US 10,757,117 B1 · Contextual analyses of network traffic

Abstract

Systems and methods for analyzing network traffic are provided. An exemplary system may include a plurality of network nodes distributed in multiple geographical regions. The plurality of network nodes may be configured to collect mass scanning network traffic data. The system may also include at least one processor configured to receive, from the plurality of network nodes, the collected mass scanning network traffic data. The processor may also be configured to generate an omnidirectional network traffic database based on the received mass scanning network traffic data. The processor may further be configured to receive a query against the omnidirectional network traffic database. The query may include information of a source of a network scanning activity. Moreover, the processor may be configured to determine whether the source matches any record in the omnidirectional network traffic database and generate an indication based on the determination.

Claims19

Dependent claims

A system for analyzing network traffic, comprising:

a memory storing computer-readable instructions;
and
at least one processor in communication with the memory, wherein the computer-readable instructions, when executed by the at least one processor, cause the at least one processor to perform operations comprising:
receiving, from a first network node, a first notification indicating reception of a first request sent by an unsolicited requester for network connection with the first network node;
instructing the first network node to respond to the first request with a first response;
receiving, from a second network node, a second notification indicating reception of a second request sent by the unsolicited requester for network connection with the second network node;
instructing the second network node to respond to the second request with a second response that is different from the first response;
receiving, from a pilot network node, an initial notification indicating reception of an initial request sent by the unsolicited requester for network connection with the pilot network node;
and
determining, based on the initial notification, a group of candidate responses, wherein the group of candidate responses comprise the first and second responses.

7 more elements

A method for analyzing network traffic, comprising:

receiving, from a first network node, a first notification indicating reception of a first request sent by an unsolicited requester for network connection with the first network node;
instructing the first network node to respond to the first request with a first response;
receiving, from a second network node, a second notification indicating reception of a second request sent by the unsolicited requester for network connection with the second network node;
instructing the second network node to respond to the second request with a second response that is different from the first response;
receiving, from a pilot network node, an initial notification indicating reception of an initial request sent by the unsolicited requester for network connection with the pilot network node;
and
determining, based on the initial notification, a group of candidate responses, wherein the group of candidate responses comprise the first and second responses.

4 more elements

Dependencies are inferred from the claim text.

Contextual analyses of network traffic

Life of this patent

Contextual analyses of network traffic

Life of this patent

Abstract

Claims19