System and method for detection of aberrant network behavior by clients of a network access gateway

• US 20050204169A1
• Filed: 03/10/2005
• Published: 09/15/2005
• Est. Priority Date: 03/10/2004
• Status: Active Grant

• Current Assignee: OpenTV, Inc. (Kudelski SA)
• Original Assignee: Eric White
• Inventors: Tonnesen, Steven D.
• Granted Patent: US 7,590,728 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A system and method for detecting aberrant network behavior. One embodiment provides a system of detecting aberrant network behavior behind a network access gateway comprising a processor, a first network interface coupled to the processor, a second network interface coupled to the processor, a storage media accessible by the processor and a set of computer instructions executable by the processor. The computer instructions can be executable to observe network communications arriving at the first network interface from multiple clients and determine when the traffic of a particular client is indicative of malware infection or other hostile network activity. If the suspicious network communication is determined to be of a sufficient volume, type, or duration the computer instructions can be executable to log such activity to storage media, or to notify an administrative entity via either the first network interface or second network interface, or to make the computer instructions be executable to perform other configured actions related to the functioning of the network access gateway.

Claims

1. A system for detecting aberrant network behavior by clients of a network access gateway, comprising:

a processor;

a first network interface coupled to the processor;

a second network interface coupled to the processor;

a storage media accessible by the processor;

a set of computer instructions executable by the processor to;

observe a network communication received at the first network interface;

determine if the network communication is aberrant; and

if the network communication is determined to be aberrant, record the event to storage and perform notifications to a registered entity.

2. The system of claim 1, wherein the computer instructions are further operable to monitor a network connected to the second network interface for a second network communication.

3. The system of claim 1, wherein the computer instructions are further operable to observe the network communication regardless of protocol.

4. The system of claim 3, wherein the network communication is received from a client on the first network and the computer instructions are further operable to associate the client with an identifier.

5. The system of claim 4, wherein the identifier comprises a MAC address or an IP address for the client.

6. The system of claim 5, wherein the computer instructions are further executable to receive at least one configuration adjustment from an internal source of the system.

7. The system of claim 5, wherein the computer instructions are further executable to receive at least one configuration adjustment from a source external to the system.

8. The system of claim 7, wherein the computer instructions are executable to determine if a client'"'"'s network communication is aberrant by means of communication with a suspicion accumulator.