SYSTEMS AND METHODS FOR IDENTIFYING AND PERFORMING AN ACTION IN RESPONSE TO IDENTIFIED MALICIOUS NETWORK TRAFFIC

• US 20150207812A1
• Filed: 01/20/2015
• Published: 07/23/2015
• Est. Priority Date: 01/17/2014
• Status: Active Grant

• Current Assignee: Percipient Networks, LLC (Gladiator Corporation), WatchGuard Technologies Incorporated (Gladiator Corporation)
• Original Assignee: Stephen Ralph Dicato, Jr, Todd Aaron O'Boyle
• Inventors: DICATO, Stephen Ralph Jr., BACK, Gregory Thomas, CLOKE, Patrick Michael, ESPINAL, Daniel Eugenio, O'BOYLE, Todd Aaron, SERAFINI, John Sheldon
• Granted Patent: US 10,432,658 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Computer-implemented systems, methods, and computer-readable media are provided for causing an action to be performed in response to a network communication, such as a malicious network communication. In accordance with some embodiments, a first network communication sent from a client device is received, and a protocol used in the first network communication is determined. Once the protocol is determined, the protocol may be implemented to enable a second network communication with the client device. An action to be performed based at least in part on the protocol may be identified, and an instruction may be sent to the client device in the second network communication.

Claims

1. A computer-implemented method for causing an action to be performed in response to a network communication, the method comprising:

receiving a first network communication sent from a client device;

determining a protocol used in the first network communication;

implementing the protocol, by at least one processor, to enable a second network communication with the client device;

identifying an action to be performed based at least in part on the protocol; and

causing an instruction to perform the action to be sent to the client device in the second network communication.

2. The computer-implemented method of claim 1, wherein determining the protocol further comprises:

selecting the protocol;

causing a response to the first network communication to be sent to the client device using the protocol; and

receiving a message from the client device indicating that a connection to the client device has been established.

3. The computer-implemented method of claim 2, wherein the protocol is a second protocol, the response is a second response, and the message is a second message, further comprising:

selecting a first protocol;

causing a first response to the first network communication to be sent to the client device using the first protocol;

receiving a first message from the client device indicating that a connection to the client device has not been established; and

selecting the second protocol in response to receiving the first message.

4. The computer-implemented method of claim 1, wherein the protocol is implemented by establishing a connection between the client device and a subsystem that utilizes the protocol.

5. The computer-implemented method of claim 1, wherein the first network communication is initiated by a malware application stored on the client device.

6. The computer-implemented method of claim 1, wherein the action includes uninstalling a malware application stored on the client device.

7. The computer-implemented method of claim 1, wherein the action includes gathering information about the malware application and sending a third network communication including the information.

8. The computer-implemented method of claim 1, wherein the action includes gathering information about the client device and sending a third network communication including the information.

12. The computer-implemented method of claim 1, wherein the protocol is implemented by establishing a connection between the client device and a subsystem that utilizes the protocol.

13. The computer-implemented method of claim 1, wherein the first network communication is initiated by a malware application stored on the client device.

14. The computer-implemented method of claim 1, wherein the action includes uninstalling a malware application stored on the client device.

15. The computer-implemented method of claim 1, wherein the action includes gathering information about the malware application and sending a third network communication including the information.

16. The computer-implemented method of claim 1, wherein the action includes gathering information about the client device and sending a third network communication including the information.

20. The computer-implemented method of claim 1, wherein the action includes uninstalling a malware application stored on the client device.

9. A computer-implemented system for causing an action to be performed in response to a network communication, comprising:

a memory device that stores instructions; and

one or more processors that execute the instructions to;

receive a first network communication sent from a client device;

determine a protocol used in the first network communication;

implement the protocol to enable a second network communication with the client device;

identify an action to be performed based at least in part on the protocol; and

cause an instruction to perform the action to be sent to the client device in the second network communication.

10. The system of claim 9, wherein the one or more processors further execute the instructions to determine the protocol by:

selecting the protocol;

causing a response to the first network communication to be sent to the client device using the protocol; and

receiving a message from the client device indicating that a connection to the client device has been established.

11. The system of claim 10, wherein the protocol is a second protocol, the response is a second response, and the message is a second message, and the one or more processors further execute the instructions to determine the protocol by:

selecting a first protocol;

causing a first response to the first network communication to be sent to the client device using the first protocol;

receiving a first message from the client device indicating that a connection to the client device has not been established; and

selecting the second protocol in response to receiving the first message.

17. A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform a method, the method comprising:

receiving a first network communication sent from a client device;

determining a protocol used in the first network communication;

implementing the protocol to enable a second network communication with the client device;

identifying an action to be performed based at least in part on the protocol; and

causing an instruction to perform the action to be sent to the client device in the second network communication.

18. The non-transitory computer-readable medium of claim 17, wherein determining the protocol further comprises:

selecting the protocol;

causing a response to the first network communication to be sent to the client device using the protocol; and

receiving a message from the client device indicating that a connection to the client device has been established.

19. The non-transitory computer-readable medium of claim 18, wherein the protocol is a second protocol, the response is a second response, and the message is a second message, further comprising:

selecting a first protocol;

causing a first response to the first network communication to be sent to the client device using the first protocol;

receiving a first message from the client device indicating that a connection to the client device has not been established; and

selecting the second protocol in response to receiving the first message.