Back to results
US 8,789,176 B1Granted
Detecting scans using a bloom counter
AssigneeAmazon Technologies, Inc.
InventorEric J. Brandwine
Life of this patent
Estimating the term…
Abstract
In certain embodiments, detecting scans may include receiving packets, where each packet has a target. The number of distinct targets of the packets may be counted using one or more Bloom counters. The number of distinct targets may satisfy a scan threshold for detecting a scan. If the scan threshold is satisfied, it is determined a scan is present.
Claims27
A system comprising:
- one or more interfaces of an edge device of a computer network, the one or more interfaces operable to:
- receive a plurality of packets, each packet of the plurality of packets having a target;
- and
- one or more processing units of the edge device, the one or more processing units operable to:
- access a Bloom filter comprising an array and associated with a plurality of hash functions, the plurality of hash functions mapping an element of a set of distinct targets to a plurality of element array positions;
- perform the following for one or more packets of the plurality of packets using one or more Bloom counters, at least a subset of the one or more Bloom counters counting for a predetermined time period to yield a time period count:
- determine whether a target of a packet is an element of the set of distinct targets recorded in the Bloom filter;
- and
- if the target is not an element of the set of distinct targets, add the target to the set of distinct targets;
- determine if a number of distinct targets in the set of distinct targets satisfies a scan threshold for detecting a scan;
- and
- determine that a scan is present if the scan threshold is satisfied.
9 more elements
A computer-implemented method comprising:
- receiving, by one or more processing units, a plurality of packets, each packet of the plurality of packets having a target;
- counting, by the one or more processing units, a number of distinct targets of the plurality of packets using one or more Bloom counters, at least a subset of the one or more Bloom counters counting for a predetermined time period to yield a time period count;
- determining, by the one or more processing units, if the number of distinct targets satisfies a scan threshold for detecting a scan;
- and
- determining, by the one or more processing units, that a scan is present if the scan threshold is satisfied.
2 more elements
One or more non-transitory computer-readable media comprising logic, the logic when executed by one or more processing units operable to perform operations comprising:
- receiving a plurality of packets, each packet of the plurality of packets having a target;
- accessing a Bloom filter comprising an array and associated with a plurality of hash functions, the plurality of hash functions mapping an element of a set of distinct targets to a plurality of element array positions;
- determining whether a target of a packet is an element of the set of distinct targets by:
- applying the hash functions to the target to yield a plurality of target array positions;
- and
- determining if the plurality of target array positions are recorded by a plurality of element array positions;
- if the target is not an element of the set of distinct targets, adding the target to the set of distinct targets by recording the plurality of target array positions as a plurality of element array positions;
- counting a number of distinct targets of the set of distinct targets using one or more Bloom counters, at least a subset of the one or more Bloom counters counting the number of distinct targets for a predetermined time period to yield a time period count;
- determining if the number of distinct targets satisfies a scan threshold for detecting a scan;
- and
- determining that a scan is present if the scan threshold is satisfied.
8 more elements
One or more non-transitory computer-readable media comprising logic, the logic when executed by one or more processing units operable to perform operations comprising:
- receiving a plurality of packets, each packet of the plurality of packets having a target;
- accessing a Bloom filter comprising an array and associated with a plurality of hash functions, the plurality of hash functions mapping an element of a set of distinct targets to a plurality of element array positions;
- determining whether a target of a packet is an element of the set of distinct targets by:
- applying the hash functions to the target to yield a plurality of target array positions;
- and
- determining if the plurality of target array positions are recorded by a plurality of element array positions;
- if the target is not an element of the set of distinct targets, adding the target to the set of distinct targets by recording the plurality of target array positions as a plurality of element array positions;
- starting one or more Bloom counters, at least a subset of the one or more Bloom counters counting a number of distinct targets for a predetermined time period to yield a time period count;
- and
- applying a statistical function the time period counts.
7 more elements
Dependencies are inferred from the claim text.