Distributed peer attack alerting

• US 20070277242A1
• Filed: 05/26/2006
• Published: 11/29/2007
• Est. Priority Date: 05/26/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hartrell, Gregory D., Baker, Arthur H., Ellison, Carl
• Granted Patent: US 7,779,465 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A system and method for distributed peer attack alerting is disclosed. The method includes accessing a peer community wherein the peer community comprises a plurality of nodes comprising a network and wherein at least one of the plurality of nodes comprises an attack identifier. The method further includes identifying an attack at one of the plurality of nodes. In addition, the method includes transmitting an alert to the plurality of nodes, the alert comprising information associated with the attack and automatically configuring at least one attack identifier associated with one of the plurality of nodes in response to the alert.

Claims

1. A computer implemented method for distributed peer attack alerting comprising:

accessing a peer community, said peer community comprising a plurality of nodes comprising a network wherein at least one of said plurality of nodes comprises access to an attack identifier;

identifying an attack at one of said plurality of nodes comprising access to said attack identifier;

transmitting an alert to said plurality of nodes, said alert comprising information associated with said attack; and

automatically configuring at least one attack identifier associated with one of said plurality of nodes in response to said alert.

2. The computer implemented method as described in claim 1 further comprising:

determining a classification type associated with said attack; and

analyzing a characteristic value associated with said classification type.

3. The computer implemented method of claim 2 further comprising:

accessing a threshold value associated with said classification type; and

comparing said threshold value to said characteristic value.

4. The computer implemented method of claim 1 further comprising:

electing one of said plurality of nodes to be a leader node of said plurality of nodes.

5. The computer implemented method as described in claim 1 wherein said alert comprises instructions to recover from or prevent said attack.

6. The computer implemented method as described in claim 5 wherein said instructions are time-based.

7. The computer implemented method as described in claim 1 wherein said alert is digitally signed by one or more of said plurality of nodes on said network.

8. Instructions on a computer-usable medium wherein the instructions when executed cause a computer system to perform a method for distributed peer attack alerting, said computer-implemented method comprising:

identifying an attack at one of a plurality of nodes of a network, said node comprising access to an attack detector;

generating an alert petition associated with said attack, said alert petition comprising information associated with said attack; and

automatically configuring at least one attack detector associated with one of said plurality of nodes in response to said alert petition without communicating with a centralized attack reporting system.

9. The computer implemented method as described in claim 8 further comprising:

transmitting said alert petition to one or more of said plurality of nodes.

10. The computer implemented method as described in claim 8 further comprising:

classifying said alert petition to a particular attack type category; and

determining a characteristic value associated with said attack type category.

11. The computer implemented method as described in claim 10 further comprising:

comparing said characteristic value associated with said attack type category to a threshold value associated with said attack type category.

12. The computer implemented method of claim 11 further comprising:

performing a first action in response to said characteristic value less than said threshold value and performing a second action in response to said characteristic value greater than said threshold value.

13. The computer implemented method of claim 8 further comprising:

determining one of said plurality of nodes to be a leader node of said plurality of nodes.

14. The computer implemented method as described in claim 8 wherein said alert petition comprises instructions to configure said attack detector in response to said attack.

15. A system for distributed peer attack alerting comprising:

an attack detector coupled to one of a plurality of nodes of a network for detecting an attack at said node;

an alert transmitter for transmitting an alert to said plurality of nodes in response to said attack, said alert comprising information associated with said attack; and

an attack detector updater for updating said attack detector in response to said alert.

16. The system as described in claim 15 wherein said network is substantially a butterfly network, a ring network, a mesh network, a star network or a tree network.

17. The system as described in claim 15 wherein one or more of said plurality of nodes is a leader node.

18. The system as described in claim 15 further comprising:

an attack type classifier for classifying said attack to a particular type.

19. The system as described in claim 18 further comprising:

an attack classifier for classifying said attack into one or more classification types and for analyzing characteristics associated with said attack.

20. The system as described in claim 15 wherein said alert comprises instructions that can be used by one or more of said plurality of nodes to recover from or prevent said attack.