Patent ID: 7356587

Claim:
A method to detect unauthorized reconnaissance or scanning of a computer network comprising: monitoring communications within the network; detecting a predefined sequential triplet of TCP/IP protocol set packets flowing within said communications, each of the predefined sequential triplet packets comprising a source address field, a target device address field, a source port field and a target device port field, comprising: providing a histogram in which states of the predefined sequence of packets are maintained, the histogram including a table partitioned into a first field in which source addresses of network devices are kept and a second field concatenated to the first field; dynamically updating said histogram as selected ones of the predefined sequence of packets is detected by initializing or incrementing a state code field in response to an order in which packets in the predefined sequence of packets are detected: concatenating a source address field, a target device address field, a source port field and a target device port field of a packet of the predefined sequential triplet into the table first and second fields as an ordered four-tuples; hashing the ordered four-tuple; and using the hashed ordered four-tuple as a histogram location index; observing an initial SYN packet originating from a source address; detecting a next sequential SYN/ACK packet issuing from a target device address in response to the SYN packet; and detecting a last sequential RST packet originating from the source address in response to the SYN/ACK packet; and issuing an alert indicating unauthorized scanning if the predefined sequence of packets are each relevant to the source address and if the state code field has an alert value.