Granted Patent B2

US 12,542,789 · App. 17/700,579 · Granted Feb 3, 2026

Inventors: Yinnon Meshi (Kibbutz Revivim, IL); Idan Amit (Ramat Gan, IL); Jonathan Allon (Haifa, IL); Aviad Meyer (Hod-Hasharon, IL)

Assignee: Palo Alto Networks, Inc.

H04L63/1416H04L63/1475

Abstract

Claims (35)

1 . A method, comprising:

defining, for a given software category, first and second, mutually disjoint sets of logical communication port numbers that are used by different, respective first and second software systems in the given software category;

identifying port scans in data traffic transmitted between multiple nodes that communicate over a network, each of the port scans comprising accesses, in the data traffic, of a plurality of the logical communication port numbers on n a given destination node by a given source node during a predefined time period;

classifying a given port scan as suspicious upon detecting that in the given port scan the given source node has accessed on the given destination node both at least one of the logical communication port numbers in the first set and at least one of the logical communication port numbers in the second set; and

initiating a protective action upon classifying the given port scan as suspicious.

2 . The method according to claim 1 , wherein identifying the port scans comprises detecting a failed connection between the given source node and a given logical port number in the first set on the given destination node.

3 . The method according to claim 1 , wherein identifying the port scans comprises detecting accesses of at least a specified number of the logical communication port numbers in the first set, wherein the specified number is greater than one.

4 . The method according to claim 1 , wherein identifying the port scans comprises detecting at least a specified number of the logical communication port numbers in each of the first and the second sets, wherein the specified number is greater than one.

5 . The method according to claim 1 , wherein the first set consists of logical communication port numbers used by a first operating system, and the second set consists of logical communication port numbers used by a second operating system, different from the first operating system.

6 . The method according to claim 1 , wherein the first set consists of logical communication port numbers used by a first database server, and the second set consists of logical communication port numbers used by a second database server, different from the first database server.

7 . The method according to claim 1 , wherein the first set consists of logical communication port numbers used by a first email server, and the second set consists of logical communication port numbers used by a second email server, different from the first email server.

8 . The method according to claim 1 , wherein the first set consists of logical communication port numbers used by a first remote session application, and the second set consists of logical communication port numbers used by a second remote session application, different from the first remote session application.

9 . The method according to claim 1 , wherein initiating the preventive action comprises generating an alert for the given source node in the detected port scan.

10 . The method according to claim 1 , wherein initiating the preventive action comprises restricting access of the given source node in the detected port scan to the network.

11 . An apparatus, comprising:

a network interface device coupled to a data network comprising multiple nodes that communicate via the network; and

at least one processor configured:

to receive a definition of first and second, mutually disjoint sets of logical communication port numbers that are used by different, respective first and second software systems in the given software category,

to identify port scans in data traffic transmitted between multiple nodes that communicate over a network, each of the port scans comprising accesses, in the data traffic, of a plurality logical communication port numbers on a given destination node by a given source node during a predefined time period,

to classify a given port scan as suspicious upon detecting that in the given port scan the given source node has accessed on the given destination node both at least one of the logical communication port numbers in the first set and at least one of the logical communication port numbers in the second set, and

to initiate a protective action upon classifying the given port scan as suspicious.

12 . The apparatus according to claim 11 , wherein the at least one processor is configured to detect a failed connection between the given source node and a given logical port number in the first set on the given destination node.

13 . The apparatus according to claim 11 , wherein identifying the port scans comprises detecting accesses of at least a specified number of the logical communication port numbers in the first set, wherein the specified number is greater than one.

14 . The apparatus according to claim 11 , wherein identifying the port scans comprises detecting at least a specified number of the logical communication port numbers in each of the first and the second sets, wherein the specified number is greater than one.

15 . The apparatus according to claim 11 , wherein the first set consists of logical communication port numbers used by a first operating system, and the second set consists of logical communication port numbers used by a second operating system, different from the first operating system.

16 . The apparatus according to claim 11 , wherein the first set consists of logical communication port numbers used by a first database server, and the second set consists of logical communication port numbers used by a second database server, different from the first database server.

17 . The apparatus according to claim 11 , wherein the first set consists of logical communication port numbers used by a first email server, and the second set consists of logical communication port numbers used by a second email server, different from the first email server.

18 . The apparatus according to claim 11 , wherein the first set consists of logical communication port numbers used by a first remote session application, and the second set consists of logical communication port numbers used by a second remote session application, different from the first remote session application.

19 . The apparatus according to claim 11 , wherein the preventive action comprises generating an alert for the given source node in the detected port scan.

20 . The apparatus according to claim 11 , wherein the preventive action comprises restricting access of the given source node in the detected port scan to the network.

21 . A computer software product, the product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer:

to receive a definition of first and second, mutually disjoint sets of logical communication port numbers that are used by different, respective first and second software systems in the given software category;

to identify port scans in data traffic transmitted between multiple nodes that communicate over a network, each of the port scans comprising accesses, in the data traffic, of a plurality of the logical communication port numbers on a given destination node by a given source node during a predefined time period; and

to classify a given port scan as suspicious upon detecting that in the given port scan the given source node has accessed on the given destination node both at least one of the logical communication port numbers in the first set and at least one of the logical communication port numbers in the second set; and

to initiate a protective action upon classifying the given port scan as suspicious.

Assignments (2)

Continuity (2)

References Cited (178)