Scanner probe detection
A method, including identifying, in network data traffic, multiple scans, each of the scans including an access, in the traffic, of multiple ports on a given destination node by a given source node during a time period. A group of high-traffic ports are identified in the traffic that include one or more ports that receive respective volumes of the traffic that exceed a threshold, and respective signatures are generated for the identified port scans that indicate the ports other than the high-traffic ports that were accessed in each of the port scans. A respective frequency of occurrence of each of the signatures over the set of the port scans is computed, and a whitelist of the signatures for which the respective frequency of occurrence is greater than a threshold is assembled. Upon detecting a port scan for which the respective signature is not whitelisted, a preventive action is initiated.
1. A method, comprising:
identifying, in data traffic transmitted between multiple nodes that communicate over a network, a set of port scans, each of the port scans comprising an access, in the data traffic, of a plurality of communication ports on a given destination node by a given source node during a predefined time period;
identifying in the data traffic a group of high-traffic ports, comprising one or more of the communication ports that receive respective volumes of the data traffic that are in excess of a predefined threshold;
generating, for the identified port scans respective signatures indicative of the communication ports, other than the high-traffic ports, that were accessed in each of the port scans;
computing a respective frequency of occurrence of each of the signatures over the set of the port scans;
assembling a whitelist of the signatures for which the respective frequency of occurrence is greater than a predefined threshold; and
upon detecting a port scan for which the respective signature is not on the whitelist, initiating a preventive action.
2. The method according to claim 1 , wherein identifying the port scans comprises:
identifying, in the data traffic, a set of pairs of the source and the destination nodes, each pair consisting of a given source node and a given destination node, and one or more of the communication ports accessed in the data traffic between the source and destination nodes in each pair;
computing, for each pair in the set, a respective baseline level that is indicative of a first number of the communication ports that source nodes other than the given source node in the pair accessed on the given destination node during a first time period;
computing, for each pair in the set, a respective test score that is indicative of a difference between a second number of the communication ports that the given source node in the pair accessed on the given destination node during a second time period and the baseline level; and
designating any of the pairs for which the test score is greater than a specified level as the port scans.
3. The method according to claim 1 , wherein the specified time period comprises multiple sub-periods comprising a set of first sub-periods and a second sub-period subsequent to the first sub-periods; wherein the step of computing the respective frequency of occurrence of each of the signatures is performed on the port scans in the first sub-periods, and wherein detecting the port scan is during the second sub-period.
4. The method according to claim 3 , wherein each of the sub-periods have substantially identical time durations.
5. The method according to claim 1 , wherein computing the respective frequency of occurrence of each of the signatures over the set of the port scans comprises determining, for each given unique signature, a count of scans matching the given unique signature; and wherein the whitelist comprises the unique signatures whose respective counts of matching scans are greater than a specified number.
6. The method according to claim 1 , wherein computing the respective frequency of occurrence of each of the signatures over the set of the port scans comprises determining, for each given unique signature, a count of unique source nodes in the scans matching the given unique signature; and wherein the whitelist comprises the unique signatures for which one or more of the following conditions was found to apply:
the count of the unique source nodes is greater than a first value, and
the count of the unique source nodes is less than a second value.
7. The method according to claim 1 , wherein computing the respective frequency of occurrence of each of the signatures over the set of the port scans comprises determining, for each given unique signature, a count of unique destination nodes in the scans matching the given unique signature; and wherein the whitelist comprises the unique signatures for which one or more of the following conditions was found to apply:
the count of the unique destination nodes is greater than a first value, and
the count of the unique destination nodes is less than a second value.
8. The method according to claim 1 , wherein the high-traffic port is associated with a given destination node.
9. The method according to claim 1 , wherein initiating the preventive action comprises generating an alert for the given source node in the detected port scan.
10. The method according to claim 1 , wherein initiating the preventive action comprises restricting access of the given source node in the detected port scan to the network.
11. An apparatus, comprising:
a network interface device coupled to a data network comprising multiple nodes that communicate via the network; and
at least one processor configured:
to identify, in data traffic transmitted between multiple nodes that communicate over a network, a set of port scans, each of the port scans comprising an access, in the data traffic, of a plurality of communication ports on a given destination node by a given source node during a predefined time period;
to identify in the data traffic a group of high-traffic ports, comprising one or more of the communication ports that receive respective volumes of the data traffic that are in excess of a predefined threshold;
to generate, for the identified port scans respective signatures indicative of the communication ports, other than the high-traffic ports, that were accessed in each of the port scans;
to compute a respective frequency of occurrence of each of the signatures over the set of the port scans;
to assemble a whitelist of the signatures for which the respective frequency of occurrence is greater than a predefined threshold; and
upon detecting a port scan for which the respective signature is not on the whitelist, to initiate a preventive action.
12. The apparatus according to claim 11 , wherein a given processor is configured to identify the port scans by:
identifying, in the data traffic, a set of pairs of the source and the destination nodes, each pair consisting of a given source node and a given destination node, and one or more of the communication ports accessed in the data traffic between the source and destination nodes in each pair;
computing, for each pair in the set, a respective baseline level that is indicative of a first number of the communication ports that source nodes other than the given source node in the pair accessed on the given destination node during a first time period;
computing, for each pair in the set, a respective test score that is indicative of a difference between a second number of the communication ports that the given source node in the pair accessed on the given destination node during a second time period and the baseline level; and
designating any of the pairs for which the test score is greater than a specified level as the port scans.
13. The apparatus according to claim 11 , wherein the specified time period comprises multiple sub-periods comprising a set of first sub-periods and a second sub-period subsequent to the first sub-periods; wherein a given processor is configured to perform the step of computing the respective frequency of occurrence of each of the signatures on the port scans in the first sub-periods, and wherein a given processor is configured to detect the port scan during the second sub-period.
14. The apparatus according to claim 13 , wherein each of the sub-periods have substantially identical time durations.
15. The apparatus according to claim 11 , wherein a given processor is configured to compute the respective frequency of occurrence of each of the signatures over the set of the port scans by determining, for each given unique signature, a count of scans matching the given unique signature; and wherein the whitelist comprises the unique signatures whose respective counts of matching scans are greater than a specified number.
16. The apparatus according to claim 11 , wherein a given processor is configured to compute the respective frequency of occurrence of each of the signatures over the set of the port scans by determining, for each given unique signature, a count of unique source nodes in the scans matching the given unique signature; and wherein the whitelist comprises the unique signatures for which one or more of the following conditions was found to apply:
the count of the unique source nodes is greater than a first value, and
the count of the unique source nodes is less than a second value.
17. The apparatus according to claim 11 , wherein a given processor is configured to compute the respective frequency of occurrence of each of the signatures over the set of the port scans by determining, for each given unique signature, a count of unique destination nodes in the scans matching the given unique signature; and wherein the whitelist comprises the unique signatures for which one or more of the following conditions was found to apply:
the count of the unique destination nodes is greater than a first value, and
the count of the unique destination nodes is less than a second value.
18. The apparatus according to claim 11 , wherein the high-traffic port is associated with a given destination node.
19. The apparatus according to claim 11 , wherein a given processor is configured to initiate the preventive action by generating an alert for the given source node in the detected port scan.
20. The apparatus according to claim 11 , wherein a given processor is configured to initiate the preventive action by restricting access of the given source node in the detected port scan to the network.
21. A non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer:
to identify, in data traffic transmitted between multiple nodes that communicate over a network, a set of port scans, each of the port scans comprising an access, in the data traffic, of a plurality of communication ports on a given destination node by a given source node during a predefined time period;
to identify in the data traffic a group of high-traffic ports, comprising one or more of the communication ports that receive respective volumes of the data traffic that are in excess of a predefined threshold;
to generate, for the identified port scans respective signatures indicative of the communication ports, other than the high-traffic ports, that were accessed in each of the port scans;
to compute a respective frequency of occurrence of each of the signatures over the set of the port scans;
to assemble a whitelist of the signatures for which the respective frequency of occurrence is greater than a predefined threshold; and
upon detecting a port scan for which the respective signature is not on the whitelist, to initiate a preventive action.