System, method and device for intrusion prevention

• US 20060075481A1
• Filed: 09/28/2004
• Published: 04/06/2006
• Est. Priority Date: 09/28/2004
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Ross, Alan D., Gutman, Michael
• Application Number:
  US10/950,496
• Publication Number:
  US 20060075481A1
• Time in Patent Office: Days
• US Class Current: 726/13
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

Embodiments of the present invention provide a method, apparatus and system for intrusion prevention. The method according to some exemplary embodiments of the invention may include determining whether a current packet associated with a host is a malicious packet based on at least one predetermined, host-specific, inspection rule related to the host. Other embodiments are described and claimed.

Claims

1. An apparatus comprising:

an inspection configuration able to determine whether a current packet associated with a host is a malicious packet, based on at least one predetermined, host-specific, inspection rule.

2. The apparatus of claim 1, wherein said current packet comprises a packet provided by said host.

3. The apparatus of claim 1, wherein said current packet comprises a packet intended to be provided to said host.

4. The apparatus of claim 1, wherein said inspection configuration comprises a rule memory able to store said at least one inspection rule.

5. The apparatus of claim 1, wherein said inspection configuration comprises a rule checker able to determine whether said current packet includes at least a portion of a predetermined malicious sequence corresponding to said inspection rule.

6. The apparatus of claim 5, wherein said rule checker comprises a searcher able to search at least part of said current packet for at least a portion of said malicious sequence.

7. The apparatus of claim 5, wherein said rule checker is able to block said current packet if said current packet is determined to be a malicious packet.

8. The apparatus of claim 5, wherein said inspection configuration is able to inspect said current packet based on context information related to at least one previous packet.

9. The apparatus of claim 8, wherein said inspection configuration comprises a context memory able to store said context information.

10. The apparatus of claim 8, wherein said inspection configuration comprises a searcher able to search at least part of said current packet for one or more at least partial malicious sequences based on said context information.

11. The apparatus of claim 1 comprising at least one parser to separate one or more fields of said current packet.

12. The apparatus of claim 1 comprising a controller able to update one or more of said inspection rules.

13. The apparatus of claim 12, wherein said controller is able to provide to a managing console an alert regarding one or more malicious packets detected by said inspection configuration.

14. The apparatus of claim 13, wherein said controller is able to communicate with said managing console to receive said one or more inspection rules.

15. The apparatus of claim 14, wherein said controller is able to communicate with said managing console during a time period corresponding to a power-up mode of said host.

16. A method comprising:

determining whether a current packet associated with a host is a malicious packet, based on at least one predetermined, host-specific, inspection rule.

17. The method of claim 16, wherein determining whether said current packet is a malicious packet comprises determining whether said current packet includes at least a portion of a predetermined malicious sequence corresponding to said inspection rule.

18. The method of claim 17, wherein determining whether said current packet includes at least a portion of said predetermined malicious sequence comprises searching at least part of said current packet for at least a portion of said malicious sequence.

19. The method of claim 16 comprising blocking said current packet if said current packet is determined to be a malicious packet.

20. The method of claim 16, wherein determining whether said current packet is a malicious packet comprises determining whether said current packet is a malicious packet based on context information related to at least one previous packet.

21. The method of claim 20 comprising storing said context information.

22. The method of claim 20, wherein determining whether said current packet is a malicious packet based on said context information comprises searching at least part of said current packet for one or more at least partial malicious sequences based on said context information.

23. The method of claim 16 comprising updating one or more of said inspection rules.

24. The method of claim 23, wherein updating one or more of said inspection rules comprises receiving updated instruction rules from a managing console.

25. The method of claim 24, wherein receiving updated instruction rules from a managing console comprises receiving updated instruction rules from a managing console at one or more predetermined time periods.

26. The method of claim 25, wherein said one or more time periods comprise a time period corresponding to a power-up mode of said host.

27. A system comprising:

a communication device comprising;

a transmitter/receiver to transmit/receive a current packet associated with a host; and

an inspection configuration able to determine whether said current packet is a malicious packet based on at least one predetermined, host-specific, inspection rule.

28. The system of claim 27 comprising another communication device able to receive one or more packets transmitted by said transmitter/receiver.

29. The system of claim 27, wherein said inspection configuration comprises a rule memory able to store said at least one inspection rule.

30. The system of claim 27, wherein said inspection configuration comprises a rule checker able to determine whether said current packet includes at least a portion of a predetermined malicious sequence corresponding to said inspection rule.

31. The system of claim 27 comprising at least one parser to separate one or more fields of said current packet.

32. The system of claim 27 comprising a controller able to update one or more of said inspection rules.

33. A program storage device having instructions readable by a machine that when executed by the machine result in:

determining whether a current packet associated with a host is a malicious packet, based on at least one predetermined, host-specific, inspection rule.

34. The program storage device of claim 33, wherein determining whether said current packet is a malicious packet comprises determining whether said current packet includes at least a portion of a predetermined malicious sequence corresponding to said inspection rule.

35. The program storage device of claim 33, wherein said instructions result in blocking said current packet if said current packet is determined to be a malicious packet.

36. The program storage device of claim 33, wherein determining whether said current packet is a malicious packet comprises determining whether said current packet is a malicious packet based on context information related to at least one previous packet.