Systems and methods of computer security

• US 20050262562A1
• Filed: 05/20/2005
• Published: 11/24/2005
• Est. Priority Date: 05/21/2004
• Status: Active Grant

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Gassoway, Paul
• Granted Patent: US 8,042,180 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method for combating malicious programs including monitoring network traffic from one or more devices, analyzing the network traffic to determine the presence of a malicious program in the one or more devices and disabling transmission of the network traffic for those of the one or more devices determined to have the malicious program present.

Claims

1. A method for combating malicious programs, the method comprising:

monitoring network traffic from one or more devices;

analyzing said network traffic to determine the presence of a malicious program in said one or more devices; and

disabling transmission of said network traffic for those of said one or more devices determined to have said malicious program present.

2. The method of claim 1, wherein analyzing said network traffic to determine the presence of a malicious program in said one or more devices comprises:

comparing observed network traffic for a device to a normal network traffic model for said device; and

determining that a malicious program is present when said observed network traffic deviates substantially from said normal network traffic model.

3. The method of claim 2, wherein statistical analysis is used to compare and determine.

4. The method of claim 2, wherein artificial intelligence is used to compare and determine.

5. The method of claim 2, wherein determining that a malicious program is present when said observed network traffic deviates substantially from said normal network traffic model comprises ascertaining if said observed network traffic deviates from said normal network traffic model by at least a determined margin.

6. The method of claim 5, wherein said determined margin is predetermined and fixed.

7. The method of claim 5, wherein said determined margin is determined based on historic values observed by monitoring network traffic.

8. The method of claim 5, wherein said determined margin is initially predetermined and is subsequently modified based on historic values observed by monitoring network traffic.

9. The method of claim 2, wherein said normal network traffic model is predetermined and fixed.

10. The method of claim 2, wherein said normal network traffic model is determined based on historic values observed by monitoring network traffic.

11. The method of claim 2, wherein said normal network traffic model is initially predetermined and is subsequently modified based on historic values observed by monitoring network traffic.

12. The method of claim 1, wherein disabling transmission of said network traffic for those of said one or more devices determined to have said malicious program present comprises powering down said those of said one or more devices determined to have said malicious program present.

13. The method of claim 1, wherein disabling transmission of said network traffic for those of said one or more devices determined to have said malicious program present comprises removing from said network said those of said one or more devices determined to have said malicious program present.

14. A system for combating malicious programs comprising:

a monitoring unit for monitoring network traffic from one or more devices;

an analyzing unit for analyzing said network traffic to determine the presence of a malicious program in said one or more devices; and

a disabling unit for disabling transmission of said network traffic for those of said one or more devices determined to have said malicious program present.

15. The system of claim 14, wherein analyzing said network traffic to determine the presence of a malicious program in said one or more devices comprises:

a comparing unit for comparing observed network traffic for a device to a normal network traffic model for said device; and

a determining unit for determining that a malicious program is present when said observed network traffic deviates substantially from said normal network traffic model.

16. The system of claim 15, wherein statistical analysis is used to compare and determine.

17. The system of claim 15, wherein artificial intelligence is used to compare and determine.

18. The system of claim 15, wherein determining that a malicious program is present when said observed network traffic deviates substantially from said normal network traffic model comprises ascertaining if said observed network traffic deviates from said normal network traffic model by at least a determined margin.

19. The system of claim 18, wherein said determined margin is predetermined and fixed.

20. The system of claim 18, wherein said determined margin is determined based on historic values observed by monitoring network traffic.

21. The system of claim 18, wherein said determined margin is initially predetermined and is subsequently modified based on historic values observed by monitoring network traffic.

22. The system of claim 15, wherein said normal network traffic model is predetermined and fixed.

23. The system of claim 15, wherein said normal network traffic model is determined based on historic values observed by monitoring network traffic.

24. The system of claim 15, wherein said normal network traffic model is initially predetermined and is subsequently modified based on historic values observed by monitoring network traffic.

25. The system of claim 14, wherein disabling transmission of said network traffic for those of said one or more devices determined to have said malicious program present comprises powering down said those of said one or more devices determined to have said malicious program present.

26. The system of claim 14, wherein disabling transmission of said network traffic for those of said one or more devices determined to have said malicious program present comprises removing from said network said those of said one or more devices determined to have said malicious program present.

27. A computer system comprising:

a processor; and

a program storage device readable by the computer system, embodying a program of instructions executable by the processor to perform method steps for combating malicious programs, the method comprising;

monitoring network traffic from one or more devices;

analyzing said network traffic to determine the presence of a malicious program in said one or more devices; and

disabling transmission of said network traffic for those of said one or more devices determined to have said malicious program present.

28. The computer system of claim 27, wherein analyzing said network traffic to determine the presence of a malicious program in said one or more devices comprises:

comparing observed network traffic for a device to a normal network traffic model for said device; and

determining that a malicious program is present when said observed network traffic deviates substantially from said normal network traffic model.

29. The computer system of claim 28, wherein statistical analysis is used to compare and determine.

30. The computer system of claim 28, wherein artificial intelligence is used to compare and determine.

31. The computer system of claim 28, wherein determining that a malicious program is present when said observed network traffic deviates substantially from said normal network traffic model comprises ascertaining if said observed network traffic deviates from said normal network traffic model by at least a determined margin.

32. The computer system of claim 31, wherein said determined margin is predetermined and fixed.

33. The computer system of claim 31, wherein said determined margin is determined based on historic values observed by monitoring network traffic.

34. The computer system of claim 31, wherein said determined margin is initially predetermined and is subsequently modified based on historic values observed by monitoring network traffic.

35. The computer system of claim 28, wherein said normal network traffic model is predetermined and fixed.

36. The computer system of claim 28, wherein said normal network traffic model is determined based on historic values observed by monitoring network traffic.

37. The computer system of claim 28, wherein said normal network traffic model is initially predetermined and is subsequently modified based on historic values observed by monitoring network traffic.

38. The computer system of claim 27, wherein disabling transmission of said network traffic for those of said one or more devices determined to have said malicious program present comprises powering down said those of said one or more devices determined to have said malicious program present.

39. The computer system of claim 27, wherein disabling transmission of said network traffic for those of said one or more devices determined to have said malicious program present comprises removing from said network said those of said one or more devices determined to have said malicious program present.

40. The computer recording medium of claim 39, wherein said code for analyzing said network traffic to determine the presence of a malicious program in said one or more devices comprises:

code for comparing observed network traffic for a device to a normal network traffic model for said device; and

code for determining that a malicious program is present when said observed network traffic deviates substantially from said normal network traffic model.

41. The computer recording medium of claim 40, wherein statistical analysis is used to compare and determine.

42. The computer recording medium of claim 40, wherein artificial intelligence is used to compare and determine.

43. The computer recording medium of claim 40 wherein said code for determining that a malicious program is present when said observed network traffic deviates substantially from said normal network traffic model comprises code for ascertaining if said observed network traffic deviates from said normal network traffic model by at least a determined margin.

44. The computer recording medium of claim 43, wherein said determined margin is predetermined and fixed.

45. The computer recording medium of claim 43, wherein said determined margin is determined based on historic values observed by monitoring network traffic.

46. The computer recording medium of claim 43, wherein said determined margin is initially predetermined and is subsequently modified based on historic values observed by monitoring network traffic.

47. The computer recording medium of claim 40, wherein said normal network traffic model is predetermined and fixed.

48. The computer recording medium of claim 40, wherein said normal network traffic model is determined based on historic values observed by monitoring network traffic.

49. The computer recording medium of claim 40, wherein said normal network traffic model is initially predetermined and is subsequently modified based on historic values observed by monitoring network traffic.

50. The computer recording medium of claim 39, wherein said code for disabling transmission of said network traffic for those of said one or more devices determined to have said malicious program present comprises code for powering down said those of said one or more devices determined to have said malicious program present.

51. The computer recording medium of claim 39, wherein said code for disabling transmission of said network traffic for those of said one or more devices determined to have said malicious program present comprises code for removing from said network said those of said one or more devices determined to have said malicious program present.

39-1. A computer recording medium including computer executable code for combating malicious programs, the computer executable code comprising:

code for monitoring network traffic from one or more devices;

code for analyzing said network traffic to determine the presence of a malicious program in said one or more devices; and

code for disabling transmission of said network traffic for those of said one or more devices determined to have said malicious program present.