Scanner probe detection
A method, including identifying, in network data traffic, multiple scans, each of the scans including an access, in the traffic, of multiple ports on a given destination node by a given source node during a time period. A group of high-traffic ports are identified in the traffic that include one or more ports that receive respective volumes of the traffic that exceed a threshold, and respective signatures are generated for the identified port scans that indicate the ports other than the high-traffic ports that were accessed in each of the port scans. A respective frequency of occurrence of each of the signatures over the set of the port scans is computed, and a whitelist of the signatures for which the respective frequency of occurrence is greater than a threshold is assembled. Upon detecting a port scan for which the respective signature is not whitelisted, a preventive action is initiated.
1. A method, comprising:
identifying, in data traffic transmitted between multiple nodes that communicate over a network, a set of port scans, each of the port scans comprising an access, in the data traffic, of a plurality of communication ports on a given destination node by a given source node during a specified time period;
identifying in the data traffic a group of high-traffic ports, comprising one or more of the communication ports that receive respective volumes of the data traffic that are in excess of a predefined threshold; and
upon detecting a port scan not comprising the access of any of the identified high-traffic ports, initiating a preventive action.
2. The method according to claim 1 , wherein identifying the port scans comprises:
identifying, in the data traffic, a set of pairs of the source and the destination nodes, each pair consisting of a given source node and a given destination node, and one or more of the communication ports accessed in the data traffic between the source and destination nodes in each pair;
computing, for each pair in the set, a respective baseline level that is indicative of a first number of the communication ports that source nodes other than the given source node in the pair accessed on the given destination node during a first time period;
computing, for each pair in the set, a respective test score that is indicative of a difference between a second number of the communication ports that the given source node in the pair accessed on the given destination node during a second time period and the baseline level; and
designating any of the pairs for which the test score is greater than a specified level as the port scans.
3. The method according to claim 1 , wherein the specified time period comprises multiple sub-periods comprising a set of first sub-periods and a second sub-period subsequent to the first sub-periods; wherein the step of computing the respective frequency of occurrence of each of the signatures is performed on the port scans in the first sub-periods; and wherein detecting the port scan is during the second sub-period.
4. The method according to claim 3 , wherein each of the sub-periods have substantially identical time durations.
5. The method according to claim 1 , wherein detecting the port scan not comprising the access of any of the identified high-traffic ports comprises generating, for the identified port scans, respective signatures indicative of the communication ports, other than the high-traffic ports, that were accessed in each of the port scans; computing a respective frequency of occurrence of each of the signatures over the set of the port scans; and detecting a port scan whose respective frequency is less than a predefined threshold.
6. The method according to claim 5 , wherein computing the respective frequency of occurrence of each of the signatures over the set of the port scans comprises determining, for each given unique signature, a count of scans matching the given unique signature; and wherein detecting the port scan whose respective frequency is less than the predefined threshold comprises detecting a port scan for which the count of scans for the respective signature is less than or equal to a specified number.
7. The method according to claim 5 , wherein computing the respective frequency of occurrence of each of the signatures over the set of the port scans comprises determining, for each given unique signature, a count of unique source nodes in the scans matching the given unique signature; and wherein detecting the port scan whose respective frequency is less than the predefined threshold comprises detecting a port scan for which the following conditions apply to the respective signature:
the count of the unique source nodes is less than or equal to a first value, and
the count of the unique source nodes is greater than or equal to a second value.
8. The method according to claim 5 , wherein computing the respective frequency of occurrence of each of the signatures over the set of the port scans comprises determining, for each given unique signature, a count of unique destination nodes in the scans matching the given unique signature; and wherein detecting the port scan whose respective frequency is less than the predefined threshold comprises detecting a port scan for which the following conditions apply to the respective signature:
the count of the unique destination nodes is less than or equal to a first value, and
the count of the unique destination nodes is greater than or equal to a second value.
9. The method according to claim 1 , wherein the high-traffic port is associated with a given destination node.
10. The method according to claim 1 , wherein initiating the preventive action comprises generating an alert for the given source node in the detected port scan.
11. The method according to claim 1 , wherein initiating the preventive action comprises restricting access of the given source node in the detected port scan to the network.
12. An apparatus, comprising:
a network interface device coupled to a data network comprising multiple nodes that communicate via the network; and
at least one processor configured:
to identify, in data traffic transmitted between multiple nodes that communicate over a network, a set of port scans, each of the port scans comprising an access, in the data traffic, of a plurality of communication ports on a given destination node by a given source node during a specified time period;
to identify in the data traffic a group of high-traffic ports, comprising one or more of the communication ports that receive respective volumes of the data traffic that are in excess of a predefined threshold; and
upon detecting a port scan not comprising the access of any of the identified high-traffic ports, to initiate a preventive action.
13. The apparatus according to claim 12 , wherein a given processor is configured to identify the port scans by:
identifying, in the data traffic, a set of pairs of the source and the destination nodes, each pair consisting of a given source node and a given destination node, and one or more of the communication ports accessed in the data traffic between the source and destination nodes in each pair;
computing, for each pair in the set, a respective baseline level that is indicative of a first number of the communication ports that source nodes other than the given source node in the pair accessed on the given destination node during a first time period;
computing, for each pair in the set, a respective test score that is indicative of a difference between a second number of the communication ports that the given source node in the pair accessed on the given destination node during a second time period and the baseline level; and
designating any of the pairs for which the test score is greater than a specified level as the port scans.
14. The apparatus according to claim 12 , wherein the specified time period comprises multiple sub-periods comprising a set of first sub-periods and a second sub-period subsequent to the first sub-periods; wherein a given processor is configured, in the first sub-periods, to perform the step of computing the respective frequency of occurrence of each of the signatures; and wherein a given processor is configured to detect the port scan during the second sub-period.
15. The apparatus according to claim 14 , wherein each of the sub-periods have substantially identical time durations.
16. The apparatus according to claim 12 , wherein a given processor is configured to detect the port scan not comprising the access of any of the identified high-traffic ports by generating, for the identified port scans, respective signatures indicative of the communication ports, other than the high-traffic ports, that were accessed in each of the port scans; computing a respective frequency of occurrence of each of the signatures over the set of the port scans; and detecting a port scan whose respective frequency is less than a predefined threshold.
17. The apparatus according to claim 16 , wherein a given processor is configured to compute the respective frequency of occurrence of each of the signatures over the set of the port scans by determining, for each given unique signature, a count of scans matching the given unique signature; and wherein a given processor is configured to detect the port scan whose respective frequency is less than the predefined threshold by detecting a port scan for which the count of scans for the respective signature is less than or equal to a specified number.
18. The apparatus according to claim 16 , wherein a given processor is configured to compute the respective frequency of occurrence of each of the signatures over the set of the port scans by determining, for each given unique signature, a count of unique source nodes in the scans matching the given unique signature; and wherein a given processor is configured to detect the port scan whose respective frequency is less than the predefined threshold by detecting a port scan for which the following conditions apply to the respective signature:
the count of the unique source nodes is less than or equal to a first value, and
the count of the unique source nodes is greater than or equal to a second value.
19. The apparatus according to claim 16 , wherein a given processor is configured to compute the respective frequency of occurrence of each of the signatures over the set of the port scans by determining, for each given unique signature, a count of unique destination nodes in the scans matching the given unique signature; and wherein a given processor is configured to detect the port scan whose respective frequency is less than the predefined threshold by detecting a port scan for which the following conditions apply to the respective signature:
the count of the unique destination nodes is less than or equal to a first value, and
the count of the unique destination nodes is greater than or equal to a second value.
20. The apparatus according to claim 12 , wherein the high-traffic port is associated with a given destination node.
21. The apparatus according to claim 12 , wherein a given processor is configured to initiate the preventive action by generating an alert for the given source node in the detected port scan.
22. The apparatus according to claim 12 , wherein a given processor is configured to initiate the preventive action by restricting access of the given source node in the detected port scan to the network.
23. A non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer:
to identify, in data traffic transmitted between multiple nodes that communicate over a network, a set of port scans, each of the port scans comprising an access, in the data traffic, of a plurality of communication ports on a given destination node by a given source node during a specified time period;
to identify in the data traffic a group of high-traffic ports, comprising one or more of the communication ports that receive respective volumes of the data traffic that are in excess of a predefined threshold; and
upon detecting a port scan not comprising the access of any of the identified high-traffic ports, to initiate a preventive action.