim 1 , wherein the first and the second time periods have substantially identical time durations.

6. The method according to claim 1 , wherein the first time period comprises multiple sub-periods, and wherein computing the test score for a given pair comprises computing separate baseline levels for each of the sub-periods, computing an average of the separate baseline levels, and subtracting the computed average from the second number of the communication ports.

7. The method according to claim 6 , wherein the second time period and each of the sub-periods have substantially identical time durations.

8. The method according to claim 1 , wherein initiating the preventive action comprises generating an alert for the given source node.

9. The method according to claim 1 , wherein initiating the preventive action comprises restricting access of the given source node to the network.

10. An apparatus, comprising:

a network interface controller coupled to a data network comprising multiple nodes that communicate via the network; and

at least one processor, each given processor comprising a general-purpose central processing unit (CPU) or a special-purpose embedded processor, which is programmed in software or firmware:

to identify, in data traffic transmitted between the multiple nodes over the network, a set of pairs of source and destination nodes, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in the data traffic between the source and destination nodes in each pair,

to identify one or more noisy scanners, each of the noisy scanners comprising a given source node that accesses at least a specified first number of destination ports on at least a second specified number of destination nodes,

to compute, for each pair in the set, a respective baseline level that is indicative of a first number of the communication ports that source nodes, other than the given source node in the pair and other than any of the identified noisy scanners, accessed on the given destination node during a first time period,

to compute, for each pair in the set, a respective test score that is indicative of a difference between a second number of the communication ports that the given source node in the pair accessed on the given destination node during a second time period and the baseline level, and

to initiate a preventive action with respect to the given source node in any of the pairs for which the test score is greater than a specified level.

11. The apparatus according to claim 10 , wherein a given processor is configured to identify the pairs of source and destination nodes by collecting, from a probe, data packets transmitted over the network, aggregating the collected data packets into communication sessions between a given source node and a given destination node, and identifying, in each the aggregated communication sessions, the given source node accessing at least one given communication port on the given destination node.

12. The apparatus according to claim 10 , wherein the specified level comprises a first specified level, wherein a given processor is configured to initiate the preventive action by initiating a first preventive action, and comprising identifying any failed connections in the port scans during the second time period, and initiating a second preventive action with respect to the given source node in any of the pairs having at least one of the identified failed connections and for which the test score is greater than a second specified level lower than the first specified level.

13. The apparatus according to claim 10 , wherein the second time period is subsequent to the first time period.

14. The apparatus according to claim 10 , wherein the first and the second time periods have substantially identical time durations.

15. The apparatus according to claim 10 , wherein the first time period comprises multiple sub-periods, and wherein a given processor is configured to compute the test score for a given pair by computing separate baseline levels for each of the sub-periods, computing an average of the separate baseline levels, and subtracting the computed average from the second number of the communication ports.

16. The apparatus according to claim 15 , wherein the second time period and each of the sub-periods have substantially identical time durations.

17. The apparatus according to claim 10 wherein a given processor is configured to initiate the preventive action by generating an alert for the given source node.

18. The apparatus according to claim 10 , a given processor is configured to initiate the preventive action by restricting access of the given source node to the network.

19. A computer software product, the product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer:

to identify, in data traffic transmitted between multiple nodes that communicate over a network, a set of pairs of source and destination nodes, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in the data traffic between the source and destination nodes in each pair;

to identify one or more noisy scanners, each of the noisy scanners comprising a given source node that accesses at least a specified first number of destination ports on at least a second specified number of destination nodes;

to compute, for each pair in the set, a respective baseline level that is indicative of a first number of the communication ports that source nodes, other than the given source node in the pair and other than any of the identified noisy scanners, accessed on the given destination node during a first time period;

to compute, for each pair in the set, a respective test score that is indicative of a difference between a second number of the communication ports that the given source node in the pair accessed on the given destination node during a second time period and the baseline level; and

to initiate a preventive action with respect to the given source node in any of the pairs for which the test score is greater than a specified level.

20. A method, comprising:

identifying, in data traffic transmitted between multiple nodes that communicate over a network, a set of pairs of source and destination nodes, each pair consisting of a given source node and a given destination node, and one or more communication ports accessed in the data traffic between the source and destination nodes in each pair;

computing, for each pair in the set during a first time period comprising multiple sub-periods, respective baseline levels that is indicative of a first number of the communication ports that source nodes other than the given source node in the pair accessed on the given destination node during each of the sub-periods;

computing, for each of the pairs in the set, an average of the respective baseline levels for the each of the pairs;

computing, for each given pair in the set, a respective test score that is indicative of a difference between a second number of the communication ports that the given source node in the pair accessed on the given destination node during a second time period and the computed average baseline level for the given pair; and

initiating a preventive action with respect to the given source node in any of the pairs for which the test score is greater than a specified level.