Responding to malicious traffic using separate detection and notification methods

• US 20060174001A1
• Filed: 11/21/2005
• Published: 08/03/2006
• Est. Priority Date: 01/31/2005
• Status: Abandoned Application

• Current Assignee: The Theta Networks Incorporated
• Original Assignee: The Theta Networks Incorporated
• Inventors: Zhu, Shouyu
• Application Number:
  US11/284,767
• Publication Number:
  US 20060174001A1
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method and a system for responding to malicious traffic in a mobile IP network are provided. The method may detect malicious traffic communicated to and from a mobile subscriber via a first method, and notify the mobile subscriber using a second method. The system may include a network interface coupled to the mobile network, and a processor executing the method. An embodiment of the present invention may intrusively or non-intrusively monitor the mobile subscriber'"'"'s data traffic for malicious traffic and security intrusion attempts. Another embodiment of the present invention may report to an operator the identity of the mobile subscriber sending malicious traffic. Yet another embodiment of the present invention may block the mobile subscriber'"'"'s subscription or alert the mobile subscriber. One embodiment of the present invention may be applied to mobile networks where the mobile subscriber'"'"'s identity is known by an unique identifier and where a subscriber may be notified by a messaging service.

Claims

1. A method for responding to malicious traffic in a mobile network comprising:

detecting malicious traffic being communicated to and from a mobile subscriber unit via a first method; and

notifying the mobile subscriber unit using a second method being different than the first method.

2. The method of claim 1 wherein the first method and the second method are communication protocols.

3. The method of claim 1 wherein the first method is a protocol adapted for a packet switched network.

4. The method of claim 1 wherein the second method is a stateless protocol.

5. The method of claim 1 wherein the second method is selected from a group consisting of SMS, MMS, IM, voice, email, and Push to Talk.

6. The method of claim 1 wherein the second method is an URL redirection in response to a request selected from a group consisting of a HTTP GET and WAP GET.

7. The method of claim 6 wherein the URL redirection is performed by a redirecting network node selected from a group consisting of a Domain Name Server and an Internet Protocol Server.

8. The method of claim 1 wherein the second method is native to an air interface used for sending messages to the mobile subscriber unit.

9. An apparatus for responding to malicious traffic in a mobile network comprising;

an network interface coupled to the mobile network; and

a processor which executes a method for responding to malicious traffic in the mobile network, wherein the method for responding to malicious traffic in the mobile network comprises;

detecting malicious traffic being communicated to and from a mobile subscriber unit via a first method; and

notifying the mobile subscriber unit using a second method being different than the first method.

10. The apparatus of claim 9 wherein the first method and the second method are communication protocols.

11. The apparatus of claim 9 wherein the first method is a protocol adapted for a packet switched network.

12. The apparatus of claim 9 wherein the second method is a stateless protocol.

13. The apparatus of claim 9 wherein the second method is selected from a group consisting of SMS, MMS, IM, voice, email, and Push to Talk.

14. The method of claim 9 wherein the second method is an URL redirection in response to a request selected from a group consisting of a HTTP GET and WAP GET.

15. A method of claim 14 wherein the URL redirection is performed by a redirecting network node selected from a group consisting of a Domain Name Server and an Internet Protocol Server.

16. The method of claim 9 wherein the second method is native to an air interface used for sending messages to the mobile subscriber unit.