Protecting open world wide web sites from known malicious users by diverting requests from malicious users to alias addresses for the protected sites

• US 6,714,970 B1
• Filed: 10/26/2000
• Issued: 03/30/2004
• Est. Priority Date: 10/26/2000
• Status: Expired due to Term

• Current Assignee: Trend Micro Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Fiveash, William Alton, McBrearty, Gerald Francis, Mullen, Shawn Patrick, Shieh, Johnny Meng-Han
• Primary Examiner(s): Dinh, Dung C.
• Assistant Examiner(s): EDELMAN, BRADLEY E
• Application Number:
  US09/697,443
• Time in Patent Office: 1,251 Days
• Field of Search: 709/219, 709/225, 709/229, 713/200, 713/201
• US Class Current: 709/219
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2127 Bluffing
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Protecting open Web sites from known malicious users in a World Wide Web (Web) communication network with access to a plurality of open Web sites responsive to requests from users at IP addresses throughout the Web. There is provided in association with a protected open Web site, a stored list of the IP addresses of known malicious users combined with means for comparing the IP addresses of each user requesting access to the protected open Web site to said list of IP addresses of the known malicious users. There are also implementations responsive to the comparing means for diverting to an alias address for the protected Web site any request from the IP address of a malicious user. The alias address is provided by a function associated with the protected open Web site. The present invention is applicable in circumstances where the malicious users or “crackers” are already known.

Claims

1. In a World Wide Web (Web) communication network with access to a plurality of open Web sites responsive to requests from users at IP addresses throughout the Webs, a system for protecting said open Web sites front known malicious users comprising;

means associated with a protected open Web site for storing a list of the IP addresses of said known malicious users;

means for comparing the IP addresses of each user requesting access to said protected open Web site to said list of IP addresses of said known malicious users;

means for providing a plurality of alias addresses for said protected Web site; and

means responsive to said comparing means enabled to respectively divert to each of said plurality of alias addresses, one of a plurality of requests respectively from plurality of malicious users, whereby the request of each of said malicious users is diverted to a different one of said alias Web site addresses.

2. The network system of claim 1 further comprising:

a server for said protected Web site including;

said means for comparing,

said means for providing said alias address, and

said means for diverting.

3. The network system of claim 2 wherein said means for diverting further includes a router for routing all requests from said malicious users to a safe sub-network at said alias address.

4. The network system of claim 1 wherein said means associated with the protected open Web site for storing a list of the IP addresses of said known malicious users is associated with a plurality of protected Web sites.

5. The network system of claim 1 wherein said means associated with the protected open Web site for storing a list of the IP addresses of said known malicious users is associated with a plurality of protected web sites.

6. In a Web communication network with access to a plurality of open Web sites responsive to requests from users at IP addresses throughout the Web, a method for protecting said open Web sites from known malicious users comprising;

storing a list of the IP addresses of said known malicious users in association with a protected open Web site;

comparing the IP addresses of each user requesting access to said protected open Web site to said list of IP addresses of said known malicious users;

providing a plurality of alias addresses for said protected Web site; and

in response to said comparing step, diverting to each of said plurality of alias addresses, one of a plurality of requests respectively from a corresponding one of a plurality of IP addresses of a plurality of malicious users, whereby the request of each of said malicious users is diverted to a different one of said alias Web site addresses.

7. The method of claim 6 wherein said step of storing a list of the IP addresses of said known malicious users is associated with a plurality of protected open Web sites.

8. A computer program having code recorded on a computer readable medium for protecting said open Web sites from known malicious users in a Web communication network with access to a plurality of open Web sites responsive to requests from users at IP addresses throughout the Web comprising:

means associated with a protected open Web site for storing a list of the IP addresses of said known malicious users;

means for comparing the IP addresses of each user requesting access to said protected open Web site to said list of IP addresses of said known malicious users;

means for providing a plurality of alias addresses for said protected Web site; and

means responsive to said comparing means enabled to respectively divert to each of plurality of alias addresses, one of a plurality of requests respectively from a corresponding one of a plurality of IP addresses of a plurality of malicious users, whereby the request of each of said malicious users is diverted to a different one of said alias Web site addresses.

9. The computer program of claim 8 wherein said means associated with the protected open Web site for storing a list of the IP addresses of said known malicious users is associated with a plurality of protected Web sites.

10. A computer program having code recorded on a computer readable medium for protecting said open Web sites from known malicious users in a Web communication network with access to a plurality of open Web sites responsive to requests from users at IP addresses throughout the Web comprising:

means for determining whether a user requesting access to a protected open Web site is a malicious user;

means for providing a plurality of alias addresses for said protected Web site; and

means responsive to said determining means enabled to respectively divert to each of said plurality of alias addresses, one of a plurality of requests respectively from a corresponding one of a plurality of IP addresses of a plurality of malicious users, whereby the request of each of said malicious users is diverted to a different one of said alias Web site addresses.

11. The computer program of claim 10 wherein said means for determining whether a user requesting access to said open Web site is a malicious user is associated with a plurality of protected Web sites.

12. A computer program having code recorded on a computer readable medium for protecting said open Web sites from known malicious users in a Web communication network with access to a plurality of open Web sites responsive to requests from users at IP addresses throughout the Web comprising:

means associated with a protected open Web site for storing a list of the IP addresses of said known malicious users;

means for comparing the IP addresses of each user requesting access to said protected open Web site to said list of IP addresses of said known malicious users;

means for providing a plurality of alias addresses for said protected Web site; and

means responsive to said comparing means for diverting to each of said plurality of alias addresses, one of a plurality of requests respectively from a corresponding one of a plurality of IP addresses of a plurality of malicious users, whereby the request of each of said malicious users is diverted to a different one of said alias Web site addresses.

13. The computer program of claim 12 wherein said means associated with the protected open Web site for storing a list of the IP addresses of said known malicious users is associated with a plurality of protected web sites.