Patent Document ID: 7752665
Application ID: 10620156
Patent Flag: 1

Claim One:
1. A method of detecting surveillance probes on a computer communications network, comprising: receiving a plurality of messages from a data sensor located at a network audit point, said data sensor sampling data packets on said computer communications network and outputting said messages, each of said messages describing an event occurring on said communications network; processing said messages to form extrapolated connection sessions from said sampled data packets from which to determine a connection source that initiated the connection session by clustering packets exchanged in respective directions over a connection between addresses associated with a connection identifier for said connection said addresses including an address of said connection source and a destination address, and clustering packets that are a) within a specified time period where the source and destination addresses are not predetermined, (b) have certain flags set, or c) have source and destination addresses that are not predetermined but have similar characteristics; and detecting a surveillance probe by: grouping said connection sessions into a plurality of groups of related connection source addresses; scoring each group based on at least a quantity of attack destinations; and generating an alert for each group whose score is greater than an empirically derived threshold.