REMEDIATING COMPUTER SECURITY THREATS USING DISTRIBUTED SENSOR COMPUTERS
First Claim
1. A computer-implemented data processing method, comprising:
- detecting, by a processor, network messages that are emitted by a compromised computer,wherein the compromised computer comprises at least one malware item that is configured to direct unauthorized network activity toward one or more enterprise networks or enterprise computers;
analyzing, by the processor, timing of the network messages with respect to a predetermined schedule including active hours and inactive hours;
sending a result of the analyzing to a security control computer over a communication network, the result indicating one or more security threats caused by the compromised computer;
receiving a measure to remediate the one security threat from security control computer.
4 Assignments
0 Petitions
Accused Products
Abstract
A data processing system comprising: a sensor computer that is coupled to and co-located with a compromised computer, the compromised computer comprising at least one malware item that is configured to direct unauthorized network activity toward one or more enterprise networks or enterprise computers, wherein the compromised computer is coupled to a firewall that is configured to control ingress of packets to the compromised computer and is logically between one or more attacker computers and the one or more enterprise networks or enterprise computers; a security control computer that is coupled to the sensor computer; one or more non-transitory data storage media in the security control computer storing security logic comprising one or more sequences of instructions which when executed cause the security control computer to perform: obtaining, from the sensor computer, detection data relating to network messages that the compromised computer emits, as the compromised computer emits the network messages; using the detection data, identifying one or more security threats that are indicated by the network messages; determining a specified remediation measure to remediate one or more of the security threats; providing the specified remediation measure to one or more of the compromised computer, the sensor computer, the firewall, and an enterprise computer.
-
Citations
20 Claims
-
1. A computer-implemented data processing method, comprising:
-
detecting, by a processor, network messages that are emitted by a compromised computer, wherein the compromised computer comprises at least one malware item that is configured to direct unauthorized network activity toward one or more enterprise networks or enterprise computers; analyzing, by the processor, timing of the network messages with respect to a predetermined schedule including active hours and inactive hours; sending a result of the analyzing to a security control computer over a communication network, the result indicating one or more security threats caused by the compromised computer; receiving a measure to remediate the one security threat from security control computer. - View Dependent Claims (2)
-
-
3. A computer-implemented data processing method, comprising:
-
obtaining, by a processor, from a sensor computer detection data relating to network messages that a compromised computer emits, as the compromised computer emits the network messages, wherein the sensor computer that is coupled to and co-located with the compromised computer, wherein the compromised computer comprises at least one malware item that is configured to direct unauthorized network activity toward one or more enterprise networks or enterprise computers, wherein the compromised computer is coupled to a firewall that is configured to control ingress of packets to the compromised computer; identifying, by the processor, one or more security threats that are indicated by the network messages from the detection data; determining a specified remediation measure to remediate at least one of the one or more security threats; providing the specified remediation measure to one or more of the compromised computer, the sensor computer, the firewall, and the one enterprise computer or network. - View Dependent Claims (4, 5, 6, 7)
-
-
8. A data processing method performed by a security control computer, comprising:
-
the security control computer being coupled to a sensor computer, the sensor computer being coupled to, co-located with, and on a same LAN segment as a compromised computer, the compromised computer comprising at least one malware item that is configured to direct unauthorized network activity toward one or more enterprise networks or enterprise computers, the compromised computer being coupled to a firewall that is configured to control ingress of packets to the compromised computer and the sensor computer from a network, the one or more enterprise networks or enterprise computers being coupled to the network through an enterprise firewall, the compromised computer being logically between one or more attacker computers and the one or more enterprise networks or enterprise computers, causing selecting of one or more of network messages emitted from the compromised computer and directed toward the one enterprise computer, the selection comprising filtering the one or more network messages emitted from the compromised computer based upon one or more ports of interest; causing queuing of the selected one or more network messages in queues at the sensor computer; obtaining, from the sensor computer, detection data relating to the network messages that the compromised computer emits, as the compromised computer emits the network messages; using the detection data, identifying one or more security threats that are indicated by the network messages; determining a specified remediation measure to remediate the one or more the security threats; providing the specified remediation measure to one or more of the compromised computer, the sensor computer, the firewall, and an enterprise computer; causing inspecting and modifying of the queued one or more of network messages to remove one or more security threats before forwarding the queued one or more of network messages to the enterprise computer. - View Dependent Claims (9, 10, 11, 12, 14, 15)
-
-
13. A data processing method performed by a security control computer, comprising:
-
the security control computer being coupled to a sensor computer, a sensor computer being coupled to, co-located with, and on a same LAN segment as a compromised computer, the compromised computer comprising at least one malware item that is configured to direct unauthorized network activity toward one or more enterprise networks or enterprise computers, the compromised computer being coupled to a firewall that is configured to control ingress of packets to the compromised computer and the sensor computer from a network, the one or more enterprise networks or enterprise computers being coupled to the network through an enterprise firewall, the compromised computer being logically between one or more attacker computers and the one or more enterprise networks or enterprise computers, causing selecting of one or more of network messages emitted from the compromised computer and directed toward the one enterprise computer, the selection comprising selecting all network messages when a total message output or packet output of the compromised computer exceeds one or more specified thresholds; causing queuing of the selected one or more network messages in queues at the sensor computer; obtaining, from the sensor computer, detection data relating to the network messages that the compromised computer emits, as the compromised computer emits the network messages; using the detection data, identifying one or more security threats that are indicated by the network messages; determining a specified remediation measure to remediate the one or more the security threats; providing the specified remediation measure to the compromised computer, the sensor computer, the firewall, and an enterprise computer; causing inspecting and modification of the queued one or more of network messages to remove the one or more security threats before forwarding the queued one or more network messages to the enterprise computer.
-
-
16. A data processing method performed by a security control computer, comprising:
-
the security control computer being coupled to a sensor computer, the sensor computer coupled to, co-located with, and on a same LAN segment as a compromised computer, the compromised computer comprising at least one malware item that is configured to direct unauthorized network activity toward one or more enterprise networks or enterprise computers, the compromised computer being logically between one or more attacker computers and the one or more enterprise networks or enterprise computers, the compromised computer being coupled to a firewall that is configured to control ingress of packets to the compromised computer and the sensor computer from a network, the one or more enterprise networks or enterprise computers being coupled to the network through an enterprise firewall, causing selection of one or more of network messages emitted from the compromised computers and directed toward the one enterprise computer, the selection comprising filtering the one or more network messages emitted from the compromised computers based upon one or more ports of interest; causing queuing of the selected one or more network messages in queues at the sensor computer; obtaining, from the sensor computer, detection data relating to the selected one or more network messages that the compromised computers emit, as the compromised computers emit the network messages; using the detection data, identifying one or more security threats that are indicated by the network messages; determining a specified remediation measure to remediate the one or more security threats, the specified remediation measure comprising one or more of;
causing dropping packets associated with the compromised computer;
causing disrupting establishment of a TCP connection or UDP connection that is partway through handshake negotiation using the compromised computer;
causing disrupting an existing connection session in one or more of TCP/IP or an application layer protocol;configuring one or more of the compromised computer, the sensor computer, the firewall, and an enterprise computer to perform the specified remediation measure; causing inspecting and modifying of the queued one or more of network messages to remove one or more security threats before forwarding the queued one or more of network messages to the enterprise computer. - View Dependent Claims (17, 18)
-
-
19. A data processing method performed by a sensor computer, comprising:
-
the sensor computer being coupled to, co-located with, and on a same LAN segment as a compromised computer, the compromised computer comprising at least one malware item that is configured to direct unauthorized network activity toward one or more enterprise networks or enterprise computers, the compromised computer being coupled to a firewall that is configured to control ingress of packets to the compromised computer and the sensor computer from a network, the one or more enterprise networks or enterprise computers being coupled to the network through an enterprise firewall, the compromised computer being logically between one or more attacker computers and the one or more enterprise networks or enterprise computers, selecting one or more of network messages emitted from the compromised computer and directed toward the one enterprise computer, the selecting comprising filtering the one or more network messages emitted from the compromised computer based upon one or more ports of interest; queuing the selected one or more network messages in queues at the sensor computer; sending to a security control computer that is coupled to the sensor computer via a network, detection data relating to network messages that the compromised computer emits, as the compromised computer emits the network messages; receiving a specified remediation measure from the security control computer which remediation measure has been determined using the detection data to identify one or more security threats that are indicated by the network messages; causing inspection and modification of the queued one or more network messages to remove the one or more security threats before forwarding the queued one or more network messages to the one enterprise computer.
-
-
20. A data processing method performed by a sensor computer, comprising:
-
the sensor computer being coupled to, co-located with, and on a same LAN segment as a compromised computer the compromised computer comprising at least one malware item that is configured to direct unauthorized network activity toward one or more enterprise networks or enterprise computers, the compromised computer being coupled to a firewall that is configured to control ingress of packets to the compromised computer and the sensor computer from a network, the one or more enterprise networks or enterprise computers being coupled to the network through an enterprise firewall, the compromised computer being logically between one or more attacker computers and the one or more enterprise networks or enterprise computers, selecting one or more of network messages emitted from the compromised computer and directed toward the one enterprise computer, the selection comprising selecting all network messages when a total message output or packet output of the compromised computer exceeds one or more specified thresholds; queuing the selected one or more network messages in queues at the sensor computer; sending to a security control computer that is coupled to the sensor computer via a network, detection data relating to network messages that the compromised computer emits, as the compromised computer emits the network messages; receiving a specified remediation measure from the security control computer which remediation measure has been determined using the detection data to identify one or more security threats that are indicated by the network messages; causing inspecting and modifying of the queued one or more network messages to remove the one or more security threats before forwarding the queued one or more of network messages to the one enterprise computer.
-
Specification