METHODS, MEDIA, AND SYSTEMS FOR SECURING COMMUNICATIONS BETWEEN A FIRST NODE AND A SECOND NODE

• US 20110214161A1
• Filed: 10/31/2006
• Published: 09/01/2011
• Est. Priority Date: 10/31/2005
• Status: Active Grant

• Current Assignee: Trustees Of Columbia University In The City Of New York (Columbia University)
• Original Assignee: Trustees Of Columbia University In The City Of New York (Columbia University)
• Inventors: Ciocarlie, Gabriela F., Sherrick, Joseph, Frias-Martinez, Vanessa, Parekh, Janak, Keromytis, Angelos D., Stolfo, Salvatore J.
• Granted Patent: US 9,419,981 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Methods, media, and systems for securing communications between a first node and a second node are provided. In some embodiments, methods for securing communication between a first node and a second node are provided. The methods comprising: receiving at least one model of behavior of the second node at the first node; and authorizing the first node to receive traffic from the second node based on the difference between the at least one model of behavior of the second node and at least one model of behavior of the first node.

Claims

1. A method for securing communications between a first node and a second node, comprising:

receiving at least one model of behavior of the second node at the first node; and

authorizing the first node to receive traffic from the second node based on the difference between the at least one model of behavior of the second node and at least one model of behavior of the first node.

2. The method of claim 1, further comprising determining a distance between the at least one model of behavior of the second node and the at least one model of behavior of the first node.

3. The method of claim 2, further comprising comparing the distance to a threshold.

4. The method of claim 3, further comprising calculating the threshold based on the distance between the at least one model of behavior of the first node and at least one model of behavior of at least one other node.

5. The method of claim 1, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of output behavior.

6. The method of claim 1, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of input behavior.

7. The method of claim 1, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of anomalous behavior.

8. The method of claim 1, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a Bloom filter.

9. The method of claim 1, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is the output of n-gram frequency analysis.

10. The method of claim 1, further comprising rejecting traffic sent to the first node from the second node based on the difference between the at least one model of behavior of the second node and actual behavior of the second node.

11. The method of claim 10, wherein the actual behavior of the second node is its output behavior.

12. The method of claim 1, further comprising:

receiving at least one model of behavior of the first node at the second node; and

authorizing the second node to receive traffic from the first node based on the difference between the at least one model of behavior of the first node and the at least one model of behavior of the second node.

13. A device that secures communications between a first node and a second node, comprising:

an interface in communication with a network;

a memory; and

a processor in communication with the memory and the interface;

wherein the processor;

receives at least one model of behavior of the second node; and

authorizes the first node to receive traffic from the second node based on the difference between the at least one model of behavior of the second node and at least one model of behavior of the first node.

14. The device of claim 13, wherein the processor further determines a distance between the at least one model of behavior of the second node and the at least one model of behavior of the first node.

15. The device of claim 14, wherein the processor further compares the distance to a threshold.

16. The device of claim 15, where the processor further calculates the threshold based on the distance between the at least one model of behavior of the first node and at least one model of behavior of at least one other node.

17. The device of claim 13, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of output behavior.

18. The device of claim 13, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of input behavior.

19. The device of claim 13, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of anomalous behavior.

20. The device of claim 13, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a Bloom filter.

21. The device of claim 13, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is the output of n-gram frequency analysis.

22. The device of claim 13, where the processor further rejects traffic sent from the second node based on the difference between the at least one model of behavior of the second node and actual behavior of the second node.

23. The device of claim 22, wherein the actual behavior of the second node is its output behavior.

24. A computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for securing communications between a first node and a second node, comprising:

receiving at least one model of behavior of the second node; and

authorizing the first node to receive traffic from the second node based on the difference between the at least one model of behavior of the second node and at least one model of behavior of the first node.

25. The computer-readable medium of claim 24, the method further comprising determining a distance between the at least one model of behavior of the second node and the at least one model of behavior of the first node.

26. The computer-readable medium of claim 25, the method further comprising comparing the distance to a threshold.

27. The computer-readable medium of claim 26, the method further comprising calculating the threshold based on the distance between the at least one model of behavior of the first node and at least one model of behavior of at least one other node.

28. The computer-readable medium of claim 24, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of output behavior.

29. The computer-readable medium of claim 24, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of input behavior.

30. The computer-readable medium of claim 24, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of anomalous behavior.

31. The computer-readable medium of claim 24, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a Bloom filter.

32. The computer-readable medium of claim 24, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is the output of n-gram frequency analysis.

33. The computer-readable medium of claim 24, the method further comprising rejecting traffic from the second node based on the difference between the at least one model of behavior of the second node and actual behavior of the second node.

34. The computer-readable medium of claim 33, wherein the actual behavior of the second node is its output behavior.

35. A method for securing communications between a first node and a second node, comprising:

receiving at least one model of behavior of the second node at the first node; and

rejecting traffic sent from the second node to the first node based on the difference between the at least one model of behavior of the second node and at least one model of behavior of the first node.