Method and system for tracking machines on a network using fuzzy guid technology
First Claim
1. An apparatus for tracking machines on a network of computers, the apparatus comprising at least one processor and at least one memory storing computer code that, when executed by the at least one processor, causes the apparatus to:
- identify a malicious host coupled to the network of computers;
determine a first IP address and a first set of one or more attributes associated with the malicious host during a first time period, wherein the first set of one or more attributes comprises information about activities performed by the malicious host during the first time period;
classify the malicious host to be in a determined state;
during a second time period, classify the malicious host to be in a latent state;
identify an unknown host during the second time period, the unknown host being associated with a second IP address and a second set of one or more attributes, wherein the second set of one or more attributes comprises information about activities performed by the unknown host during the second time period;
process the second IP address and the second set of one or more attributes of the unknown host with the first IP address and the first set of one or more attributes of the malicious host; and
determine, based on the processing of the second IP address and the second set of one or more attributes of the unknown host with the first IP address and the first set of one or more attributes of the malicious host, if the malicious host has moved from the first IP address to the second IP address, thereby identifying if the unknown host is the malicious host.
1 Assignment
0 Petitions
Accused Products
Abstract
A method for querying a knowledgebase of malicious hosts numbered from 1 through N. The method includes providing a network of computers, which has a plurality of unknown malicious host machines. In a specific embodiment, the malicious host machines are disposed throughout the network of computers, which includes a worldwide network of computers, e.g., Internet. The method includes querying a knowledge base including a plurality of known malicious hosts, which are numbered from 1 through N, where N is an integer greater than 1. In a preferred embodiment, the knowledge base is coupled to the network of computers. The method includes receiving first information associated with an unknown host from the network; identifying an unknown host and querying the knowledge base to determine if the unknown host is one of the known malicious hosts in the knowledge base. The method also includes outputting second information associated with the unknown host based upon the querying process.
-
Citations
19 Claims
-
1. An apparatus for tracking machines on a network of computers, the apparatus comprising at least one processor and at least one memory storing computer code that, when executed by the at least one processor, causes the apparatus to:
-
identify a malicious host coupled to the network of computers; determine a first IP address and a first set of one or more attributes associated with the malicious host during a first time period, wherein the first set of one or more attributes comprises information about activities performed by the malicious host during the first time period; classify the malicious host to be in a determined state; during a second time period, classify the malicious host to be in a latent state; identify an unknown host during the second time period, the unknown host being associated with a second IP address and a second set of one or more attributes, wherein the second set of one or more attributes comprises information about activities performed by the unknown host during the second time period; process the second IP address and the second set of one or more attributes of the unknown host with the first IP address and the first set of one or more attributes of the malicious host; and determine, based on the processing of the second IP address and the second set of one or more attributes of the unknown host with the first IP address and the first set of one or more attributes of the malicious host, if the malicious host has moved from the first IP address to the second IP address, thereby identifying if the unknown host is the malicious host. - View Dependent Claims (2, 3, 4)
-
-
5. An apparatus for querying a knowledgebase of malicious hosts numbered from 1 through N, the apparatus comprising at least one processor and at least one memory storing computer code that, when executed by the at least one processor, causes the apparatus to:
-
communicably couple to a network of computers, the network of computers including a plurality of unknown malicious host machines, the malicious host machines being disposed throughout the network of computers, the network of computers including a world-wide network of computers; query a knowledge base including information about a plurality of known malicious hosts, the plurality of known malicious hosts being numbered from 1 through N, where N is an integer greater than 1, the knowledge base being a database communicably coupled to the network of computers; receive first information associated with an unknown host from the network of computers, wherein the first information comprises information about activities performed by the unknown host; identify a fuzzy GUID of the unknown host based on the received first information; query the knowledge base, using the first information, to determine if the unknown host is one of the known malicious hosts in the knowledge base; and output second information associated with the unknown host based upon the querying process. - View Dependent Claims (6, 7, 8, 9, 10, 11)
-
-
12. An apparatus for populating a database to form a knowledge base of malicious host entities, the apparatus comprising at least one processor and at least one memory storing computer code that, when executed by the at least one processor, cause the apparatus to:
-
determine a plurality of identity attributes for an unknown host; assign a quality measure to each of the plurality the identity attributes; collect one or more evidences from the unknown host, wherein the one or more evidences comprises information about activities performed by the unknown host; determine, based on the one or more evidences, an attribute fuzzy GUID for each of the plurality of identity attributes for the unknown host; process the attribute fuzzy GUID for each of the plurality of attributes, in an order from a highest quality measure to a lowest quality measure, to determine a host fuzzy GUID for the unknown host; and store the host fuzzy GUID for the unknown host in one or more memories of a database to form a knowledge base. - View Dependent Claims (13, 14)
-
-
15. A computer based system for populating a database to form a knowledge base of malicious host entities, the system comprising at least one server and at least one machine readable memory or memories, the memory or memories storing instructions that, when executed by the at least one server, cause the system to:
-
determine a plurality of identity attributes for an unknown host; assign a quality measure to each of the plurality the identity attributes; collect one or more evidences from the unknown host, wherein the one or more evidences comprises information about activities performed by the unknown host; determine, based on the one or more evidences, an attribute fuzzy GUID for each of the plurality of identity attributes for the unknown host; process the attribute fuzzy GUID for each of the plurality of identity attributes, in an order from a highest quality measure to a lowest quality measure, to determine a host fuzzy GUID for the unknown host; and store the host fuzzy GUID for the unknown host in one or more memories of a database to form a knowledge base. - View Dependent Claims (16, 17, 18, 19)
-
Specification