Integrated Network Intrusion Detection

• US 20100122317A1
• Filed: 12/29/2009
• Published: 05/13/2010
• Est. Priority Date: 02/01/2002
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Yadav, Satyendra
• Granted Patent: US 8,752,173 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Intrusion preludes may be detected (including detection using fabricated responses to blocked network requests), and particular sources of network communications may be singled out for greater scrutiny, by performing intrusion analysis on packets blocked by a firewall. An integrated intrusion detection system uses an end-node firewall that is dynamically controlled using invoked-application information and a network policy. The system may use various alert levels to trigger heightened monitoring states, alerts sent to a security operation center, and/or logging of network activity for later forensic analysis. The system may monitor network traffic to block traffic that violates the network policy, monitor blocked traffic to detect an intrusion prelude, and monitor traffic from a potential intruder when an intrusion prelude is detected. The system also may track behavior of applications using the network policy to identify abnormal application behavior, and monitor traffic from an abnormally behaving application to identify an intrusion.

Claims

1. A method comprising:

receiving requests for access to network services from an invoked application;

integrating firewall and intrusion detection to check whether the requests violate a network policy, wherein network policies include permissive and restrictive rules to designate each of the received requests as authorized or unauthorized, respectively;

monitoring network communications, for the invoked application, based on the designation of the requests; and

blocking network communications that fail to correspond to an authorized network service request.

2. The method of claim 1, further comprising:

adding the invoked application to a watch list to initiate monitoring of network communications both to and from the application, including searching packets for application-specific intrusion signatures.

3. A tangible machine-readable medium embodying machine instructions for causing one or more machines to perform operations comprising:

receiving requests for access to network services from an invoked application;

integrating firewall and intrusion detection to check whether the requests violate a network policy, wherein network policies include permissive and restrictive rules to designate each of the received requests as authorized or unauthorized, respectively;

monitoring network communications, for the invoked application, based on the designation of the requests; and

blocking network communications that fail to correspond to an authorized network service request.

4. The tangible machine-readable medium of claim 3, further comprising:

adding the invoked application to a watch list to initiate monitoring of network communications both to and from the application, including searching packets for application-specific intrusion signatures.

5. A system comprising:

a processor;

a communication interface coupled with the processor; and

a tangible machine-readable medium operatively coupled with the processor and embodying machine instructions for causing the processor to perform operations comprising;

receiving requests for access to network services from an invoked application;

integrating firewall and intrusion detection to check whether the requests violate a network policy, wherein network policies include permissive and restrictive rules to designate each of the received requests as authorized or unauthorized, respectively;

monitoring network communications, for the invoked application, based on the designation of the requests; and

blocking network communications that fail to correspond to an authorized network service request.

6. The system of claim 5, further comprising instructions for adding the invoked application to a watch list to initiate monitoring of network communications both to and from the application, including searching packets for application-specific intrusion signatures.

7. A machine-implemented method comprising:

receiving requests for access to network services from an invoked application;

integrating firewall and intrusion detection to check whether the requests violate a network policy, wherein network policies include permissive and restrictive rules to designate each of the received requests as authorized or unauthorized, respectively; and

monitoring network communications, for the invoked application, based on the designation of the requests;

wherein monitoring of the network communications for the invoked application comprises monitoring in an intrusion detection system component invoked with the invoked application.

8. The machine-implemented method of claim 7, wherein the intrusion detection system component and the invoked application run within a single execution context.

9. The machine-implemented method of claim 8, wherein monitoring the network communications comprises monitoring outbound network communications.

10. A tangible machine-readable medium embodying machine instructions for causing one or more machines to perform operations comprising:

receiving requests for access to network services from an invoked application;

integrating firewall and intrusion detection to check whether the requests violate a network policy, wherein network policies include permissive and restrictive rules to designate each of the received requests as authorized or unauthorized, respectively; and

monitoring network communications, for the invoked application, based on the designation of the requests;

wherein monitoring of the network communications for the invoked application comprises monitoring in an intrusion detection system component invoked with the invoked application.

11. The tangible machine-readable medium of claim 10, wherein the intrusion detection system component and the invoked application run within a single execution context.

12. The tangible machine-readable medium of claim 11, wherein monitoring the network communications comprises monitoring outbound network communications.