# US 11,516,226 B2 · Contextual analyses of network traffic > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,516,226 B2 - Document ID: US11516226B2 - Status: Granted - Kind: B2 - Application number: 17/035,033 - Filed: 2020-09-28 - Published: 2021-01-28 - Granted: 2022-11-29 - Earliest claimed: 2019-05-03 - Assignees: Greynoise Intelligence Inc. - Applicants: GreyNoise Intelligence Inc. - Inventors: Andrew Kevin Morris - Web page: https://patentgrep.com/patent/US11516226B2 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 43/026: using flow identification - H04L 43/028: by filtering - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods for analyzing network traffic are provided. An exemplary system may include a plurality of network nodes distributed in multiple geographical regions. The plurality of network nodes may be configured to collect mass scanning network traffic data. The system may also include at least one processor. The processor may be configured to receive, from a first network node, a first network scanning request from a source scanner. In response to the reception of the first network scanning request, the processor may also be configured to transmit, via a second network node, a second network scanning request to the source scanner. The processor may further be configured to determine, based on feedback from the source scanner, whether the source scanner is compromised. ## Claims ### Claim 1 A system for analyzing network traffic, comprising: a memory storing computer-readable instructions; and at least one processor in communication with the memory, wherein the computer-readable instructions, when executed by the at least one processor, cause the at least one processor to perform operations comprising: receiving, from a plurality of network listeners, network traffic data; aggregating the network traffic data to generate a database of mass scanning network traffic, the database associating the mass scanning network traffic with respective sources of the mass scanning network traffic; querying the database with a first source associated with first network traffic; determining whether at least one source in the database matches the first source; receiving, from multiple users, multiple queries, each comprising a respective network scanning activity from a same source; determining that the network scanning activities are targeted scanning activities; and tagging the source as suspicious of conducting micro-targeting network scans. ### Claim 2 (depends on 1) The system of claim 1, wherein the operations comprise: deprioritizing the first network traffic after it is determined that at least one source in the database matches the first source. ### Claim 3 (depends on 1) The system of claim 1, wherein the operations comprise: enriching the database with contextual information based on a set of rules; and providing the contextual information to a user after it is determined that at least one source in the database matches the first source. ### Claim 4 (depends on 3) The system of claim 3, wherein the contextual information comprises at least one of temporal information of recording a source of mass scanning network traffic, a port number scanned by the source, an Autonomous System Number (ASN) associated with the source, geographical location information of the source, organizational information of the source, or a type of the source. ### Claim 5 (depends on 1) The system of claim 1, wherein the operations comprise: generating an indication indicating that the first network traffic is a targeted network traffic when no record in the database matches the first source. ### Claim 6 (depends on 1) The system of claim 1, wherein the plurality of network listeners are located in datacenters of multiple cloud computing service providers. ### Claim 7 (depends on 1) The system of claim 1, wherein the operations comprise: enriching the database by tagging records in the database based on a set of rules. ### Claim 8 (depends on 1) The system of claim 1, wherein the operations comprise: receiving a query from a network security system of a user via an Application Programming Interface (API). ### Claim 9 A method for analyzing network traffic, comprising: receiving, from a plurality of network listeners, network traffic data; aggregating the network traffic data to generate a database of mass scanning network traffic, the database associating the mass scanning network traffic with respective sources of the mass scanning network traffic; querying the database with a first source associated with first network traffic; determining whether at least one source in the database matches the first source; receiving, from multiple users, multiple queries, each comprising a respective network scanning activity from a same source; determining that the network scanning activities are targeted scanning activities; and tagging the source as suspicious of conducting micro-targeting network scans. ### Claim 10 (depends on 9) The method of claim 9, comprising: deprioritizing the first network traffic after it is determined that at least one source in the database matches the first source. ### Claim 11 (depends on 9) The method of claim 9, comprising: enriching the database with contextual information based on a set of rules; and providing the contextual information to a user after it is determined that at least one source in the database matches the first source. ### Claim 12 (depends on 11) The method of claim 11, wherein the contextual information comprises at least one of temporal information of recording a source of mass scanning network traffic, a port number scanned by the source, an Autonomous System Number (ASN) associated with the source, geographical location information of the source, organizational information of the source, or a type of the source. ### Claim 13 (depends on 9) The method of claim 9, comprising: generating an indication indicating that the first network traffic is a targeted network traffic when no record in the database matches the first source. ### Claim 14 (depends on 9) The method of claim 9, wherein the plurality of network listeners are located in datacenters of multiple cloud computing service providers. ### Claim 15 (depends on 9) The method of claim 9, comprising: enriching the database by tagging records in the database based on a set of rules. ### Claim 16 (depends on 9) The method of claim 9, comprising: receiving a query from a network security system of a user via an Application Programming Interface (API). ### Claim 17 A non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to perform a method for analyzing network traffic, the method comprising: receiving, from a plurality of network listeners, network traffic data; aggregating the network traffic data to generate a database of mass scanning network traffic, the database associating the mass scanning network traffic with respective sources of the mass scanning network traffic; querying the database with a first source associated with first network traffic; determining whether at least one source in the database matches the first source; receiving, from multiple users, multiple queries, each comprising a respective network scanning activity from a same source; determining that the network scanning activities are targeted scanning activities; and tagging the source as suspicious of conducting micro-targeting network scans. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the method comprises: deprioritizing the first network traffic after it is determined that at least one source in the database matches the first source.