# US 10,819,716 B1 · Contextual analyses of network traffic

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,819,716 B1
- Document ID: US10819716B1
- Status: Granted
- Kind: B1
- Application number: 16/936,288
- Filed: 2020-07-22
- Published: 2020-11-05
- Granted: 2020-10-27
- Earliest claimed: 2019-05-03
- Assignees: Greynoise Intelligence Inc.
- Applicants: GreyNoise Intelligence Inc.
- Inventors: Andrew Kevin Morris
- Web page: https://patentgrep.com/patent/US10819716B1

## CPC

- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 43/026: using flow identification
- H04L 43/028: by filtering
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Systems and methods for analyzing network traffic are provided. An exemplary system may include a plurality of network nodes distributed in multiple geographical regions. The plurality of network nodes may be configured to collect mass scanning network traffic data. The system may also include at least one processor. The processor may be configured to receive, from a first network node, a first network scanning request from a source scanner. In response to the reception of the first network scanning request, the processor may also be configured to transmit, via a second network node, a second network scanning request to the source scanner. The processor may further be configured to determine, based on feedback from the source scanner, whether the source scanner is compromised.

## Claims

### Claim 1

A system for analyzing network traffic, comprising:
a plurality of network nodes distributed in multiple geographical regions, wherein the plurality of network nodes are configured to collect mass scanning network traffic data; and
at least one processor configured to:
receive, from a first network node, a first network scanning request from a source scanner;
in response to the reception of the first network scanning request, transmit, via a second network node, a second network scanning request to the source scanner; and
determine, based on feedback from the source scanner, whether the source scanner is compromised,
wherein:
the first network scanning request comprises a first request for a protocol through a first network port of the first network node having a first port number; and
the second network scanning request comprises a second request for a same protocol through a second network port of the source scanner, the second network port having a same port number as the first port number.

### Claim 2 (depends on 1)

The system of claim 1, wherein:
the first network scanning request comprises a first request to scan a first network port of the first network node having a first port number; and
the second network scanning request comprises a second request to scan a second network port of the source scanner, the second network port having a same port number as the first port number.

### Claim 3 (depends on 2)

The system of claim 2, wherein the at least one processor is configured to:
determine that the source scanner is compromised when the feedback from the source scanner indicates that the second network port is open.

### Claim 4 (depends on 1)

The system of claim 1, wherein the at least one processor is configured to:
determine that the source scanner is compromised when the feedback from the source scanner indicates that the protocol is present at the second network port.

### Claim 5 (depends on 1)

The system of claim 1, wherein:
the first network scanning request comprises a first request for a file, service, or path from the first network node; and
the second network scanning request comprises a second request for a same file, service, or path from the source scanner.

### Claim 6 (depends on 5)

The system of claim 5, wherein the at least one processor is configured to:
determine that the source scanner is compromised when the feedback from the source scanner indicates that the file, service, or path is present at the source scanner.

### Claim 7 (depends on 1)

The system of claim 1, wherein the first and second network nodes are located in different geographical regions.

### Claim 8 (depends on 1)

The system of claim 1, wherein the first and second network nodes are provided by different cloud computing service providers.

### Claim 9

A method for analyzing network traffic, comprising:
receiving, from a first network node, a first network scanning request from a source scanner;
in response to the reception of the first network scanning request, transmitting, via a second network node, a second network scanning request to the source scanner; and
determining, based on feedback from the source scanner, whether the source scanner is compromised,
wherein:
the first network scanning request comprises a first request for a protocol through a first network port of the first network node having a first port number; and
the second network scanning request comprises a second request for a same protocol through a second network port of the source scanner, the second network port having a same port number as the first port number.

### Claim 10 (depends on 9)

The method of claim 9, wherein:
the first network scanning request comprises a first request to scan a first network port of the first network node having a first port number; and
the second network scanning request comprises a second request to scan a second network port of the source scanner, the second network port having a same port number as the first port number.

### Claim 11 (depends on 10)

The method of claim 10, comprising:
determining that the source scanner is compromised when the feedback from the source scanner indicates that the second network port is open.

### Claim 12 (depends on 9)

The method of claim 9, comprising:
determining that the source scanner is compromised when the feedback from the source scanner indicates that the protocol is present at the second network port.

### Claim 13 (depends on 9)

The method of claim 9, wherein:
the first network scanning request comprises a first request for a file, service, or path from the first network node; and
the second network scanning request comprises a second request for a same file, service, or path from the source scanner.

### Claim 14 (depends on 13)

The method of claim 13, comprising:
determining that the source scanner is compromised when the feedback from the source scanner indicates that the file, service, or path is present at the source scanner.

### Claim 15 (depends on 9)

The method of claim 9, wherein the first and second network nodes are located in different geographical regions.

### Claim 16 (depends on 9)

The method of claim 9, wherein the first and second network nodes are provided by different cloud computing service providers.

### Claim 17

A non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to perform a method for analyzing network traffic, the method comprising:
receiving, from a first network node, a first network scanning request from a source scanner;
in response to the reception of the first network scanning request, transmitting, via a second network node, a second network scanning request to the source scanner; and
determining, based on feedback from the source scanner, whether the source scanner is compromised,
wherein:
the first network scanning request comprises a first request for a protocol through a first network port of the first network node having a first port number; and
the second network scanning request comprises a second request for a same protocol through a second network port of the source scanner, the second network port having a same port number as the first port number.