Stealth network attack monitoring

摘要

A particular failed connection attempt initiated by a particular source asset in a network is identified and subsequent failed connection attempts initiated by the particular source asset in the network during a time period are tracked. A low frequency sequence of failed connection attempts involving the particular source asset is detected during the time period and the source asset is designated as a potential security risk based on the detected low frequency sequence of failed connection attempts.

主权项

1. At least one machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to: identify a particular failed connection attempt initiated by a particular source asset in a network; track subsequent failed connection attempts initiated by the particular source asset in the network during a time period; determine whether the subsequent failed connection attempts during the time period correspond to a low frequency failed connection attempt rate corresponding to an attempted stealth attack, wherein the stealth attack is characterized by a low frequency series of connection attempts; and designate the source asset as a potential security risk based on a determination that the subsequent failed connection attempts correspond to the low frequency failed connection attempt rate.