Detecting intrusions

• US 20030110392A1
• Filed: 12/06/2001
• Published: 06/12/2003
• Est. Priority Date: 12/06/2001
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Richardson, John W., Aucsmith, David W.
• Application Number:
  US10/010,743
• Publication Number:
  US 20030110392A1
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Detecting intrusions includes detecting a possible security problem at a client location, transmitting notice of the possible security problem across a network in real time to a home location remotely located from the client location, determining at the home location an anomaly based on at least the possible security problem, and transmitting notice of the anomaly in real time to the client location.

Claims

1. A method comprising:

detecting a possible security problem at a client location;

transmitting notice of the possible security problem across a network in real time to a home location remotely located from the client location;

determining at the home location an anomaly based on at least the possible security problem; and

transmitting notice of the anomaly in real time to the client location.

2. The method of claim 1 further comprising transmitting notice of the anomaly in real time to other client locations that may communicate with the home location over the network.

3. The method of claim 1 further comprising notifying a firewall located between the client location and the home location about the anomaly.

4. The method of claim 1 further comprising inspecting a packet that arrives at the client location to detect the possible security problem.

5. The method of claim 1 in which the network includes a virtual private network.

6. The method of claim 1 in which the anomaly includes unauthorized access to the network.

7. The method of claim 1 in which the anomaly includes unauthorized access of a resource accessible through the network.

8. The method of claim 1 in which the anomaly includes unauthorized use of resources available through the network.

9. An article comprising:

a machine-readable medium which contains machine-executable instructions, the instructions causing a machine to;

detect a possible security problem at a client location;

transmit notice of the possible security problem across a network in real time to a home location remotely located from the client location;

determine at the home location an anomaly based on at least the possible security problem; and

transmit notice of the anomaly in real time to the client location.

10. The article of claim 9 further causing a machine to transmit notice of the anomaly in real time to other client locations that may communicate with the home location over the network

11. The article of claim 9 further causing a machine to notify a firewall located between the client location and the home location about the anomaly.

12. The article of claim 9 further causing a machine to inspect a packet that arrives at the client location to detect the possible security problem.

13. The article of claim 9 in which the network includes a virtual private network.

14. The article of claim 9 in which the anomaly includes unauthorized access to the network.

15. The article of claim 9 in which the anomaly includes unauthorized access of a resource accessible through the network.

16. The article of claim 9 in which the anomaly includes unauthorized use of resources available through the network.

17. A method comprising:

at a home location in a network, receiving from a remote client location an indication of a possible security problem at the client; and

determining in real time at the home location an existence of an anomaly based on at least the indication of the possible security problem.

18. The method of claim 17 further comprising transmitting notice of the existence of the anomaly in real time from the home location to the remote client location.

19. The method of claim 17 further comprising notice of the existence of the anomaly in real time from the home location to other remote client locations that many communicate with the home location over the network.

20. The method of claim 17 further comprising notifying, from the home location, a firewall located between the remote client location and the home location about the anomaly.

21. The method of claim 17 further comprising transmitting information from the home location to the remote client location to help the remote client location identify possible security problems.

22. The method of claim 17 further comprising determining the existence of the anomaly based on at least information regarding previous anomalies.

23. A method comprising:

detecting a possible security problem at a client location;

transmitting notice of the possible security problem across a network in real time to a home location remotely located from the client location; and

receiving in real time at the client location a notice from the home location indicating an existence of an anomaly based on at least the possible security problem.

24. The method of claim 23 further comprising inspecting a packet that arrives at the client location to detect the possible security problem.

25. The method of claim 23 further comprising receiving in real time at the client location a notice from the home location indicating an existence of a possible security problem detected by another client location that can communicate with the home location over the network.

26. An apparatus comprising:

a client terminal;

a first mechanism accessible by the client terminal and configured to detect a possible security problem at the client terminal;

a second mechanism accessible by the client terminal and configured to transmit notice of the possible security problem across a network in real time to a server remotely located from the client terminal; and

a third mechanism accessible by the client terminal and configured to receive updates from the server in real time regarding security problems that the first mechanism may use in detecting possible security problems.

27. The apparatus of claim 26 in which the first mechanism is also configured to monitor packets that arrive at the client terminal for the possible security problem.

28. An apparatus comprising:

a server;

a first mechanism accessible by the server and configured to determine an anomaly based on at least information from a client regarding a possible security problem; and

a second mechanism accessible by the server and configured to transmit notice of the anomaly in real time over a network to the client and to other client locations that may communicate with the server over the network.

29. The apparatus of claim 28 in which the first mechanism is also configured to determine the anomaly based on at least information regarding previously determined anomalies.

30. A system comprising:

a client terminal;

a server;

a first client mechanism accessible by the client terminal and configured to detect a possible security problem at the client terminal;

a second client mechanism accessible by the client terminal and configured to transmit notice of the possible security problem across a network in real time to a server remotely located from the client terminal;

a third client mechanism accessible by the client terminal and configured to receive updates from the server in real time regarding security problems that the first client mechanism may use in detecting possible security problems;

a first server mechanism accessible by the server and configured to determine an anomaly based on at least information from a client regarding a possible security problem; and

a second server mechanism accessible by the server and configured to transmit notice of the anomaly in real time over the network to the client terminal.

31. The system of claim 30 in which the first client mechanism is also configured to monitor packets that arrive at the client terminal for the possible security problem.

32. The system of claim 30 in which the first server mechanism is also configured to determine the anomaly based on at least information regarding previously determined anomalies.

33. The system of claim 30 in which the second server mechanism is also configured to transmit notice of the anomaly in real time to other client locations that may communicate with the server over the network.

34. The system of claim 30 further comprising a firewall located between the client terminal and the server and configured to act as an intermediary for information flowing between the client terminal and the server.

35. The system of claim 34 in which the firewall includes a corporate server.

36. A method comprising:

processing information relating to possible security problems associated with a private network at a home location to determine a security problem; and

modifying a monitoring agent included at each one of multiple clients to reflect the security problem, each one of the multiple clients capable of communicating the information to the home location.

37. The method of claim 36 further comprising performing the modifying in real time.

38. The method of claim 36 in which the multiple clients can communicate the information in real time.