Patent ID: 7908655

Claim:
A computer implemented method for determining whether a device on a computer network is port scanning, the method comprising: assigning a probability variable to the device associated with said computer network, wherein said probability variable indicates the probability that said device is conducting port scanning activities; accessing transmission data describing one or more transmissions by said device during a plurality of time intervals; for each of said plurality of time intervals, computing a horizontal access pattern ratio and a vertical access pattern ratio for each of said plurality of time intervals; providing a port-scanning determination by determining whether said horizontal access pattern ratio exceeded a horizontal threshold value and whether said vertical access pattern ratio exceeded a vertical threshold value indicating port scanning behavior during each of said plurality of time intervals; and based on said port-scanning determination, updating said probability variable by utilizing a sequential hypothesis test that includes computing a ratio of said plurality of time intervals that said device behaved like a scanning device versus said plurality of time intervals that said device behaved like a benign device based on the number of times said horizontal access pattern ratio exceeded said horizontal threshold value and said vertical access pattern ratio exceeded said vertical threshold value.