Adaptive network probing using machine learning

1. A computer-implemented method for scanning a computer network, comprising:

a) sending, by a computer processor, a particular network probe to a particular port of a network address in a computer network;

b) receiving, by the computer processor, a response to the particular network probe from the network address;

c) appending, the computer processor, the response for the particular port to a set of features forming a feature vector associated with the network address, where the feature vector includes at least two features and each feature of the at least two features indicates status of a different port at the network address;

d) determining, by the computer processor, a next port to probe at the network address, where the next port is selected dynamically according to the set of features from the feature vector; and

e) predicting, by the computer processor, the response of the next port using the feature vector and a model, where the model is trained using a machine learning method and outputs a probability that the next port will respond to a given network probe in a desired manner and the next port differs from the particular port.

2. The method of claim 1 further comprises sending another network probe to the next port of the network address in response to the probability that a given network address will respond in a desired manner exceeds a threshold.

3. The method of claim 2 further comprises

receiving, by the computer processor, a response to the another network probe from the network address; and

repeating steps b)-e) for the response from the another network probe.

4. The method of claim 1 further comprises determining the next port at the network address in accordance with a sequence of probes.

5. The method of claim 4 wherein the sequence of probes is determined by training a set of classifiers with training data, where the training data represents a plurality of network probes across a set of different types of ports;

ordering ports in the set of different types of ports to form a predefined sequence, where the ports are ordered according to importance of a given port for predicting response of another port.

6. The method of claim 5 further comprises quantifying contributions of each feature using SHAP (SHapley Additive explanation) values.

7. The method of claim 5 further comprises ordering ports in the set of different types of probes using a hill climbing method.

8. The method of 1 wherein the set of features includes at least one of a geographic location for the network address and ownership information for the network address.

9. The method of claim 1 wherein the model is further defined as one or more decision trees and the machine learning method is further defined as gradient-boosting method.

10. A computer-implemented method for scanning a computer network, comprising:

a) sending, by a computer processor, a network probe to a particular port at a network address in a computer network;

b) receiving, by the computer processor, a response to the network probe from the network address;

c) appending, the computer processor, the response to a set of features forming a feature vector associated with the network address, where the feature vector includes at least two features and each feature of the at least two features indicates status of a different port at the network address;

d) determining, by the computer processor, a next port at the network address to probe, where the next port is selected dynamically according to the set of features from the feature vector; and

e) predicting, by the computer processor, the response from the next port using the feature vector and a model, where the model is trained using a machine learning method and outputs a probability that the next port will respond to a given network probe in a desired manner and the next port differs from the particular port.

11. The method of claim 10 further comprises sending another network probe to the next port in response to the probability that a given port will respond in a desired manner exceeds a threshold.

12. The method of claim 11 further comprises receiving, by the computer processor, a response to the another network probe from the network address; and

repeating steps b)-e) for the response from the another network probe.

13. The method of claim 10 further comprises determining the next port at the network address to probe in accordance with a sequence of probes.

14. The method of claim 13 wherein the sequence of probes is determined by training a set of classifiers with training data, where the training data represents a plurality of network probes across a set of different types of ports;

ordering ports in the set of different types of ports to form a predefined sequence, where the ports are ordered according to importance of a given port for predicting response of another port.

15. The method of claim 10 wherein determining a next port at the network address to probe is selected dynamically.

16. The method of 10 wherein the set of features includes at least one of a geographic location for the network address and ownership information for the network address.

17. A network scanner, comprising

a processor; and

a storage medium having computer program instructions stored thereon, when executed by the processor, perform to:

sending, by a computer processor, a network probe to a particular port of a network address in a computer network;

receiving, by the computer processor, a response to the network probe from the network address;

appending, the computer processor, the response for the particular port to a set of features forming a feature vector associated with the network address, where the feature vector includes at least two features and each feature of the at least two features indicates status of a given port at the network address;

determining, by the computer processor, a next port to probe at the network address, where the next port is selected dynamically according to the set of features from the feature vector; and

predicting, by the computer processor, the response from the next port using the feature vector and a model, where the model is trained using a machine learning method and outputs a probability that the next port will respond to a given network probe in a desired manner and the next port differs from the particular port.