Detector and computerized method for determining an occurrence of tunneling activity

• US 20060031928A1
• Filed: 08/09/2004
• Published: 02/09/2006
• Est. Priority Date: 08/09/2004
• Status: Abandoned Application

• Current Assignee: Sytex, Inc. (Leidos Holdings, Inc.)
• Original Assignee: Sytex, Inc. (Leidos Holdings, Inc.)
• Inventors: Cole, Eric B., Conley, James Walter
• Application Number:
  US10/915,686
• Publication Number:
  US 20060031928A1
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Devices and methods are provided to ascertain an existence of tunneling activity through a network firewall. According to one methodology, a set of norms is established for network traffic and a series of data packets transmitted through the firewall are monitored. Data packet attributes are analyzed to determine an absence or an existence of tunneling activity based on whether the attributes conform to the norms. A device is also provided in the form of a detector which is situated behind a network firewall and incorporates a data capture component for passively monitoring network traffic through the firewall and for producing detection data, and a data analysis component for comparing the detection data to a set of network traffic norms that are characteristic of an absence of tunneling activity. Tunneling activity potentially exists if the detection data fails to conform to any one of the set of norms.

Claims

1. A computerized method for determining whether tunneling activity is occurring through a network firewall between two network devices which communicate through transmission of data packets, said computerized method comprising:

establishing a set of norms for network traffic through the firewall;

monitoring a series of the data packets transmitted through the firewall;

analyzing attributes associated with the data packets in order to determine one of;

an absence of tunneling activity if the attributes conform to the set of norms; and

an existence of tunneling activity if the attributes fail to conform to the set of norms.

2. A computerized method according to claim 1 whereby the set of norms includes one or more expectations selected from a group consisting of:

a first expectation that an average outbound packet length for selected communications protocols should not exceed a selected packet length value;

a second expectation that a series of connections between the two computer systems should not exceed a selected time duration value;

a third expectation that a frequency of connections between the two computer systems should not exceed a selected connection frequency value;

a fourth expectation that data corresponding to any of a plurality of key words should be absent in non-TCP packet transmission types; and

a fifth expectation that encrypted data should be absent in particular communications protocols.

3. A computerized method according to claim 2 whereby the selected communications protocols are telnet and dns, and whereby the selected packet length value is between about 1000 bytes and 1500 bytes.

4. A computerized method according to claim 3 whereby the selected communications protocols are telnet and dns, and whereby the selected packet length value is 1250 bytes.

5. A computerized method according to claim 2 whereby the selected time duration value is between about 10 minutes and 30 minutes.

6. A computerized method according to claim 2 whereby the plurality of key words are selected from a group consisting of:

http, get, post, jpeg and smtp.

7. A computerized method according to claim 2 whereby said particular communications protocols include ICMP and UDP.

8. A computerized method according to claim 1 whereby monitoring of the data packets transmitted through the firewall is accomplished with a network sniffer.

9. A computerized method for ascertaining a potential existence of tunneling activity between a front end computer system located exteriorly of a network firewall and a back end computer system located behind the network firewall, wherein said front end and back end computer systems are adapted to communicate according to an overt communications protocol by transmitting network traffic through the firewall as a stream of data packets, said computerized method comprising:

establishing a set of parameters, each corresponding to a respective attribute of interest for network traffic transmitted through the firewall;

establishing a set of norms, each based on at least one of said parameters;

monitoring network traffic transmitted through the firewall;

collecting data corresponding to the set of parameters from each of a series of data packets associated with network traffic transmitted through the firewall, thereby to generate captured data;

generating detection data from the captured data;

analyzing the detection data to determine whether it adheres to the set of norms; and

identifying an existence of potential tunneling activity between the front end and back end computer systems upon a determination that the detection data fails to conform to any one of the set of norms.

10. A computerized method according to claim 9 whereby monitoring of the network traffic through the firewall is accomplished through a network sniffer.

11. A computerized method according to claim 10 whereby said network sniffer captures, with respect to each connection between the front end and back end computer systems, data corresponding to connection start time, connection end time, connection port, connection protocol, connection source IP address, connection destination IP address, and packet length.

12. A method according to claim 9 whereby the set of norms includes one or more expectations selected from a group consisting of:

a first expectation that an average outbound packet length for selected communications protocols should not exceed a selected packet length value;

a second expectation that a series of connections between the two computer systems should not exceed a selected time duration value;

a third expectation that a frequency of connections between the two computer systems should not exceed a selected connection frequency value;

a fourth expectation that data corresponding to any of a plurality of key words should be absent in non-TCP packet transmission types; and

a fifth expectation that encrypted data should be absent in particular communications protocols.

13. A detector adapted to be situated behind a network firewall for use in determining whether tunneling activity is occurring through the firewall, said detector comprising:

a data capture component for passively monitoring network traffic passing through the firewall and for producing detection data corresponding thereto; and

a data analysis component for comparing the detection data to a set of norms for network traffic that are characteristic of an absence of tunneling activity, and for identifying a potential existence of tunneling activity if the detection data fails to conform to any one of the set of norms.

14. A detector according to claim 13 comprising a response component for initiating at least one of a plurality of responses upon identifying a potential existence of tunneling activity.

15. A detector according to claim 14 wherein said plurality of responses is selected from a group consisting of:

a first response which entails transmission of a suitable notification to an administrator of the network;

a second response which entails transmission of a suitable notification to the firewall for the purpose of terminating the tunneling activity;

a third response which entails execution of a pre-defined script; and

a fourth response which entails creation a log containing data parameters for the tunneling activity.

16. A detector according to claim 13 wherein said detection data includes captured data from a network sniffer and derived data that is generated from said captured data.

17. A detector according to claim 13 wherein said data capture component stores said detection data as a connection table in memory which is accessible by said data analysis component.

18. A detector according to claim 13 wherein said data analysis component includes a logic engine for sequentially determining, with respect to each of said set of norms, whether said detection data conforms thereto.

19. A detector according to claim 13 wherein said set of norms includes one or more expectations selected from a group consisting of:

a first expectation that an average outbound packet length for selected communications protocols should not exceed a selected packet length value;

a second expectation that a series of connections between two computer systems should not exceed a selected time duration value;

a third expectation that a frequency of connections between two computer systems should not exceed a selected connection frequency value;

a fourth expectation that data corresponding to any of a plurality of key words should be absent in non-TCP packet transmission types; and

a fifth expectation that encrypted data should be absent in particular communications protocols.