Contextual analyses of network traffic

1. A system for analyzing network traffic, comprising:

a plurality of network nodes distributed in multiple geographical regions, wherein the plurality of network nodes are configured to collect mass scanning network traffic data; and

at least one processor configured to:

receive, from a first network node, a first network scanning request from a source scanner;

in response to the reception of the first network scanning request, transmit, via a second network node, a second network scanning request to the source scanner; and

determine, based on feedback from the source scanner, whether the source scanner is compromised,

wherein:

the first network scanning request comprises a first request for a protocol through a first network port of the first network node having a first port number; and

the second network scanning request comprises a second request for a same protocol through a second network port of the source scanner, the second network port having a same port number as the first port number.

2. The system of claim 1 , wherein:

the first network scanning request comprises a first request to scan a first network port of the first network node having a first port number; and

the second network scanning request comprises a second request to scan a second network port of the source scanner, the second network port having a same port number as the first port number.

3. The system of claim 2 , wherein the at least one processor is configured to:

determine that the source scanner is compromised when the feedback from the source scanner indicates that the second network port is open.

4. The system of claim 1 , wherein the at least one processor is configured to:

determine that the source scanner is compromised when the feedback from the source scanner indicates that the protocol is present at the second network port.

5. The system of claim 1 , wherein:

the first network scanning request comprises a first request for a file, service, or path from the first network node; and

the second network scanning request comprises a second request for a same file, service, or path from the source scanner.

6. The system of claim 5 , wherein the at least one processor is configured to:

determine that the source scanner is compromised when the feedback from the source scanner indicates that the file, service, or path is present at the source scanner.

7. The system of claim 1 , wherein the first and second network nodes are located in different geographical regions.

8. The system of claim 1 , wherein the first and second network nodes are provided by different cloud computing service providers.

9. A method for analyzing network traffic, comprising:

receiving, from a first network node, a first network scanning request from a source scanner;

in response to the reception of the first network scanning request, transmitting, via a second network node, a second network scanning request to the source scanner; and

determining, based on feedback from the source scanner, whether the source scanner is compromised,

wherein:

the first network scanning request comprises a first request for a protocol through a first network port of the first network node having a first port number; and

the second network scanning request comprises a second request for a same protocol through a second network port of the source scanner, the second network port having a same port number as the first port number.

10. The method of claim 9 , wherein:

the first network scanning request comprises a first request to scan a first network port of the first network node having a first port number; and

the second network scanning request comprises a second request to scan a second network port of the source scanner, the second network port having a same port number as the first port number.

11. The method of claim 10 , comprising:

determining that the source scanner is compromised when the feedback from the source scanner indicates that the second network port is open.

12. The method of claim 9 , comprising:

determining that the source scanner is compromised when the feedback from the source scanner indicates that the protocol is present at the second network port.

13. The method of claim 9 , wherein:

the first network scanning request comprises a first request for a file, service, or path from the first network node; and

the second network scanning request comprises a second request for a same file, service, or path from the source scanner.

14. The method of claim 13 , comprising:

determining that the source scanner is compromised when the feedback from the source scanner indicates that the file, service, or path is present at the source scanner.

15. The method of claim 9 , wherein the first and second network nodes are located in different geographical regions.

16. The method of claim 9 , wherein the first and second network nodes are provided by different cloud computing service providers.

17. A non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to perform a method for analyzing network traffic, the method comprising:

receiving, from a first network node, a first network scanning request from a source scanner;

in response to the reception of the first network scanning request, transmitting, via a second network node, a second network scanning request to the source scanner; and

determining, based on feedback from the source scanner, whether the source scanner is compromised,

wherein:

the first network scanning request comprises a first request for a protocol through a first network port of the first network node having a first port number; and

the second network scanning request comprises a second request for a same protocol through a second network port of the source scanner, the second network port having a same port number as the first port number.