DETECTION OF NETWORK SECURITY BREACHES BASED ON ANALYSIS OF NETWORK RECORD LOGS

• US 20080155697A1
• Filed: 12/06/2007
• Published: 06/26/2008
• Est. Priority Date: 04/04/2003
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: ZUK, Nir
• Granted Patent: US 7,904,479 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface

Abstract

Computer program products and methods of inspecting a log of security records in a computer network are provided. The method includes retrieving a log record, processing the log record including deriving a key to a table, determining a data value from information in the log record and adding the data value to a list of data values associated with the key if the data value is unique. One or more entries of the table are evaluated based on predetermined criteria to detect attempted security breaches.

Claims

1-44. -44. (canceled)

45. A network device including an interface to receive a log of security records from a plurality of network security devices in a computer network, the network device comprising:

a processing engine to;

process a log record, including deriving a key to a table and tagging the key with a time stamp, and

determine a data value from information in the log record and adding the data value including a tag field to a list of data values associated with the key if the data value is not already in the list of data values, wherein the time stamp and the tag field differ, and the tag field indicates that the key has been modified by the addition of the data value since a prior evaluation;

a database to store the table; and

an evaluation engine to;

retrieve ones of the entries of the table not having the tag field,

retrieve ones of the entries of the table having the tag field,

evaluate ones of the entries of the table having the tag field based on predetermined criteria, and

reset the tag field of the evaluated ones of the entries to indicate that the key has been evaluated since a prior modification and to indicate the time stamp.

46. The network device of claim 45, wherein the table is a hash table.

47. The network device of claim 45, wherein the list of data values is implemented as a linked list.

48. The network device of claim 45, wherein the list of data values is implemented as a hash table.

49. The network device of claim 45, wherein the list of data values is implemented as a tree.

50. The network device of claim 45, wherein when evaluating ones of the entries of the table, the evaluation engine is configured to evaluate all the entries of the table.

51. A network device including an interface to receive a log of security records from a plurality of network security devices in a computer network, the network device comprising:

a processing engine to generate a hash key based on one or more fields of a log record; and

a database to store a plurality of hash tables;

an evaluation engine to;

evaluate one of the stored hash tables using the hash key, and

add a new entry to the evaluated hash table if a hash table entry does not match the hash key or retrieve a data list associated with the hash table entry if the hash table entry matches the hash key;

the processing engine being further configured to;

compute a data value based on the one or more fields of the log record,

compare the data value with entries in the data list to identify matching entries, and

insert the data value into the data list when no matching entries are identified, wherein the data value includes a tag field and a time stamp that differ, the tag field indicating that the hash key has been modified by the insertion of the data value since a prior evaluation; and

the evaluation engine being further configured to;

retrieve ones of the entries of the hash table that do not have the tag field,

retrieve ones of the entries of the hash table that have the tag field,

evaluate the data list based on predetermined criteria to detect attempted security breaches,

reset the tag field to indicate that the hash key has been evaluated since a prior modification, and

update the time stamp.

52. The network device of claim 51, wherein adding a new entry to the hash table includes generating an empty data list associated with the new entry to the hash table.

53. The network device of claim 51, wherein inserting the data value into the data list includes triggering an evaluation of the data list.

54. The network device of claim 51, wherein the evaluation engine is further configured to receive a check table operation to trigger the evaluation of the data list.

55. The network device of claim 51, wherein when evaluating the data list based on predetermined criteria, the evaluation engine is further configured to block a packet associated with the log record.

56. The network device of claim 51, wherein when evaluating the data list based on predetermined criteria, the evaluation engine is further configured to block future packets from a same source as a packet associated with the log record.

57. The network device of claim 51, wherein when evaluating the data list based on predetermined criteria, the evaluation engine is further configured to block an attempted security attack.

58. The network device of claim 51, wherein the data list is a linked list.

59. The network device of claim 51, wherein the data list is a hash table.

60. The network device of claim 51, wherein the data list is a tree.

61. The network device of claim 51, wherein the evaluation engine is further configured to evaluate the data list after a plurality of data values have been added to the data list.

62. The network device of claim 51, wherein the evaluation engine is further configured to evaluate the data list after each data value is added to the data list.

63. The network device of claim 51, wherein when evaluating the hash table using the hash key, the evaluation engine is further configured to process a second hash table.

64. The network device of claim 63, wherein processing a second hash table includes:

using a matching hash table entry to retrieve the second hash table;

using the hash key to evaluate the second hash table;

if there is no matching second hash table entry, adding a new entry to the second hash table;

if there is a matching second hash table entry, retrieving a second data list associated with the second hash table entry;

comparing the data value with entries in the second data list to determine if there are any matching entries;

inserting the data value in the second data list if there are no matching entries; and

evaluating the second data list based on the predetermined criteria or other predetermined criteria.

65. A system comprising:

means for receiving a log of security records from a plurality of network security devices in a computer network,

means for processing, including;

means for processing a log record to derive a key to a table and tag the key with a time stamp, and

means for determining a data value from information in the log record and adding the data value including a tag field to a list of data values associated with the key if the data value is not already in the list of data values, wherein the time stamp and the tag field differ, and the tag field indicates that the key has been modified by the addition of the data value since a prior evaluation;

means for storing the table; and

means for evaluating, including;

means for retrieving ones of the entries of the table not having the tag field,

means for retrieving ones of the entries of the table having the tag field,

means for evaluating ones of the entries of the table having the tag field based on predetermined criteria, and

means for resetting the tag field of the evaluated ones of the entries to indicate that the key has been evaluated since a prior modification and to indicate the time stamp.