Systems and methods for enhanced network security

• US 20060069912A1
• Filed: 05/30/2003
• Published: 03/30/2006
• Est. Priority Date: 05/30/2003
• Status: Active Grant

• Current Assignee: Calyptix Security
• Original Assignee: Calyptix Security
• Inventors: Zheng, Yuliang, Teo, Lawrence Chin Shiun
• Granted Patent: US 8,065,725 B2
• Time in Patent Office: Days
• US Class Current: 713/151
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Systems and methods for an information system security infrastructure are described. One embodiment of the present invention comprises global Internet-scale defense infrastructure, referred to as the Intrusion Detection Force (IDF). The IDF comprises a virtual infrastructure implemented on top of an existing network, such as the Internet. The IDF enables secure information sharing and intelligent data analysis and response. The node (e.g. 102 of FIG. 1) is the most primitive entity in the IDF architecture, and may be a switch, router, server, or workstation. The IDF may be implemented in small networks of computers or may be utilized by millions of hosts throughout the Internet, spanning different organizations, countries, and continents.

Claims

1. A network security system, comprising:

a security infrastructure operable to communicate with a computer network and further operable to facilitate communication of security data from a first node to a second node, wherein said first node and said second node comprise;

an adaptation layer; and

a security agent.

2. The system of claim 1, wherein said security agent further comprises a vulnerability database interface.

3. The system of claim 1, wherein said security agent further comprises an analysis engine.

4. The system of claim 3, further comprising an anomaly profile database in communication with said analysis engine.

5. The system of claim 3, further comprising an attacker profile database in communication with said analysis engine.

6. The system of claim 1, wherein said security agent further comprises a plug-in extension engine.

7. The system of claim 1, wherein said security agent further comprises a software update distribution engine.

8. The system of claim 7, further comprising a software update repository in communication with said software update distribution engine.

9. The system of claim 1, wherein said security agent further comprises a data collection sensor.

10. The system of claim 1, wherein said security agent further comprises a response engine.

11. The system of claim 1, wherein said second node comprises a supernode.

12. The system of claim 1, further comprising a third node, wherein said security infrastructure is operable to facilitate communication of said security data from said third node to said second node.

13. The system of claim 12, wherein said first node and said second node comprise a node collective.

14. The system of claim 1, wherein said plurality of nodes comprises:

a node collective; and

a supernode collective in communication with said node collective.

15. A method for providing network security comprising:

receiving a plurality of data values from a plurality of nodes;

analyzing said plurality of data values to determine if a network intrusion has occurred.

16. The method of claim 15, further comprising responding to said network intrusion.

17. The method of claim 16, wherein said responding comprises causing an alert message to be sent.

18. The method of claim 15, further comprising transmitting a software update to said plurality of nodes.

19. The method of claim 15, further comprising receiving a vulnerability update from a vulnerability database interface.