Method and apparatus for mitigating the effects of malicious software in a communication network

• US 20060288417A1
• Filed: 06/21/2005
• Published: 12/21/2006
• Est. Priority Date: 06/21/2005
• Status: Abandoned Application

• Current Assignee: Sbc Knowledge Ventures, L.P.
• Original Assignee: Sbc Knowledge Ventures, L.P.
• Inventors: Bookbinder, James B., Steele, Dawn, Garcia, Joe, Paden, Jon, Green, Antonio
• Application Number:
  US11/157,774
• Publication Number:
  US 20060288417A1
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A controller (104) manages operations of a communication network (101). The controller has a communication element (202) for monitoring data traffic in the communication network and for controlling operations of the communication network, a memory (204) for storage, and a processor (206) for controlling operations of the communication element, and the memory. The processor is programmed to monitor (302) the communication network for the effects of malicious software, detect (304) a suspected malicious event, record (306) the suspected malicious event, restrict (308) Internet access to one or more customers suspected of having infected terminal equipment interrupting service of the communication network, and notify (310) said one or more customers of the restricted Internet access.

Claims

1. A computer-readable storage medium for managing a communication network, the storage medium comprising computer instructions for:

monitoring the communication network for the effects of malicious software;

detecting a suspected malicious event;

recording the suspected malicious event

restricting Internet access to one or more customers suspected of having infected terminal equipment interrupting service of the communication network; and

notifying said one or more customers of the restricted Internet access.

2. The storage medium of claim 1, comprising computer instructions for providing said one or more customers with options to remove malicious software from their terminal equipment.

3. The storage medium of claim 1, comprising computer instructions for:

receiving a request from terminal equipment of one of said customers to access the Internet;

determining if said terminal equipment is a source of the suspected malicious event; and

if so, supplying said terminal equipment an Internet web page with limited access to the communication network providing notification of the restricted access and one or more options to remedy the suspected malicious software operating in said terminal equipment.

4. The storage medium of claim 3, wherein said options are at least one among a group of options comprising instructions for selecting one or more software solutions to remove the suspected malicious software from the infected terminal equipment of said customer, offering customer service support, offering technical support, and an option to accept requests from the one or more customers to remove the restricted access on the basis of mitigation steps taken by said customers.

5. The storage medium of claim 1, comprising computer instructions for:

receiving an indication from one of said customers that the suspected malicious software has been removed; and

removing the restricted access to the Internet for said customer.

6. The storage medium of claim 1, comprising computer instructions for:

receiving a call from one of said customers;

determining if the terminal equipment of the calling customer is a source of the suspected malicious event; and

notifying said customer of the restricted access and provide one or more options to remedy the suspected malicious software operating in the terminal equipment of said customer.

7. The storage medium of claim 6, wherein said options are at least one among a group of options comprising instructions for selecting one or more software solutions to remove the suspected malicious software from the infected terminal equipment of said customer, offering customer service support, offering technical support, and an option to accept requests from the one or more customers to remove the restricted access on the basis of mitigation steps taken by said customers.

8. The storage medium of claim 6, comprising computer instructions for:

receiving a request from said customer for support from an agent of the communication network;

routing said customer to the agent;

informing the agent of the suspected malicious event and its association with said customer;

removing upon a request of the agent the restricted Internet access to said customer; and

recording that the suspected malicious event has been resolved for said customer.

9. A controller for managing operations of a communication network, the controller comprising:

a communication element for monitoring data traffic in the communication network and for controlling operations of the communication network;

a memory for storage; and

a processor for controlling operations of the communication element, and the memory, wherein the processor is programmed to;

monitor the communication network for the effects of malicious software;

detect a suspected malicious event;

record the suspected malicious event;

restrict Internet access to one or more customers suspected of having infected terminal equipment interrupting service of the communication network; and

notify said one or more customers of the restricted Internet access.

10. The controller of claim 9, wherein the processor is programmed to provide said one or more customers with options to remove malicious software from their terminal equipment.

11. The controller of claim 9, wherein the processor is programmed to:

receive a request from terminal equipment of one of said customers to access the Internet;

determine if said terminal equipment is a source of the suspected malicious event; and

if so, supply said terminal equipment an Internet web page with limited access to the communication network providing notification of the restricted access and one or more options to remedy the suspected malicious software operating in said terminal equipment.

12. The controller of claim 11, wherein said options are at least one among a group of options comprising instructions for selecting one or more software solutions to remove the suspected malicious software from the infected terminal equipment of said customer, offering customer service support, offering technical support, and an option to accept requests from the one or more customers to remove the restricted access on the basis of mitigation steps taken by said customers.

13. The controller of claim 9, wherein the processor is programmed to:

receive an indication from one of said customers that the suspected malicious software has been removed; and

remove the restricted access to the Internet for said customer.

14. The controller of claim 9, wherein the processor is programmed to:

receive a call from one of said customers;

determine if the terminal equipment of the calling customer is a source of the suspected malicious event; and

notify said customer of the restricted access and provide one or more options to remedy the suspected malicious software operating in the terminal equipment of said customer.

15. The controller of claim 14, wherein said options are at least one among a group of options comprising instructions for selecting one or more software solutions to remove the suspected malicious software from the infected terminal equipment of said customer, offering customer service support, offering technical support, and an option to accept requests from the one or more customers to remove the restricted access on the basis of mitigation steps taken by said customers.

16. The controller of claim 14, wherein the processor is programmed to:

receive a request from said customer for support from an agent of the communication network;

route said customer to the agent;

inform the agent of the suspected malicious event and its association with said customer;

remove upon a request of the agent the restricted Internet access to said customer; and

record that the suspected malicious event has been resolved for said customer.

17. In a controller that manages a communication network, a method comprising the steps of:

monitoring the communication network for the effects of malicious software;

detecting a suspected malicious event;

recording the suspected malicious event;

restricting Internet access to one or more customers suspected of having infected terminal equipment interrupting service of the communication network;

notifying said one or more customers of the restricted Internet access; and

providing said one or more customers with options to remove malicious software from their terminal equipment.

18. The method of claim 17, comprising the steps of:

receiving a request from terminal equipment of one of said customers to access the Internet;

determining if said terminal equipment is a source of the suspected malicious event; and

if so, supplying said terminal equipment an Internet web page with limited access to the communication network providing notification of the restricted access and one or more options to remedy the suspected malicious software operating in said terminal equipment, wherein said options are at least one among a group of options comprising instructions for selecting one or more software solutions to remove the suspected malicious software from the infected terminal equipment of said customer, offering customer service support, offering technical support, and an option to accept requests from the one or more customers to remove the restricted access on the basis of mitigation steps taken by said customers.

19. The method of claim 17, comprising the steps of:

receiving an indication from one of said customers that the suspected malicious software has been removed; and

removing the restricted access to the Internet for said customer.

20. The method of claim 17, comprising the steps of:

receiving a call from one of said customers;

determining if the terminal equipment of the calling customer is a source of the suspected malicious event; and

notifying said customer of the restricted access and provide one or more options to remedy the suspected malicious software operating in the terminal equipment of said customer, wherein said options are at least one among a group of options comprising instructions for selecting one or more software solutions to remove the suspected malicious software from the infected terminal equipment of said customer, offering customer service support, offering technical support, and an option to accept requests from the one or more customers to remove the restricted access on the basis of mitigation steps taken by said customers.