Method and apparatus for detecting scans in real-time
A method and apparatus for detecting scans are described. In one example, a plurality of flows is allocated into a plurality of bins associated with different source Internet protocol (SIP) addresses. A set of bin characteristics for at least one bin of the plurality of bins is generated if the at least one bin reaches a predefined flow capacity. Afterwards, the set of bin characteristics is compared to a scan characteristics list to determine if a potential scan exists.
1. A method for detecting a scan, comprising:
allocating, by a processor, a plurality of flows into a plurality of bins based upon a source internet protocol address of each of the plurality of flows, where each bin of the plurality of bins is associated with a different source internet protocol address;
generating, by the processor, a set of bin characteristics for one bin of the plurality of bins if the one bin reaches a predefined flow capacity; and
comparing, by the processor, the set of bin characteristics to a scan characteristics list to determine if the scan exists.
2. The method of claim 1 , further comprising:
updating summary characteristics of the one bin if the set of bin characteristics matches an entry in the scan characteristics list.
3. The method of claim 2 , further comprising:
updating a flow count of the summary characteristics if the set of bin characteristics matches the summary characteristics.
4. The method of claim 3 , further comprising:
detecting a scan if the updated flow count exceeds a predetermined threshold.
5. The method of claim 3 , wherein the summary characteristics comprise a scan type and the flow count.
6. The method of claim 5 , wherein the scan type comprises a class based scan.
7. The method of claim 1 , wherein the bin characteristics comprise a source internet protocol address, a destination internet protocol address, a source port, a destination port, a transmission control protocol flag, and a protocol.
8. A tangible computer-readable medium storing instructions which, when executed by a processor, cause the processor to perform operations for detecting a scan, the operations comprising:
allocating a plurality of flows into a plurality of bins based upon a source internet protocol address of each of the plurality of flows, where each bin of the plurality of bins is associated with a different source internet protocol address;
generating a set of bin characteristics for one bin of the plurality of bins if the one bin reaches a predefined flow capacity; and
comparing the set of bin characteristics to a scan characteristics list to determine if the scan exists.
9. The tangible computer-readable medium of claim 8 , wherein the operations further comprise:
updating summary characteristics of the one bin if the set of bin characteristics matches an entry in the scan characteristics list.
10. The tangible computer-readable medium of claim 9 , wherein the operations further comprise:
updating a flow count of the summary characteristics if the set of bin characteristics matches the summary characteristics.
11. The tangible computer-readable medium of claim 10 , wherein the operations further comprise:
detecting a scan if the updated flow count exceeds a predetermined threshold.
12. The tangible computer-readable medium of claim 10 , wherein the summary characteristics comprise a scan type and the flow count.
13. The tangible computer-readable medium of claim 12 , wherein the scan type comprises a class based scan.
14. The tangible computer-readable medium of claim 8 , wherein the bin characteristics comprise a source internet protocol address, a destination internet protocol address, a source port, a destination port, a transmission control protocol flag, and a protocol.
15. An apparatus for detecting a scan, comprising:
a processor; and
a computer-readable medium storing instructions which, when executed by the processor, cause the processor to perform operations, the operations comprising:
allocating a plurality of flows into a plurality of bins based upon a source internet protocol address of each of the plurality of flows, where each bin of the plurality of bins is associated with a different source internet protocol address;
generating a set of bin characteristics for one bin of the plurality of bins if the one bin reaches a predefined flow capacity; and
comparing the set of bin characteristics to a scan characteristics list to determine if the scan exists.
16. The apparatus of claim 15 , wherein the operations further comprise:
updating summary characteristics of the one bin if the set of bin characteristics matches an entry in the scan characteristics list.
17. The apparatus of claim 16 , wherein the operations further comprise:
updating a flow count of the summary characteristics if the set of bin characteristics matches the summary characteristics.
18. The apparatus of claim 17 , wherein the operations further comprise:
detecting a scan if the updated flow count exceeds a predetermined threshold.
19. The apparatus of claim 17 , wherein the summary characteristics comprise a scan type and the flow count.
20. The apparatus of claim 15 , wherein the bin characteristics comprise a source internet protocol address, a destination internet protocol address, a source port, a destination port, a transmission control protocol flag, and a protocol.