Methods and Systems for Network Attack Detection and Prevention Through Redirection

• US 20110154494A1
• Filed: 03/03/2011
• Published: 06/23/2011
• Est. Priority Date: 04/16/2003
• Status: Active Grant

• Current Assignee: Raytheon BBN Technologies Corp. (Rtx Corporation), Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: Milliken, Walter C., Sundaram, Ravi
• Granted Patent: US 8,719,937 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 61/45 Network directories; Name-to-address mapping
• CPC Class Codes: H04L 61/4505 using standardised directories; using standardised directory access protocols
• CPC Class Codes: H04L 61/50 Address allocation
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/16 Implementing security features at a particular protocol layer

Abstract

Methods and systems for detection and/or prevention of network attacks can include the use of multiple and/or time-dependent addresses coupled with filtering by the directory or naming service. The directory service can respond to requests for the address of a resource by returning an address that can be relocated over time by coordinating the directory service entry with the host and network address configuration data and/or by returning an address specific to the requestor. Thus, the directory service can track and build profiles of matches between requestors and accesses. The methods and systems can use the time dependent addresses and profiles to distinguish legitimate accesses from unauthorized or malicious ones. Requests for non-valid addresses can be misdirected to “empty” addresses or to detection devices.

Claims

1. A processor-implemented method of detecting unauthorized access attempts to a network, comprising:

provisioning a block of addresses;

determining a current used address of the block of addresses;

changing the current used address to a new used address of the block of addresses;

changing the current used address of the block of addresses into an unused address in a group of unused addresses; and

detecting an unauthorized attempt to access the network when an attempted address corresponds with any address of the group of unused addresses.

2. The method according to claim 1, further comprises:

determining a time period for changing the current used address of the block of addresses; and

changing the current used address to a new address at the determined time period.

3. The method according to claim 2, wherein determining the time period comprises using a pre-selected time period.

4. The method according to claim 2, wherein determining the time period comprises generating a random time period.

5. The method according to claim 1, wherein changing said current used address of the block of addresses comprises randomly choosing the new address from the block of addresses.

6. The method according to claim 1, wherein detecting comprises tracing a user when said attempted address corresponds to said group of unused addresses.

7. The method according to claim 6, comprising blocking additional unauthorized attempts when said attempted address corresponds to said group of unused addresses.

8. The method according to claim 6, wherein the unused addresses correspond to attack detectors.

9. The method according to claim 1 wherein changing the current used address comprises coordinating changes in a name-to-address database and a host identity-to-address database.

10. The method according to claim 1, wherein the current used address is user specific.

11. The method according to claim 1, wherein the group of unused addresses is user specific.

12. The method according to claim 1, wherein provisioning the block of addresses comprises selecting a range of addresses according to an attack prevention effectiveness level.

14. The non-transitory computer-readable medium of claim 1, further comprising instructions for controlling the processor to:

determine a time period for changing the unused address of the block of addresses; and

change the current used address to a new address at the determined time period.

15. The non-transitory computer-readable medium of claim 14, comprising instructions for controlling the processor to determine the time period by using a pre-selected time period.

16. The non-transitory computer-readable medium of claim 14, comprising instructions for controlling the processor to determine the time period by generating a random time period.

13. A non-transitory computer-readable medium containing instructions for controlling a processor to detect unauthorized access attempts to a network, by:

provisioning a block of addresses;

determining a current used address of the block of addresses;

changing the current used address to a new used address of the block of addresses;

changing the current used address of the block of addresses into an unused address in a group of unused addresses; and

detecting an unauthorized attempt to access the network when an attempted address corresponds with any address of the group of unused addresses.

17. The non-transitory computer-readable medium of claim 13, further comprising instructions for controlling the processor to change said used address of the block of addresses by randomly choosing the new address from the block of addresses.

18. The non-transitory computer-readable medium of claim 13, further comprising instructions for controlling the processor to detect said unauthorized attempt by tracing a user when said attempted address corresponds to said group of unused addresses.

19. The non-transitory computer-readable medium of claim 18, further comprising instructions for controlling the processor to detect said unauthorized attempt by blocking additional unauthorized attempts when said attempted address corresponds to said group of unused addresses.

20. The non-transitory computer-readable medium of claim 13, further comprising instructions for controlling the processor to change said used address by coordinating changes in a name-to-address database and a host identity-to-address database.

21. A system for detecting unauthorized access attempts to a network, comprising:

a memory;

a processor disposed in communication with said memory, and configured to issue a plurality of processing instructions stored in the memory, wherein the processor issues instructions to;

provision a block of addresses;

determine a current used address of the block of addresses;

change the current used address to a new used address of the block of addresses;

change the current used address of the block of addresses into an unused address in a group of unused addresses; and

detect an unauthorized attempt to access the network when an attempted address corresponds with any address of the group of unused addresses.