Multi-stage scanning of computer devices from different geographic locations

1. A method, comprising:

performing, by one or more hardware processors and associated memory that implement a computing system:

receiving a list of target devices in a network;

distributing the list among a plurality of collection nodes, wherein individual ones of the plurality of collection nodes are configured to scan individual target devices to determine open port and protocol combinations on the individual target devices, and the collection nodes are deployed at a plurality of geographic locations;

determining, based on a scan of the target devices by the collection nodes, that a target device in the network has an open port associated with a particular protocol;

interrogating, by the collection nodes, the target device to perform a protocol-specific analysis of the open port of the target device, wherein the interrogation is performed by at least a first collection node at a first geographic location and a second collection node at a second geographic location;

comparing results of the interrogation obtained by the first collection node and the second collection node to observe a difference in behavior of the target device when interrogated from the first geographic location and the second geographic location; and

storing, in a database, results of the protocol-specific analysis including the observed difference in the behavior of the target device when interrogated from the first geographic location and the second geographic location.

2. The method of claim 1 , wherein the first and second collection nodes are operated by different infrastructure providers.

3. The method of claim 1 , wherein the interrogation is performed according to a configuration that specifies to interrogate the target device from different geographic locations.

4. The method of claim 1 , further comprising the computer system:

using the collection nodes to repeatedly interrogate the target device over time; and

determining, based on the repeated interrogations, a configuration change of the target device over time.

5. The method of claim 1 , further comprising the computing system:

determining that the target device allows scanning from one or more specific collection locations; and

selecting one or more collection nodes to scan the target device from the one or more specific collection locations.

6. The method of claim 1 , wherein distributing the list of target devices among the collection nodes comprises distributing batches of target devices to individual ones of the collection nodes, wherein the batches are of a configurable size.

7. The method of claim 1 , further comprising the computing system scaling up an amount of the collection nodes in response to an increase in demand for the collection nodes.

8. The method of claim 1 , wherein:

the interrogation of the target device is performed as part of a monitoring of the network by the computing system; and

the method further comprises the computing system generating an alert about the target device based on the protocol-specific analysis of the target device.

9. The method of claim 1 , further comprising the computing system:

storing in the database results of protocol-specific analysis performed on other target devices in the network; and

generating, on a user interface, a summarization of the target devices based on the results of the protocol-specific analysis stored in the database.

10. The method of claim 1 , further comprising the computing system:

generating, on a user interface, the observed difference in the behavior of the target device when interrogated from the first geographic location and the second geographic location.

11. A system comprising:

one or more hardware processors and associated memory that implement a computing system, configured to:

receive a list of target devices in a network;

distribute the list among a plurality of collection nodes, wherein individual ones of the plurality of collection nodes are configured to scan individual target devices to determine open port and protocol combinations on the individual target devices, and the collection nodes are deployed at a plurality of geographic locations;

determine, based on a scan of the target devices by the collection nodes, that a target device in the network has an open port associated with a particular protocol;

interrogate, by the collection nodes, the target device to perform a protocol-specific analysis of the open port of the target device, wherein the interrogation is performed by at least a first collection node at a first geographic location and a second collection node at a second geographic location;

compare results of the interrogation obtained by the first collection node and the second collection node to observe a difference in behavior of the target device when interrogated from the first geographic location and the second geographic location; and

store, in a database, results of the protocol-specific analysis including the observed difference in the behavior of the target device when interrogated from the first geographic location and the second geographic location.

12. The system of claim 11 , wherein the first and second collection nodes are operated by different infrastructure providers.

13. The system of claim 11 , wherein the computer system is configured to:

use the collection nodes to repeatedly interrogate the target device over time; and

determine, based on the repeated interrogations, a configuration change of the target device over time.

14. The system of claim 11 , wherein the computer system is configured to:

determine that the target device allows scanning from one or more specific collection locations; and

select one or more collection nodes to scan the target device from the one or more specific collection locations.

15. The system of claim 11 , wherein the computing system is configured to:

store open port and protocol combination about the target devices in a queueing service.

16. The system of claim 11 , wherein the computing system is configured to:

receive a request to opt out a particular target device from scanning; and

exclude the particular target device from the list of target devices.

17. The system of claim 11 , the computing system is configured to:

scale up an amount of the collection nodes in response to an increase in demand for the collection nodes.

18. The system of claim 11 , wherein:

the interrogation of the target device is performed as part of a monitoring of the network by the computing system; and

the computing system is configured to generate an alert about the target device based on the protocol-specific analysis of the target device.

19. The system of claim 11 , wherein the computing system is configured to:

generate, on a user interface, the observed difference in the behavior of the target device when interrogated from the first geographic location and the second geographic location.

20. One or more non-transitory computer-readable storage media storing program instructions that when executed on one or more processors of a computing system cause the computing system to:

receive a list of target devices in a network;

distribute the list among a plurality of collection nodes, wherein individual ones of the plurality of collection nodes are configured to scan individual target devices to determine open port and protocol combinations on the individual target devices, and the collection nodes are deployed at a plurality of geographic locations;

determine, based on a scan of the target devices by the collection nodes, that a target device in the network has an open port associated with a particular protocol;

interrogate, by the collection nodes, the target device to perform a protocol-specific analysis of the open port of the target device, wherein the interrogation is performed by at least a first collection node at a first geographic location and a second collection node at a second geographic location;

compare results of the interrogation obtained by the first collection node and the second collection node to observe a difference in behavior of the target device when interrogated from the first geographic location and the second geographic location; and

store, in a database, results of the protocol-specific analysis including the observed difference in the behavior of the target device when interrogated from the first geographic location and the second geographic location.