METHOD AND SYSTEM FOR NETWORK RESOURCE ATTACK DETECTION USING A CLIENT IDENTIFIER

• US 20170048260A1
• Filed: 08/12/2016
• Published: 02/16/2017
• Est. Priority Date: 08/12/2015
• Status: Active Application

• Current Assignee: Wizard Tower Technoservices Ltd.
• Original Assignee: Wizard Tower Technoservices Ltd.
• Inventors: Peddemors, Michael, Storey, William
• Granted Patent: US 10,264,001 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Methods, systems, and techniques for network resource attack detection using a client identifier. A server receives from a device the client identifier and user credentials. The client identifier and user credentials are assessed to determine their authenticity. If one or both of the credentials and identifier are inauthentic, the device does not learn from the server which of the identifier and credentials have been found to be inauthentic. When at least one of the identifier and credentials are inauthentic, the device that sent them is assessed to determine whether it is an attacker of the network resource. If the device is determined to be an attacker, one or both of prophylactic and remedial action is taken in response.

Claims

1. A method for network resource attack detection using a client identifier, the method comprising:

(a) receiving, at a server, the client identifier and user credentials from a device;

(b) determining whether the client identifier and user credentials are authentic, wherein the device does not learn from the server which of the client identifier and user credentials are inauthentic when one or both of the client identifier and user credentials are determined to be inauthentic;

(c) when at least one of the client identifier and user credentials are inauthentic, determining whether the device is an attacker of the network resource; and

(d) performing one or both of prophylactic and remedial action in response to determining that the device is an attacker.

2. The method of claim 1 wherein the client identifier is representative of a class of devices.

3. The method of claim 1 wherein the client identifier is representative of a specific device.

4. The method of claim 1 wherein the client identifier is representative of a class of users.

5. The method of claim 1 wherein the client identifier is representative of a specific user.

6. The method of claim 1 wherein the client identifier is selected from the group comprising a MAC address of the device;

a software license identifier;

information stored on a SIM card inserted in the device;

a serial number of the device;

a car vehicle identification number;

a hardware encryption key;

a version of software;

a personal identification number;

a digital representation of a biometric identifier of the user; and

a birthday of the user.

7. The method of claim 1 wherein the action is selected from the group comprising contacting authorities;

adding the IP address of the device to a blacklist;

banning or restricting access of the client identifier;

banning or restricting access of the user credentials;

refusing connections or logins from any one or more of the IP address, rDNS/PTR, and geographical location of the device;

creating a database of methods used by the device to connect to the server;

publishing data regarding the connection from the device, stealth banning the device; and

tarpitting the device.

8. A system for network attack detection using a client identifier, the system comprising:

(a) ports for communication with devices comprising clients and attackers;

(b) a processor communicatively coupled to the ports; and

(c) a non-transitory computer readable medium communicatively coupled to the processor, the medium having computer program code stored thereon that is executable by the processor and that, when executed by the processor, causes the processor to;

(i) receive the client identifier and user credentials from a device;

(ii) determine whether the client identifier and user credentials are authentic, wherein the device does not learn from the system which of the client identifier and user credentials are inauthentic when one or both of the client identifier and user credentials are determined to be inauthentic;

(iii) when at least one of the client identifier and user credentials are inauthentic, determining whether the device is an attacker of the network resource; and

(iv) performing one or both of prophylactic and remedial action in response to determining that the device is an attacker.

9. The system of claim 8 wherein the client identifier is representative of a class of devices.

10. The system of claim 8 wherein the client identifier is representative of a specific device.

11. The system of claim 8 wherein the client identifier is representative of a class of users.

12. The system of claim 8 wherein the client identifier is representative of a specific user.

13. The system of claim 8 wherein the client identifier is selected from the group comprising a MAC address of the device;

a software license identifier;

information stored on a SIM card inserted in the device;

a serial number of the device;

a car vehicle identification number;

a hardware encryption key;

a version of software;

a personal identification number;

a digital representation of a biometric identifier of the user; and

a birthday of the user.

14. The system of claim 8 wherein the action is selected from the group comprising contacting authorities;

adding the IP address of the device to a blacklist;

banning or restricting access of the client identifier;

banning or restricting access of the user credentials;

refusing connections or logins from any one or more of the IP address, rDNS/PTR, and geographical location of the device;

creating a database of methods used by the device to connect to the server;

publishing data regarding the connection from the device, stealth banning the device; and

tarpitting the device.

15. A non-transitory computer readable medium having program code stored thereon that is executable by a processor comprising part of a server and that, when executed by the processor, causes the processor to:

(a) receive the client identifier and user credentials from a device;

(b) determine whether the client identifier and user credentials are authentic, wherein the device does not learn from the server which of the client identifier and user credentials are inauthentic when one or both of the client identifier and user credentials are determined to be inauthentic;

(c) when at least one of the client identifier and user credentials are inauthentic, determining whether the device is an attacker of the network resource; and

(d) performing one or both of prophylactic and remedial action in response to determining that the device is an attacker.