Methods, apparatus and computer software products implement embodiments of the present invention that include defining, for a given software category, respective, disjoint sets of communication ports that are used by each of a plurality of software systems in the given software category, including at least first and second disjoint sets. A set of port scans are identified in data traffic transmitted between multiple nodes that communicate over a network, each of the port scans including an access, in the data traffic, of a plurality of the communication ports on a given destination node by a given source node during a predefined time period. Upon detecting a port scan by one of the nodes including accesses of at least one of the communication ports in the first set and at least one of the communication ports in the second set, a preventive action is initiated.


    Access

    Download


    Export, share and cite



    Title :

    Malicious port scan detection using port profiles


    Contributors:
    MESHI YINNON (author) / AMIT IDAN (author) / ALLON JONATHAN (author) / MEYER AVIAD (author)

    Publication date :

    2022-04-26


    Type of media :

    Patent


    Type of material :

    Electronic Resource


    Language :

    English



    Port scan detection using destination profiles

    MESHI YINNON / AMIT IDAN / ALLON JONATHAN et al. | European Patent Office | 2021

    Free access

    Port profiles

    Online Contents | 1994


    Port Profiles

    Online Contents | 1994


    Port Profile. Bintulu Port

    Online Contents | 1997


    Port Profile: Port Hedland

    Online Contents | 1997