Method and apparatus for detecting scans in real-time
AssigneeAT&T Intellectual Property II, L.P.
InventorKenichi Futamura
Life of this patent
Estimating the term…
Abstract
A method and apparatus for detecting scans are described. In one example, a plurality of flows is allocated into a plurality of bins associated with different source Internet protocol (SIP) addresses. A set of bin characteristics for at least one bin of the plurality of bins is generated if the at least one bin reaches a predefined flow capacity. Afterwards, the set of bin characteristics is compared to a scan characteristics list to determine if a potential scan exists.
Claims20
A method for detecting a scan, comprising:
- allocating, by a processor, a plurality of flows into a plurality of bins based upon a source internet protocol address of each of the plurality of flows, where each bin of the plurality of bins is associated with a different source internet protocol address;
- generating, by the processor, a set of bin characteristics for one bin of the plurality of bins if the one bin reaches a predefined flow capacity;
- and
- comparing, by the processor, the set of bin characteristics to a scan characteristics list to determine if the scan exists.
A tangible computer-readable medium storing instructions which, when executed by a processor, cause the processor to perform operations for detecting a scan, the operations comprising:
- allocating a plurality of flows into a plurality of bins based upon a source internet protocol address of each of the plurality of flows, where each bin of the plurality of bins is associated with a different source internet protocol address;
- generating a set of bin characteristics for one bin of the plurality of bins if the one bin reaches a predefined flow capacity;
- and
- comparing the set of bin characteristics to a scan characteristics list to determine if the scan exists.
An apparatus for detecting a scan, comprising:
- a processor;
- and
- a computer-readable medium storing instructions which, when executed by the processor, cause the processor to perform operations, the operations comprising:
- allocating a plurality of flows into a plurality of bins based upon a source internet protocol address of each of the plurality of flows, where each bin of the plurality of bins is associated with a different source internet protocol address;
- generating a set of bin characteristics for one bin of the plurality of bins if the one bin reaches a predefined flow capacity;
- and
- comparing the set of bin characteristics to a scan characteristics list to determine if the scan exists.
Dependencies are inferred from the claim text.