Horizontal scan detection

Abstract

Horizontal port scanning enables an attacker to gain information about the services running on a host computer system and/or about the users of the computer system so that the subsequent attacks can be targeted to those services and/or those users. A horizontal port scanning detection system enables a network administrator to use a system of cascading ring buffers to maximize network resources to detect attackers. The horizontal port scanning system employs a series of ring buffers, where each ring buffer is associated with a specific port and each cascade of ring buffers is associated with a specific source. As communications requests are received, the destination address is stored in the ring buffer associated with the requested port and a process is run across each ring buffer, such that when a threshold is passed, an alarm is raised.