CPC H04L 63/20 (2013.01) [G06F 16/2477 (2019.01); G06F 16/951 (2019.01); H04L 63/1425 (2013.01); H04L 63/1433 (2013.01); H04L 63/1441 (2013.01)] | 8 Claims |
1. A system for probe-based active network reconnaissance, comprising:
a plurality of computing devices each comprising at least a processor, a memory, and a network interface;
wherein a plurality of programming instructions stored in one or more of the memories and operating on one or more of the processors of the plurality of computing devices causes the plurality of computing devices to:
receive traffic data from a network;
from the received traffic data, identify a connection attempt from an unknown source computing device external to the network to a target device internal to the network;
transmit a plurality of probe packets to the source computing device;
receive a plurality of response packets responsive to the transmitted probe packets from the source computing device;
perform a plurality of analysis and transformation operations on at least a portion of the received plurality of response packets;
store the results of the plurality of analysis and transformation operations as time-series data in a time-series data store; and
produce a weighted score based at least in part on the output of at least a portion of the analysis and transformation operations.
|