DETECTING AND DEFENDING AGAINST MAN-IN-THE-MIDDLE ATTACKS
First Claim
Patent Images
1. A system for defending against man in the middle (MITM) attacks directed at a target server, comprising:
- an activity recording system that records an incoming IP address, user id, and time of each session occurring with the target server;
a list checking system for performing the following;
comparing a single incoming IP address with a white list; and
comparing the single incoming IP address with a black list after the comparing of the single incoming IP address with the white list in the case that the single incoming IP address is not present on the white list;
an activity analysis system that performs the following after the list checking system compares the single incoming IP address with the black list, in the case that the single incoming IP address is not present on the black list;
searches for records of a previous login attempt from the single incoming IP address;
determines a number of user ids occurring from the single incoming IP address during a predefined time period;
compares the number of user ids occurring from the single incoming IP address to a predefined threshold number of user ids specific to the predefined time period; and
identifies the single incoming IP address as a suspect IP address in response to the number of user ids occurring from the single incoming IP address exceeding the threshold within the predefined time period; and
a countermeasure system for taking action against the suspect IP address.
0 Assignments
0 Petitions
Accused Products
Abstract
A system, method and program product for defending against man in the middle (MITM) attacks directed at a target server. A system is provided that includes an activity recording system that records an incoming IP address, userid, and time of each session occurring with the target server; an activity analysis system that identifies suspect IP addresses by determining if an unacceptable number of sessions are occurring from a single incoming IP address during a predefined time period; and a countermeasure system for taking action against suspect IP addresses.
22 Citations
22 Claims
-
1. A system for defending against man in the middle (MITM) attacks directed at a target server, comprising:
-
an activity recording system that records an incoming IP address, user id, and time of each session occurring with the target server; a list checking system for performing the following; comparing a single incoming IP address with a white list; and comparing the single incoming IP address with a black list after the comparing of the single incoming IP address with the white list in the case that the single incoming IP address is not present on the white list; an activity analysis system that performs the following after the list checking system compares the single incoming IP address with the black list, in the case that the single incoming IP address is not present on the black list; searches for records of a previous login attempt from the single incoming IP address; determines a number of user ids occurring from the single incoming IP address during a predefined time period; compares the number of user ids occurring from the single incoming IP address to a predefined threshold number of user ids specific to the predefined time period; and identifies the single incoming IP address as a suspect IP address in response to the number of user ids occurring from the single incoming IP address exceeding the threshold within the predefined time period; and a countermeasure system for taking action against the suspect IP address. - View Dependent Claims (2, 3, 4, 5)
-
-
6. A computer program product stored on a computer readable storage medium, which when executed includes program instructions for defending against man in the middle (MITM) attacks directed at a target server, the program product comprising:
-
program instructions for recording an incoming IP address, user id, and time of each session occurring with the target server; program instructions for comparing the incoming IP address with a white list; program instructions for comparing the incoming IP address with a black list after the comparing of the incoming IP address with the white list in the case that the incoming IP address is not present on the white list; program instructions for searching for records of a previous login attempt from the incoming IP address; program instructions for identifying suspect IP addresses by determining a number of user ids occurring from the single incoming IP address during a predefined time period after the comparing of the incoming IP address with the black list, in the case that the single incoming IP address is not present on the black list; program instructions for comparing the number of user ids occurring from the single incoming IP address to a predefined threshold number of user ids specific to the predefined time period; program instructions for identifying the single incoming IP address as a suspect IP address in response to the number of user ids occurring from the single incoming IP address exceeding the threshold within the predefined time period; and program instructions for taking defensive action against the suspect IP address. - View Dependent Claims (7, 8, 9, 10, 19, 20)
-
-
11. A computer-implemented method performed on at least one computing device for defending against man in the middle (MITM) attacks directed at a target server, the method comprising:
-
recording an incoming IP address, user id, and time of each session occurring with the target server using the at least one computing device; comparing the incoming IP address with a white list; comparing the incoming IP address with a black list after the comparing of the incoming IP address with the white list in the case that the incoming IP address is not present on the white list; searching for records of a previous login attempt from the incoming IP address; identifying suspect IP addresses by determining a number of user ids occurring from the single incoming IP address during a predefined time period after the comparing of the incoming IP address with the black list, in the case that the single incoming IP address is not present on the black list; comparing the number of user ids occurring from the single incoming IP address to a predefined threshold number of user ids specific to the predefined time period; identifying the single incoming IP address as a suspect IP address in response to the number of user ids occurring from the single incoming IP address exceeding the threshold within the predefined time period; and taking defensive action against the suspect IP address using the at least one computing device. - View Dependent Claims (12, 13, 14, 15, 21, 22)
-
-
16. A method for deploying a system for defending against man in the middle (MITM) attacks directed at a target server, comprising:
providing a computer infrastructure being operable to; record an incoming IP address, user id, and time of each session occurring with the target server; compare the incoming IP address with a white list; compare the incoming IP address with a black list after the comparing of the incoming IP address with the white list in the case that the incoming IP address is not present on the white list; search for records of a previous login attempt from the incoming IP address; identify suspect IP addresses by determining a number of user ids occurring from the incoming IP address during a predefined time period after the comparing of the incoming IP address with the black list, in the case that the single incoming IP address is not present on the black list; compare the number of user ids occurring from the single incoming IP address to a predefined threshold number of user ids specific to the predefined time period; identify the single incoming IP address as a suspect IP address in response to the number of user ids occurring from the single incoming IP address exceeding the threshold within the predefined time period; and take defensive action against the suspect IP address. - View Dependent Claims (17, 18)
Specification