Patent ID: 7957372
Filing Date: 2011-06-07
Classification: H04L

Abstract:
1. A method to detect scanning on a network, the method comprising: implementing a look-up structure in a device coupled to said network, said look-up structure being logically equivalent to a search tree having a first portion partitioned into a plurality of slots with at least one slot operatively coupled to a tree structure; receiving network traffic in the device from existing traffic on the network; analyzing the network traffic with a programmed CPU to detect TCP/IP packets having a predefined statistical characteristic; for each TCP/IP packet so detected, using said programmed CPU to generate a hashed value from a Source Address (SA) and a Destination Address (DA); using the hashed value to index into a slot; examining the slot for a pointer; if no pointer is found, inserting a new leaf with the SA and the DA being an identifier of said leaf; storing in said leaf an address for a Destination Port (DP) contained in said each TCP/IP packet; creating a pointer in the slot that points to the leaf; if a pointer is in the slot, using said pointer to access a leaf; examining contents of said leaf to detect addresses of Destination Ports (DP) recorded therein; comparing a number of addresses so detected with a threshold value; performing a second tier look-up if the number of addresses equals or exceeds the threshold value; adding the DA to said leaf if the number of addresses in said leaf is less than the threshold value; issuing an alarm indicating detection of greater than a threshold number of packets with a predefined statistical characteristics that indicates suspicious packets; and limiting all subsequent packets with a same Source Address (SA) as the suspicious packets to a transfer/receipt rate that has a low likelihood of causing injury to the network.