Method and system for preventing, auditing and trending unauthorized traffic in network systems

• US 20060242701A1
• Filed: 04/20/2005
• Published: 10/26/2006
• Est. Priority Date: 04/20/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Black, Robert Barth, Wright, Steven Richard
• Granted Patent: US 8,171,544 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A method and system for preventing, auditing and trending unauthorized traffic in a network system is provided. The unauthorized traffic is detected at the router level. An attacker transmits an attack vector to the network system. The attack vector is detected at the router and signatures are created for network system resources, wherein each signature represents the response of a network system resource to the attack vector. Signatures are created by learning how the attack is taking place within the network system. Network system resources corresponding to the signatures are then emulated, thereby protecting the network device.

Claims

1. A method for preventing unauthorized traffic in a network system, the method comprising

providing a router;

creating signatures for network system resources, wherein each signature represents the behavior of a network system resource to an attack vector; and

emulating network system resources to understand the attack vector on the router, wherein emulating the network system resources is based on the signatures.

2. The method of claim 1 further comprising identifying the type of the attack vector.

3. The method of claim 1 wherein creating the signatures further comprises modeling the types of services available on the network system.

4. The method of claim 1 further comprising learning how the attack vector is occurring within the network if the attack vector is unknown.

5. The method of claim 4 further comprising updating the signatures for the network system resources.

7. The method of claim 1 further comprising providing an application program interface module to learn how the attack vector is occurring within the network system.

8. The method of claim 1 further comprising providing an application program interface module for updating the signatures for the network system resources.

6. A method for learning information about unauthorized network traffic in a network system, the method comprising:

providing a router; and

emulating network system resources to understand an attack vector on the router and learn how the attack vector is occurring within the network system.

9. A method for auditing network traffic in a network system, the method comprising

providing a router;

and

creating a session audit policy based on an access control language, wherein the session audit policy is used to understand the network traffic.

10. The method of claim 9 wherein understanding the network traffic further comprises identifying the unauthorized traffic.

11. The method of claim 9 further comprising providing an application program interface for triggering a session level audit policy.

12. The method of claim 9 wherein the session level audit policy is triggered by a network device.

13. The method of claim 12 wherein the session level audit policy is triggered by a router.

14. The method of claim 9 wherein the session level audit policy is triggered by a network system resource.

15. A system for preventing unauthorized network traffic in a network system, the system comprising:

a router;

a signature creator for creating signatures for network system resources, wherein each signature represents the behavior of a network system resource to an attack vector;

a system of record for storing the signatures for network system resources; and

a resource emulator disposed in the router for emulating the network system resources to understand the attack vector on the router, wherein emulating the network system resources is based on the signatures.

16. The system of claim 15 further comprising an attack vector identifier for identifying the type of the attack vector.

17. The system of claim 15 further comprising a session level audit policy manager for auditing the unauthorized network traffic.

18. A system for preventing unauthorized network traffic in a network, the system comprising:

means for routing;

means for creating signatures for network system resources, wherein each signature represents the behavior of a network system resource to an attack vector;

means for storing the signatures for the network system resources; and

means for emulating the network system resources to understand the attack vector, wherein emulating the network system resources is based on the signatures.

19. A system comprising:

a router; and

a computer coupled to the router and including an adaptive service learning software module for emulating network system resources to understand an attack vector and learn how the attack vector is occurring within a network.

20. A device for learning information about unauthorized network traffic in a network system, the device comprising:

a router; and

an adaptive service learning module disposed in the router for emulating network system resources to understand an attack vector and learn how the attack vector is occurring within a network.

21. An apparatus for preventing unauthorized traffic in a network, the apparatus comprising:

a processing system including a processor coupled to a display and user input device;

a machine-readable medium including instructions executable by the processor comprising

one or more instructions for providing a router;

one or more instructions for creating signatures for network system resources, wherein each signature represents the behavior of a network system resource to an attack vector; and

one or more instructions for emulating the network system resources to understand the attack vector on the router, wherein emulating the network system resources is based on the signatures.

22. A machine-readable medium including instructions executable by the processor for preventing unauthorized traffic in a network, the machine-readable medium comprising:

one or more instructions for providing a router;

one or more instructions for creating signatures for network system resources, wherein each signature represents the behavior of a network system resource to an attack vector; and

one or more instructions for emulating the network system resources to understand the attack vector on the router, wherein emulating the network system resources is based on the signatures.