Methods, systems, and products for intrusion detection

• US 20050268337A1
• Filed: 05/26/2004
• Published: 12/01/2005
• Est. Priority Date: 05/26/2004
• Status: Active Grant

• Current Assignee: Bellsouth Intellectual Property Corporation (AT&T, Inc.)
• Original Assignee: Bellsouth Intellectual Property Corporation (AT&T, Inc.)
• Inventors: Prince, David, Norton, Stephen Pancoast, Burchfield, Chris, Frataccia, Rick J., Gibson, Gary O. Sr.
• Granted Patent: US 7,971,053 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Methods, systems, and products are disclosed for detecting an intrusion to a communications network. One embodiment describes a system for detecting intrusions. The system has a peripheral card coupled to a host computer system. The peripheral card has a communications portion and a processor managing the communications portion. The communications portion has only a capability for receiving data packets via a communications network. The communications portion lacks capability of transmitting the data packets via the communications network. The communications portion of the peripheral card reduces intrusion of the communications network.

Claims

1. A system, comprising:

a host computer system; and

a peripheral card coupled to the host computer system, the peripheral card comprising a communications portion and a processor managing the communications portion, the communications portion having only a capability for receiving data packets via a communications network, the communications portion lacking capability of transmitting the data packets via the communications network,

wherein the communications portion of the peripheral card reduces intrusion of the communications network.

2. A system according to claim 1, further comprising a second peripheral card coupled to the host computer system, the second peripheral card comprising a second communications portion, the second communications portion having only a capability for transmitting the data packets via the communications network, the second communications portion lacking capability of receiving the data packets via the communications network, wherein the second peripheral card further reduces intrusion of the communications network.

3. A system according to claim 2, further comprising a third peripheral card coupled to the host computer system, the third peripheral card comprising a network interface portion to maintain a network connection between the communications network and the host computer system.

4. A system according to claim 1, further comprising an Intrusion Detection Module stored in memory,

the Intrusion Detection Module comparing the content of a data packet to a database of registered clients and hosts and to a set of rules,

if the data packet satisfies the set of rules, the data packet is ignored,

if, however, the data packet fails to satisfy the set of rules, the Intrusion Detection Module triggers an intrusion alert.

5. A system according to claim 4, wherein the memory stores seven rules describing the following seven observations:

i) ad-hoc communications from a client device,

ii) a mis-configured access point,

iii) probing for a service set identifier of the communications network,

iv) a rogue access point,

v) a rogue client device,

vi) a rogue communications network, and

vii) unauthorized conversation between the host communications system and the client device.

6. A system according to claim 1, further comprising a dynamically configurable Intrusion Detection Module stored in a memory device, the Intrusion Detection Module containing intrusion detection software that can reload a configuration file without rebooting the host computer system.

7. A system according to claim 1, further comprising a second peripheral card coupled to the host computer system, the second peripheral card comprising a dynamically-available second communications portion, the second communications portion having a normally unavailable state, but when dynamically activated the second peripheral card may only transmit the data packets via the communications network, the second peripheral card lacking capability of receiving the data packets via the communications network, the second peripheral card further reducing intrusion of the communications network.

8. A system according to claim 1, wherein the communications portion comprises a wireless receiver for wirelessly receiving the data packets via the communications network.

9. A system, comprising:

a host computer system; and

a peripheral card coupled to the host computer system, the peripheral card comprising a communications portion and a processor managing the communications portion, the communications portion having only a capability for wirelessly receiving data packets via a communications network, the communications portion lacking capability of wirelessly transmitting the data packets via the communications network,

wherein the communications portion of the peripheral card reduces intrusion of the communications network.

10. A system according to claim 9, further comprising a second peripheral card coupled to the host computer system, the second peripheral card comprising a second communications portion, the second communications portion having only a capability for wirelessly transmitting the data packets via the communications network, the second communications portion lacking capability of wirelessly receiving the data packets via the communications network, wherein the second peripheral card further reduces intrusion of the communications network.

11. A system according to claim 10, further comprising a third peripheral card coupled to the host computer system, the third peripheral card comprising a network interface portion to maintain a network connection between the communications network and the host computer system.

12. A system according to claim 9, further comprising an Intrusion Detection Module stored in memory,

the Intrusion Detection Module comparing the content of a data packet to a database of registered clients and hosts and to a set of rules,

if the data packet satisfies the set of rules, the data packet is ignored,

if, however, the data packet fails to satisfy the set of rules, the Intrusion Detection Module triggers an intrusion alert.

13. A system according to claim 12, wherein the memory stores seven rules describing the following seven observations:

viii) ad-hoc communications from a client device,

ix) a mis-configured access point,

x) probing for a service set identifier of the communications network,

xi) a rogue access point,

xii) a rogue client device,

xiii) a rogue communications network, and

xiv) unauthorized conversation between the host communications system and the client device.

14. A system according to claim 9, further comprising a dynamically configurable Intrusion Detection Module stored in a memory device, the Intrusion Detection Module containing intrusion detection software that can reload a configuration file without rebooting the host computer system.

15. A system according to claim 9, further comprising a second peripheral card coupled to the host computer system, the second peripheral card comprising a dynamically-available second communications portion, the second communications portion having a normally unavailable state, but when dynamically activated the second peripheral card may only wirelessly transmit the data packets via the communications network, the second peripheral card lacking capability of wirelessly receiving the data packets via the communications network, the second peripheral card further reducing intrusion of the communications network.

16. A system according to claim 9, wherein the communications portion comprises a wireless receiver for wirelessly receiving the data packets via the communications network.

17. A computer program product, comprising:

an Intrusion Detection Module stored on a computer-readable medium, the Intrusion Detection Module comparing the content of a data packet to a database of registered clients and hosts and to a set of rules,

if the data packet satisfies the set of rules, then the Intrusion Detection Module ignores the data packet, and

if the data packet fails to satisfy the set of rules, the Intrusion Detection Module triggers an intrusion alert.

18. A computer program product according to claim 17, wherein the computer-readable medium stores seven rules describing the following seven observations:

xv) ad-hoc communications from a client device,

xvi) a mis-configured access point,

xvii) probing for a service set identifier of the communications network,

xviii) a rogue access point,

xix) a rogue client device,

xx) a rogue communications network, and

xxi) unauthorized conversation between the host communications system and the client device.