Monitoring traffic in a computer network

A computerized apparatus having a processor, the computerized apparatus being in communication with a computer network environment comprising a plurality of devices, each of which being configured for applying a transformation function on an identifier of a target port for network communication indicated in a transmission request of an application program executing thereon, whereby a scrambled version of the identifier is obtained, the plurality of devices being further configured for directing the transmission to be received via a different target port identified by the scrambled version of the identifier, the processor being adapted to perform the steps of:

• identifying an invalid port access attempt by a first transmission directed at a first port of a first computerized apparatus comprised in the plurality of devices;
• and in response to said identifying, providing for an action to be performed whereby a security threat ascribed to the invalid port access attempt is mitigated, wherein the action comprises disconnecting the first computerized apparatus comprised in the plurality of devices from the network environment by providing the first computerized apparatus with a false, corrupted or tampered version of at least one parameter shared among the plurality of devices;
• wherein said identifying the invalid port access comprises checking whether a first identifier identifying the first port is obtainable from applying the transformation function on a second identifier of a second port via which receipt is designated by a transmission request of an application program executing on as second computerized apparatus comprised in the plurality of devices;
• wherein the transformation function depends on at least one parameter shared among the plurality of devices, wherein the step of applying the transformation function by a device of the plurality of devices is conditioned on the application program requesting transmission being listed in a list of authorized application programs provided to the device.

A computer program product comprising a non-transitory computer readable storage medium retaining program instructions, which program instructions when read by a processor, cause the processor to perform a method carried out in a computer network environment comprising a plurality of devices, each of which being configured for applying a transformation function on an identifier of a target port for network communication indicated in a transmission request of an application program executing thereon, whereby a scrambled version of the identifier is obtained, the plurality of devices being further configured for directing the transmission to be received via a different target port identified by the scrambled version of the identifier, the program instructions read by the processor performs method comprising:

• identifying an invalid port access attempt by a first transmission directed at a first port of a first computerized apparatus comprised in the plurality of devices;
• and in response to said identifying, providing for an action to be performed whereby a security threat ascribed to the invalid port access attempt is mitigated, wherein the action comprises disconnecting the first computerized apparatus comprised in the plurality of devices from the network environment by providing the first computerized apparatus with a false, corrupted or tampered version of at least one parameter shared among the plurality of devices;
• wherein said identifying the invalid port access comprises checking whether a first identifier identifying the first port is obtainable from applying the transformation function on a second identifier of a second port via which receipt is designated by a transmission request of an application program executing on a second computerized apparatus comprised in the plurality of devices;
• wherein the transformation function depends on at least one parameter shared among the plurality of devices, wherein the step of applying the transformation function by a device of the plurality of devices is conditioned on the application program requesting transmission being listed in a list of authorized application programs provided to the device.