Port scan detection using destination profiles

An apparatus, comprising:

• a network interface controller coupled to a data network comprising multiple nodes that communicate via the network;
• and
• at least one hardware processor configured:
• to identify, in data traffic transmitted between the multiple nodes over the network, a set of pairs of source and destination nodes, each pair consisting of a given source node and a given destination node, and one or more destination communication ports accessed by the given source node in the data traffic between the source and destination nodes in each pair,
• to compute, for each pair in the set, a respective baseline level that is indicative of a first number of the destination communication ports that source nodes other than the given source node in the pair accessed on the given destination node during a first time period,
• to compute, for each pair in the set, a respective test score that is indicative of a difference between a second number of the destination communication ports that the given source node in the pair accessed on the given destination node during a second time period and the baseline level, and
• to initiate a preventive action with respect to the given source node in any of the pairs for which the test score is greater than a specified level.

A computer software product, the product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by a computer, cause the computer:

• to identify, in data traffic transmitted between the multiple nodes over the network, a set of pairs of source and destination nodes, each pair consisting of a given source node and a given destination node, and one or more destination communication ports accessed by the given source node in the data traffic between the source and destination nodes in each pair;
• to compute, for each pair in the set, a respective baseline level that is indicative of a first number of the destination communication ports that source nodes other than the given source node in the pair accessed on the given destination node during a first time period;
• to compute, for each pair in the set, a respective test score that is indicative of a difference between a second number of the destination communication ports that the given source node in the pair accessed on the given destination node during a second time period and the baseline level;
• and
• to initiate a preventive action with respect to the given source node in any of the pairs for which the test score is greater than a specified level.