Correlation engine for detecting network attacks and detection method

• US 20070214503A1
• Filed: 03/08/2006
• Published: 09/13/2007
• Est. Priority Date: 03/08/2006
• Status: Active Grant

• Current Assignee: Imperva Incorporated (Thales SA)
• Original Assignee: Imperva Incorporated (Thales SA)
• Inventors: Kremer, Shlomo, Shulman, Amichai, Boodaei, Mickey
• Granted Patent: US 8,024,804 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 11/2257 using expert systems
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A method for detecting network attacks is provided. In one implementation, the method receives a plurality of attack indications based on data transmitted on the network and applies rules to the plurality of attack indications. Also, the method generates an alert if an application of at least a subset of the rules on the plurality of attack indications indicates a potential attack. In addition, a network device that performs the method and a computer program corresponding to the method are provided.

Claims

1. A method for detecting network attacks, comprising:

(a) receiving a plurality of attack indications based on data transmitted on the network;

(b) applying rules to the plurality of attack indications; and

(c) generating an alert if an application of at least a subset of the rules on the plurality of attack indications indicates a potential attack.

2. The method of claim 1, wherein the potential attack comprises an application level attack.

3. The method of claim 1, wherein the rules comprise independent rules.

4. The method of claim 1, wherein the potential attack comprises an attack against a web server.

5. The method of claim 1, wherein the potential attack comprises an attack against a database server.

6. The method of claim 2, wherein the application level attack comprises at least one of a directory traversal attack, a cross site scripting attack, an automatic reconnaissance attack, a search engine hacking attack, and an application denial of service attack.

7. The method of claim 1, wherein the attack indications comprise at least one of an irregular event, an anomaly, and an alert.

8. The method of claim 1, wherein the attack indications comprise an irregular event, an anomaly, and an alert.

9. The method of claim 6, wherein the attack indications comprise at least one of an irregular event, an anomaly, and an alert.

10. The method of claim 6, wherein the attack indications comprise an irregular event, an anomaly, and an alert.

11. The method of claim 1, wherein the attack indications comprise a first irregular event.

12. The method of claim 11, wherein the first irregular event comprises at least one of an irregular hypertext transfer protocol event and an irregular structured query language event.

13. The method of claim 11, wherein the attack indications comprise anomalies from the first irregular event.

14. The method of claim 11, wherein the attack indications comprise anomalies from a sequence of the first irregular event and at least a second irregular event, and

wherein the first irregular event and the at least the second irregular event are the same type of events.

15. The method of claim 11, wherein the attack indications comprise the first irregular event and at least a second irregular event, and

wherein the first irregular event and the at least the second irregular event are different types of events.

16. The method of claim 1, wherein the attack indications comprise an anomaly, and

wherein the anomaly comprises a deviation from a normal behavior profile of the data.

17. The method of claim 1, wherein the attack indications comprise an anomaly, and

wherein the anomaly comprises a deviation from a signature of an application layer protocol of the data.

18. The method of claim 17, wherein the application layer protocol comprises at least one of a hypertext transfer protocol and a structured query language protocol.

19. The method of claim 1, wherein operation (b) comprises:

(b1) applying a first rule to the attack indications to obtain a first result; and

(b2) selectively applying a second rule to the attack indications based on the first result.

20. The method of claim 1, wherein the rules are applied in an order based on a type of the potential attack to be detected.

21. The method of claim 19, wherein the rules are applied in an order based on a type of the potential attack to be detected.

22. A software program, which is contained on a computer-readable medium and which is capable of instructing a computer to perform a routine for detecting network attacks, wherein the routine comprises:

(a) receiving a plurality of attack indications based on data transmitted on the network;

(b) applying rules to the plurality of attack indications; and

(c) generating an alert if an application of at least a subset of the rules on the plurality of attack indications indicates a potential attack.

23. The software program of claim 22, wherein the potential attack comprises an application level attack.

24. The software program of claim 22, wherein the rules comprise independent rules.

25. The software program of claim 22, wherein the potential attack comprises an attack against a web server.

26. The software program of claim 22, wherein the potential attack comprises an attack against a database server.

27. The software program of claim 23, wherein the application level attack comprises at least one of a directory traversal attack, a cross site scripting attack, an automatic reconnaissance attack, a search engine hacking attack, and an application denial of service attack.

28. The software program of claim 22, wherein the attack indications comprise at least one of an irregular event, an anomaly, and an alert.

29. The software program of claim 22, wherein the attack indications comprise an irregular event, an anomaly, and an alert.

30. The software program of claim 27, wherein the attack indications comprise at least one of an irregular event, an anomaly, and an alert.

31. The software program of claim 27, wherein the attack indications comprise an irregular event, an anomaly, and an alert.

32. The software program of claim 22, wherein the attack indications comprise a first irregular event.

33. The software program of claim 32, wherein the first irregular event comprises at least one of an irregular hypertext transfer protocol event and an irregular structured query language event.

34. The software program of claim 32, wherein the attack indications comprise anomalies from the first irregular event.

35. The software program of claim 32, wherein the attack indications comprise anomalies from a sequence of the first irregular event and at least a second irregular event, and

wherein the first irregular event and the at least the second irregular event are the same type of events.

36. The software program of claim 32, wherein the attack indications comprise the first irregular event and at least a second irregular event, and

wherein the first irregular event and the at least the second irregular event are different types of events.

37. The software program of claim 22, wherein the attack indications comprise an anomaly, and

wherein the anomaly comprises a deviation from a normal behavior profile of the data.

38. The software program of claim 22, wherein the attack indications comprise an anomaly, and

wherein the anomaly comprises a deviation from a signature of an application layer protocol of the data.

39. The software program of claim 38, wherein the application layer protocol comprises at least one of a hypertext transfer protocol and a structured query language protocol.

40. The software program of claim 22, wherein operation (b) comprises:

(b1) applying a first rule to the attack indications to obtain a first result; and

(b2) selectively applying a second rule to the attack indications based on the first result.

41. The software program of claim 22, wherein the rules are applied in an order based on a type of the potential attack to be detected.

42. The software program of claim 40, wherein the rules are applied in an order based on a type of the potential attack to be detected.

43. A network device that detects network attacks, comprising:

a network sensor that receives data transmitted on the network and that generates a plurality of attack indications based on the data; and

a first correlation engine that applies a first set of rules to the plurality of attack indications and that generates a first alert if an application of at least a subset of the first set of rules on the plurality of attack indications indicates a first potential attack.

44. The device of claim 43, further comprising a second correlation engine that applies a second set of rules to the plurality of attack indications and that generates a second alert if an application of at least a subset of the second set of rules on the plurality of attack indications indicates a second potential attack.

45. The device of claim 43, wherein the first potential attack comprises an application level attack.

46. The device of claim 43, wherein the first set of rules comprises independent rules.

47. The device of claim 43, wherein the first potential attack comprises an attack against a web server.

48. The device of claim 43, wherein the first potential attack comprises an attack against a database server.

49. The device of claim 45, wherein the application level attack comprises at least one of a directory traversal attack, a cross site scripting attack, an automatic reconnaissance attack, a search engine hacking attack, and an application denial of service attack.

50. The device of claim 43, wherein the attack indications comprise at least one of an irregular event, an anomaly, and an alert.

51. The device of claim 43, wherein the attack indications comprise an irregular event, an anomaly, and an alert.

52. The device of claim 49, wherein the attack indications comprise at least one of an irregular event, an anomaly, and an alert.

53. The device of claim 49, wherein the attack indications comprise an irregular event, an anomaly, and an alert.

54. The device of claim 43, wherein the attack indications comprise a first irregular event.

55. The device of claim 54, wherein the first irregular event comprises at least one of an irregular hypertext transfer protocol event and an irregular structured query language event.

56. The device of claim 54, wherein the attack indications comprise anomalies from the first irregular event.

57. The device of claim 54, wherein the attack indications comprise anomalies from a sequence of the first irregular event and at least a second irregular event, and

wherein the first irregular event and the at least the second irregular event are the same type of events.

58. The device of claim 54, wherein the attack indications comprise the first irregular event and at least a second irregular event, and

wherein the first irregular event and the at least the second irregular event are different types of events.

59. The device of claim 43, wherein the attack indications comprise an anomaly, and

wherein the anomaly comprises a deviation from a normal behavior profile of the data.

60. The device of claim 43, wherein the attack indications comprise an anomaly, and

wherein the anomaly comprises a deviation from a signature of an application layer protocol of the data.

61. The device of claim 60, wherein the application layer protocol comprises at least one of a hypertext transfer protocol and a structured query language protocol.

62. The device of claim 43, wherein the first correlation engine applies a first rules of the first set of rules to the plurality of attack indications to obtain a first result, and

wherein the first correlation engine selectively applies a second rule of the first set of rules to the attack indications based on the first result.

63. The device of claim 43, wherein the rules of the first set of rules are applied in an order based on a type of the first potential attack that the first correlation engine is configured to detect.

64. The device of claim 62, wherein the rules of the first set of rules are applied in an order based on a type of the first potential attack that the first correlation engine is configured to detect.

65. The device of claim 44, wherein the first correlation engine (1) inputs the second alert from the second correlation engine, (2) applies the first set of rules to the second alert and the plurality of attack indications, and (3) generates the first alert if the application of at least the subset of the first set of rules on the second alert and the plurality of attack indications indicates the first potential attack.