Method and apparatus for detecting scans in real-time
A method and apparatus for detecting scans are described. In one example, a plurality of flows is allocated into a plurality of bins associated with different source internet protocol (SIP) addresses. A set of bin characteristics for at least one bin of the plurality of bins is generated if the at least one bin reaches a predefined flow capacity. Afterwards, the set of bin characteristics is compared to a scan characteristics list to determine if a potential scan exists.
1. A method for detecting a potential scan, comprising:
allocating a plurality of flows into a plurality of bins based upon a source internet protocol address of each of the plurality of flows, where each bin of the plurality of bins is associated with a different source internet protocol address;
generating a set of bin characteristics for one bin of the plurality of bins if the one bin reaches a predefined flow capacity; and
comparing the set of bin characteristics to a scan characteristics list to determine if the potential scan exists.
2. The method of claim 1 , further comprising:
updating summary characteristics of the one bin if the set of bin characteristics matches an entry in the scan characteristics list.
3. The method of claim 2 , further comprising:
updating a flow count of the summary characteristics if the set of bin characteristics matches the summary characteristics.
4. The method of claim 3 , further comprising:
detecting a scan if the updated flow count exceeds a predetermined threshold.
5. The method of claim 3 , wherein the summary characteristics comprise a scan type and the flow count.
6. The method of claim 5 , wherein the scan type comprises a class based scan.
7. The method of claim 1 , wherein the bin characteristics comprise a source Internet protocol address, a destination internet protocol address, a source port, a destination port, a transmission control protocol flag, and a protocol.
8. A computer-readable medium having stored thereon a plurality of instructions, the plurality of instructions including instructions which, when executed by a processor, causes the processor to perform a method for detecting a potential scan, comprising:
allocating a plurality of flows into a plurality of bins based upon a source internet protocol address of each of the plurality of flows, where each bin of the plurality of bins is associated with a different source internet protocol address;
generating a set of bin characteristics for one bin of the plurality of bins if the one bin reaches a predefined flow capacity; and
comparing the set of bin characteristics to a scan characteristics list to determine if the potential scan exists.
9. The computer-readable medium of claim 8 , further comprising:
updating summary characteristics of the one bin if the set of bin characteristics matches an entry in the scan characteristics list.
10. The computer-readable medium of claim 9 , further comprising:
updating a flow count of the summary characteristics if the set of bin characteristics matches the summary characteristics.
11. The computer-readable medium of claim 10 , further comprising:
detecting a scan if the updated flow count exceeds a predetermined threshold.
12. The computer-readable medium of claim 10 , wherein the summary characteristics comprise a scan type and the flow count.
13. The computer-readable medium of claim 12 , wherein the scan type comprises a class based scan.
14. The computer-readable medium of claim 8 , wherein the bin characteristics comprise a source internet protocol address, a destination internet protocol address, a source port, a destination port, a transmission control protocol flag, and a protocol.
15. An apparatus for detecting scans a potential scan, comprising:
an application server configured to:
allocate a plurality of flows into a plurality of bins based upon a source internet protocol address of each of the plurality of flows, where each bin of the plurality of bins is associated with a different source internet protocol address;
generate a set of bin characteristics for one bin of the plurality of bins if the one bin reaches a predefined flow capacity; and
compare the set of bin characteristics to a scan characteristics list to determine if the potential scan exists.
16. The apparatus of claim 15 , wherein the application server is further configured to:
update summary characteristics of the one bin if the set of bin characteristics matches an entry in the scan characteristics list.
17. The apparatus of claim 16 , wherein the application server is further configured to:
update a flow count of the summary characteristics if the set of bin characteristics matches the summary characteristics.
18. The apparatus of claim 17 , wherein the application server is further configured to:
detect a scan if the updated flow count exceeds a predetermined threshold.
19. The apparatus of claim 17 , wherein the summary characteristics comprise a scan type and the flow count.
20. The apparatus of claim 15 , wherein the bin characteristics comprise a source Internet protocol address, a destination internet protocol address, a source port, a destination port, a transmission control protocol flag, and a protocol.