Switching network employing adware quarantine techniques

• US 20070258469A1
• Filed: 08/18/2006
• Published: 11/08/2007
• Est. Priority Date: 05/05/2006
• Status: Abandoned Application

• Current Assignee: Avago Technologies General IP PTE Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Bennett, James D.
• Application Number:
  US11/506,729
• Publication Number:
  US 20070258469A1
• Time in Patent Office: Days
• US Class Current: 370/400
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A communication infrastructure that communicates a plurality of packets from a source device having a source address to a client device having a destination address, consisting a communication pathway with plurality of switching devices, plurality of predefined templates and associated logic and plurality of adware quarantine service functions. The source device delivers a packet containing the source address, destination address and an adware characteristic to the first of the plurality of switching devices. Then, the first of the plurality of switching devices identifies adware characteristic by comparing the packet with the plurality of predefined templates and applies the associated logic. Finally, the first of the plurality of switching devices performs selected adware quarantine service function processing that is indicated in the associated logic. In addition, the first of the plurality of switching devices, in conjunction with an adware analysis server, gathers statistical data related to the adware and the source device and utilizes this information in future detection of adware content and quarantine service function processing.

Claims

1. A communication infrastructure comprising:

a client device that executes a web browsing software;

a server device;

an Internet network comprising an intermediate routing node that receives a plurality of packets from the server device destined for the web browsing software of the client device;

the intermediate routing node compares each of the plurality of packets received to a plurality of predefined templates, each of the plurality of predefined templates relating to adware; and

the first intermediate routing node, after identifying a successful comparison, interacts with the web browsing software to perform a quarantine function.

2. The communication infrastructure of claim 1, wherein the quarantine function is selected based upon characteristics of the adware identified through the successful comparison.

3. The communication infrastructure of claim 1, wherein the interaction by the first intermediate routing node with the web browsing software results in presentation by the client device of a human challenge.

4. The communication infrastructure of claim 1, wherein the first intermediate routing node, after identifying the successful comparison, also interacts with the server device regarding the successful comparison.

5. The communication infrastructure of claim 4, wherein the interaction with the server device comprising a human challenge.

6. The communication infrastructure of claim 4, wherein the interaction with the server device comprising a quarantine function.

7. The communication infrastructure of claim 1, further comprising a support server, and the first intermediate routing node, after identifying the successful comparison, seeks assistance of the support server before interacting with the web browsing software.

8. The communication infrastructure of claim 1, wherein the quarantine function prevents the adware from automatically being presented on the client device.

9. The communication infrastructure of claim 8, wherein a user of the client device can override the quarantine function.

10. The communication infrastructure of claim 9, wherein the user can override the quarantine function by passing a human challenge.

11. The communication infrastructure of claim 1, wherein the intermediate routing node stores at least a first parameter associated with a first of the plurality of predefined templates, and the intermediate routing node selects the quarantine function from a plurality of differing quarantine functions based the at least the first parameter.

12. Network node circuitry of an intermediate network node in Internet network that receives a first packet and a second packet from a source device, the first packet and the second packet both being addressed to a destination device, the network node circuitry comprising:

first interface circuitry communicatively coupled to the source device;

second interface circuitry communicatively coupled to the destination device;

storage comprising a plurality of predefined templates;

processing circuitry communicatively coupled to the first interface circuitry, the second interface circuitry and the storage;

the processing circuitry receiving both the first packet and the second packet from the source device via the first interface circuitry, the first packet comprising a first characteristic related to first adware;

the processing circuitry identifies the first characteristic of the first packet through a successful comparison of at least one of the plurality of predefined templates; and

the processing circuitry responds to the identification by performing adware processing functionality.

13. The network node circuitry of claim 12, wherein the intermediate network node comprising a router.

14. The network node circuitry of claim 12, wherein the intermediate network node comprising an access point.

15. The network node circuitry of claim 12, wherein the adware processing functionality comprising interrupting delivery of the first packet to the destination device.

16. The network node circuitry of claim 12, wherein the adware processing functionality comprising requesting presentation of a message by the destination device, the message relating to the successful comparison.

17. The network node circuitry of claim 16, wherein the message comprising a human challenge.

18. The network node circuitry of claim 12, wherein the adware processing functionality comprising interaction with the source device regarding the successful comparison.

19. The network node circuitry of claim 12, wherein the processing circuitry fails to match any of the plurality of predefined templates with the second packet, and the processing circuitry delivers the second packet to the destination device via the second interface circuitry.

20. A method performed by an intermediate network node in a communication infrastructure that supports a first client device and a second client device, the method comprising:

receiving a first packet addressed to the first client device, the first packet comprising an adware characteristic;

comparing the first packet with a plurality of templates, at least a first of the plurality of templates being constructed to identify the adware characteristic;

identifying a match between the first packet and the at least the first of the plurality of templates;

interacting with the first client device regarding the identification of the match;

receiving a second packet addressed to the second client device;

comparing the second packet with the plurality of templates;

failing to match the second packet to any of the plurality of templates; and

delivering the second packet to the second client device.

21. The method of claim 20, wherein the interacting with the first client device comprising gathering data.

22. The method of claim 20, wherein the interacting with the first client device comprising delivering a human challenge.

23. The method of claim 20, wherein the interacting with the first client device comprising preventing automatic presentation on the first client device.

24. The method of claim 20, wherein the adware characteristic is associated with specific adware and the interaction with the first client device is based on statistics relating to the specific adware.

25. The method of claim 20, wherein the adware characteristic is associated with malware and the interaction with the first client device comprising coordinating quarantine services.