Methods, apparatus and computer software products implement embodiments of the present invention that include defining, for a given software category, respective, disjoint sets of communication ports that are used by each of a plurality of software systems in the given software category, including at least first and second disjoint sets. A set of port scans are identified in data traffic transmitted between multiple nodes that communicate over a network, each of the port scans including an access, in the data traffic, of a plurality of the communication ports on a given destination node by a given source node during a predefined time period. Upon detecting a port scan by one of the nodes including accesses of at least one of the communication ports in the first set and at least one of the communication ports in the second set, a preventive action is initiated.


    Zugriff

    Download


    Exportieren, teilen und zitieren



    Titel :

    Malicious port scan detection using port profiles


    Beteiligte:
    MESHI YINNON (Autor:in) / AMIT IDAN (Autor:in) / ALLON JONATHAN (Autor:in) / MEYER AVIAD (Autor:in)

    Erscheinungsdatum :

    26.04.2022


    Medientyp :

    Patent


    Format :

    Elektronische Ressource


    Sprache :

    Englisch



    Port scan detection using destination profiles

    MESHI YINNON / AMIT IDAN / ALLON JONATHAN et al. | Europäisches Patentamt | 2021

    Freier Zugriff

    Port profiles

    Online Contents | 1994


    Port Profiles

    Online Contents | 1994


    Port Profile. Bintulu Port

    Online Contents | 1997


    Port Profile: Port Hedland

    Online Contents | 1997