System and Method for Analyzing Unauthorized Intrusion Into a Computer Network

• US 20150074811A1
• Filed: 11/14/2014
• Published: 03/12/2015
• Est. Priority Date: 05/22/2006
• Status: Active Grant

• Current Assignee: GoSecure, Inc.
• Original Assignee: Countertack Incorporated
• Inventors: Capalik, Alen
• Granted Patent: US 9,866,584 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2123 Dummy operation
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

The method analyzes unauthorized intrusion into a computer network. Access is allowed to a virtualized operating system running on a hypervisor operating system hosted on a network device. A network attack is intercepted on the virtualized operating system using an introspection module with a virtual-machine-based rootkit module and its associated userland processes running on the hypervisor operating system. The network attack includes attack-identifying information. Forensic data is generated on the network attack from the attack-identifying information.

Claims

1. A method for analyzing unauthorized intrusion into a computer network, the method comprising:

allowing access to a virtualized operating system running on a hypervisor operating system hosted on a network device;

using an introspection module comprising a virtual-machine-based rootkit module and its associated userland processes running on the hypervisor operating system to intercept a network attack on the virtualized operating system, wherein the network attack includes attack-identifying information;

generating forensic data on the network attack from the attack-identifying information, where the forensic data is based on all activity associated with the operating system;

generating an attack signature from the forensic data; and

providing the attack signature to an intrusion prevention system configured to control access to a protected network using the attack signature to identify subsequent attacks.