Importance

Loading Importance Indicators...

Abstract

A method for detecting a scan in network connections, each connection to a respective destination determined by a destination key and a destination parameter. For each of the connections, an active-connection entry is logged in a first table. The active-connection entry includes the destination key and the destination parameter. For each destination key entered in the first table, each active-connection entry is counted by: (i) entering in a second table a new-connection entry including the destination key, and (ii) assigning to the new-connection entry a use value; the use value equals a number of the active-connection entries with the destination key. A scan event is generated when the use value exceeds a previously determined new-connection-threshold. If the scan is an 'address scan', the destination key is a destination port and the destination parameter is a destination address (IP); and if the scan is a 'port scan' then the destination key is a destination address and the destination parameter is a destination port.

Loading the Abstract Image...

First Claim