VERIFYING NETWORK ATTACK DETECTOR EFFECTIVENESS

• US 20170103213A1
• Filed: 12/21/2016
• Published: 04/13/2017
• Est. Priority Date: 07/23/2014
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Di Pietro, Andrea, Vasseur, Jean-Philippe, Cruz Mota, Javier
• Granted Patent: US 9,922,196 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/1001 for accessing one among a plurality of replicated servers

Abstract

In one embodiment, a device receives a classifier tracking request from a coordinator device that specifies a classifier verification time period. During the classifier verification time period, the device classifies a set of network traffic that includes traffic observed by the device and attack traffic specified by the coordinator device. The device generates classification results based on the classified set of network traffic and provides the classification results to the coordinator device.

Claims

1-8. -8. (canceled)

9. A method, comprising:

identifying, by a coordinator device in a network, a type of network attack;

determining, by the coordinator device, a verification schedule during which an attack classifier executed by a device in the network is to be tested;

coordinating, by the coordinator device, an attack detection test for the attack classifier for execution during the verification schedule and for the identified type of network attack;

receiving, at the coordinator device, results of the attack detection test from the device; and

evaluating, by the coordinator device, a performance of the attack classifier based on the results of the attack detection test.

10. The method as in claim 9, wherein coordinating the attack detection test comprises:

instructing the device to evaluate a particular set of attack traffic during the attack detection test by mixing the attack traffic with traffic observed by the device.

11. The method as in claim 9, wherein coordinating the attack detection test comprises:

instructing a set of one or more network nodes to send attack traffic to the device during the attack detection test.

12. The method as in claim 11, wherein the instruction causes the set of one or more network nodes to flag the attack traffic as testing traffic.

13. The method as in claim 11, wherein the set of one or more network nodes deprioritize the attack traffic with respect to other network traffic.

14. The method as in claim 9, wherein the set of one or more network nodes are instructed to use a different routing topology than a normal routing topology during the attack detection test.

15. The method as in claim 9, wherein the verification schedule is authorized by a network policy engine.

16-23. -23. (canceled)

24. An apparatus, comprising:

one or more network interfaces to communicate with a network;

a processor coupled to the network interfaces and configured to execute one or more processes; and

a memory configured to store a process executable by the processor, the process when executed operable to;

identify a type of network attack;

determine a verification schedule during which an attack classifier executed by a device in the network is to be tested;

coordinate an attack detection test for the attack classifier for execution during the verification schedule and for the identified type of network attack;

receive results of the attack detection test from the device; and

evaluate a performance of the attack classifier based on the results of the attack detection test.

25. The apparatus as in claim 24, wherein the attack detection test is coordinated by:

instructing the device to evaluate a particular set of attack traffic during the attack detection test by mixing the attack traffic with traffic observed by the device.

26. The apparatus as in claim 24, wherein the attack detection test is coordinate by:

instructing a set of one or more network nodes to send attack traffic to the device during the attack detection test.

27. The apparatus as in claim 26, wherein the instruction causes the set of one or more network nodes to flag the attack traffic as testing traffic.

28. The apparatus as in claim 26, wherein the set of one or more network nodes deprioritize the attack traffic with respect to other network traffic.

29. The apparatus as in claim 24, wherein the set of one or more network nodes are instructed to use a different routing topology than a normal routing topology during the attack detection test.

30. The apparatus as in claim 24, wherein the verification schedule is authorized by a network policy engine.

31. A tangible non-transitory computer readable medium storing program instructions that cause a computer to execute a process, the process comprising:

identifying, as a coordinator device in a network, a type of network attack;

determining, as the coordinator device, a verification schedule during which an attack classifier executed by a device in the network is to be tested;

coordinating, as the coordinator device, an attack detection test for the attack classifier for execution during the verification schedule and for the identified type of network attack;

receiving, as the coordinator device, results of the attack detection test from the device; and

evaluating, as the coordinator device, a performance of the attack classifier based on the results of the attack detection test.

32. The tangible non-transitory computer readable medium as in claim 31, wherein coordinating the attack detection test comprises:

instructing the device to evaluate a particular set of attack traffic during the attack detection test by mixing the attack traffic with traffic observed by the device.

33. The tangible non-transitory computer readable medium as in claim 31, wherein coordinating the attack detection test comprises:

instructing a set of one or more network nodes to send attack traffic to the device during the attack detection test.

34. The tangible non-transitory computer readable medium as in claim 33, wherein the instruction causes the set of one or more network nodes to flag the attack traffic as testing traffic.

35. The tangible non-transitory computer readable medium as in claim 33, wherein the set of one or more network nodes deprioritize the attack traffic with respect to other network traffic.

36. The tangible non-transitory computer readable medium as in claim 31, wherein the set of one or more network nodes are instructed to use a different routing topology than a normal routing topology during the attack detection test.