Method and apparatus for combating malicious code

• US 20070006313A1
• Filed: 09/19/2005
• Published: 01/04/2007
• Est. Priority Date: 09/17/2004
• Status: Active Grant

• Current Assignee: SRI International, Inc.
• Original Assignee: SRI International, Inc.
• Inventors: Porras, Phillip, Briesemeister, Linda
• Granted Patent: US 8,214,901 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method and apparatus are provided for combating malicious code. In one embodiment, a method for combating malicious code in a network includes implementing a resource-limiting technique to slow a propagation of the malicious code and implementing a leap-ahead technique in parallel with the resource-limiting technique to defend against the malicious code reaching a full saturation potential in the network.

Claims

1. A method for combating malicious code in a network, comprising:

implementing a resource-limiting technique to slow a propagation of said malicious code through said network; and

implementing a leap-ahead technique in parallel with said resource-limiting technique to defend against said malicious code reaching a full saturation potential in said network.

2. The method of claim 1, wherein said resource-limiting technique limits a number of outbound connections that one or more associated nodes may make per unit of time.

3. The method of claim 1, wherein said leap-ahead technique comprises:

generating an alert in response to said detection; and

distributing said alert to a pre-selected group of peers.

4. The method of claim 3, wherein said generating is performed in response to said resource-limiting technique detecting the breach of a threshold relating to resource usage.

5. The method of claim 3, wherein said leap-ahead technique further comprises:

receiving one or more alerts from one or more peers in said network, said alerts indicating the detection of said malicious code.

6. The method of claim 1, further comprising:

implementing a defensive action if a combination of said resource-limiting technique and said leap-ahead technique indicates a threshold amount of malicious code activity.

7. The method of claim 6, wherein said defensive action is halted if said malicious code activity is observed to fall below said threshold amount.

8. The method of claim 6, wherein said threshold amount is adjustable.

9. The method of claim 6, wherein said defensive action is the enablement of a filter to selectively block network traffic meeting defined characteristics.

10. The method of claim 9, wherein said defined characteristics correspond to characteristics of packets dropped in accordance with said resource-limiting technique.

11. The method of claim 10, wherein said defined characteristics include at least one of:

a port/protocol pair representing a dominant target port/protocol used by outbound packets during a time at which a violation of a resource usage threshold is detected, an average datagram size sent during said time at which said violation of said resource usage threshold is detected and a standard deviation of datagrams sent during said time at which said violation of said resource usage threshold is detected.

12. The method of claim 11, comprising:

denying at least one incoming packet corresponding to said dominant target port/protocol.

13. A computer readable medium containing an executable program for combating malicious code in a network, the method comprising:

implementing a resource-limiting technique to slow a propagation of said malicious code through said network; and

implementing a leap-ahead technique in parallel with said resource-limiting technique to defend against said malicious code reaching a full saturation potential in said network.

14. The computer readable medium of claim 13, wherein said resource-limiting technique limits a number of outbound connections that one or more associated nodes may make per unit of time.

18. The computer readable medium of claim 13, further comprising:

implementing a defensive action if a combination of said resource-limiting technique and said leap-ahead technique indicates a threshold amount of malicious code activity.

19. The computer readable medium of claim 18, wherein said defensive action is halted if said malicious code activity is observed to fall below said threshold amount.

20. The computer readable medium of claim 18, wherein said threshold amount is adjustable.

21. The computer readable medium of claim 18, wherein said defensive action is the enablement of a filter to selectively block network traffic meeting defined characteristics.

22. The computer readable medium of claim 21, wherein said defined characteristics correspond to characteristics of packets dropped in accordance with said resource-limiting technique.

23. The computer readable medium of claim 22, wherein said defined characteristics include at least one of:

a port/protocol pair representing a dominant target port/protocol used by outbound packets during a time at which a violation of a resource usage threshold is detected, an average datagram size sent during said time at which said violation of said resource usage threshold is detected and a standard deviation of datagrams sent during said time at which said violation of said resource usage threshold is detected.

24. The computer readable medium of claim 23, comprising:

denying at least one incoming packet corresponding to said dominant target port/protocol.

15. The computer readable medium of claim 15, wherein said leap-ahead technique comprises:

generating an alert in response to said detection; and

distributing said alert to a pre-selected group of peers.

16. The computer readable medium of claim 15, wherein said generating is performed in response to said resource-limiting technique detecting the breach of a threshold relating to resource usage.

17. The computer readable medium of claim 15, wherein said leap-ahead technique further comprises:

receiving one or more alerts from one or more peers in said network, said alerts indicating the detection of said malicious code.

25. Apparatus for combating malicious code in a network, the apparatus comprising:

means for implementing a resource-limiting technique to slow a propagation of said malicious code through said network; and

means for implementing a leap-ahead technique in parallel with said resource-limiting technique to defend against said malicious code reaching a full saturation potential in said network.