Intelligent feedback loop process control system
DCFirst Claim
Patent Images
1. A method for detecting attacks on a network, comprising:
- at a gateway, receiving data from a remote source which is destined for a target;
discarding the data based on a predetermined set of rules utilizing a firewall associated with the gateway which is coupled to the remote source, wherein the firewall utilizes the predetermined set of rules to discard the data as a function of a plurality of parameters;
passing remaining data to an intrusion detection system coupled to the firewall associated with the gateway;
intercepting in real time the remaining data utilizing the intrusion detection system;
parsing the remaining data to identify data representing text therein utilizing the intrusion detection system;
comparing the data representing text to a predetermined list of data representing text associated with attacks utilizing the intrusion detection system, wherein the data representing text of the predetermined list refers to different types of attacks;
identifying the data representing text as hostile based on the comparison; and
acting on the data representing text identified as hostile in order to prevent an attack, wherein the data representing text identified as hostile is acted upon differently based on the type of the attack by at least one of blocking the data, alerting an administrator, and disconnecting the remote source.
6 Assignments
Litigations
0 Petitions
Accused Products
Abstract
There is disclosed a system and method for detecting attacks on a site in a communication network and for taking action to reduce or redirect such attacks. A monitor system reviews incoming data packets and sends directions to at least one router to change the data flow in the system. The directions may be sent to other routers. The data packets and the resulting work flow are modified for certain conditions, and for certain conditions within defined time slices, and action is taken when the monitored condition is contrary to expected conditions.
-
Citations
13 Claims
-
1. A method for detecting attacks on a network, comprising:
-
at a gateway, receiving data from a remote source which is destined for a target; discarding the data based on a predetermined set of rules utilizing a firewall associated with the gateway which is coupled to the remote source, wherein the firewall utilizes the predetermined set of rules to discard the data as a function of a plurality of parameters; passing remaining data to an intrusion detection system coupled to the firewall associated with the gateway; intercepting in real time the remaining data utilizing the intrusion detection system; parsing the remaining data to identify data representing text therein utilizing the intrusion detection system; comparing the data representing text to a predetermined list of data representing text associated with attacks utilizing the intrusion detection system, wherein the data representing text of the predetermined list refers to different types of attacks; identifying the data representing text as hostile based on the comparison; and acting on the data representing text identified as hostile in order to prevent an attack, wherein the data representing text identified as hostile is acted upon differently based on the type of the attack by at least one of blocking the data, alerting an administrator, and disconnecting the remote source. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A gateway system for detecting attacks on a network, comprising:
-
a firewall for receiving data from a remote source which is destined for a target, and discarding the data based on a predetermined set of rules; an intrusion detection system coupled to the firewall for intercepting in real time remaining data, parsing the remaining data to identify data representing text therein, and comparing the data representing text to a predetermined list of data representing text associated with attacks, wherein the data representing text of the predetermined list refers to different types of attacks; and acting on the data representing text identified as hostile in order to prevent an attack, wherein the data representing text identified as hostile is acted upon differently based on the type of the attack by at least one of blocking the data, alerting an administrator, and disconnecting the remote source, the intrusion detection system further capable of updating the predetermined list of data representing text associated with attacks. - View Dependent Claims (8, 9, 10, 11)
-
-
12. A method for detecting attacks on a network, comprising:
-
at a gateway, receiving data from a remote source which is destined for a target;
discarding the data based on a predetermined set of rules utilizing a firewall associated with the gateway which is coupled to the remote source, wherein the firewall utilizes the predetermined set of rules to discard the data as a function of a plurality of parameters selected from the group consisting of a source, a destination, and a port associated with the data;passing remaining data to an intrusion detection system coupled to the firewall associated with the gateway; intercepting in real time the remaining data utilizing the intrusion detection system; parsing the remaining data to identify data representing text therein utilizing the intrusion detection system; comparing the data representing text to a predetermined list of data representing text associated with attacks utilizing the intrusion detection system, wherein the data representing text of the predetermined list refers to different types of attacks selected from the group consisting of information gathering attacks, a web server denial of service attack, and a file server remote compromise; identifying the data representing text as hostile based on the comparison; acting on the data representing text identified as hostile in order to prevent an attack, wherein the data representing text identified as hostile is acted upon differently based on the type of the attack by at least one of blocking the data, alerting an administrator, and disconnecting the remote source; and updating the predetermined list of data representing text associated with attacks; wherein the firewall and the intrusion detection system are included in a single device.
-
-
13. A gateway system for detecting attacks on a network, comprising:
-
a firewall for receiving data from a remote source which is destined for a target, and discarding the data based on a predetermined set of rules, wherein the firewall utilizes the predetermined set of rules to discard the data as a function of a plurality of parameters selected from the group consisting of a source, a destination, and a port associated with the data; an intrusion detection system coupled to the firewall for intercepting in real time remaining data, parsing the remaining data to identify data representing text therein, and comparing the data representing text to a predetermined list of data representing text associated with attacks, wherein the data representing text of the predetermined list refers to different types of attacks, selected from the group consisting of information gathering attacks, a web server denial of service attack and a file server remote compromise, the intrusion detection system further capable of identifying the data representing text as hostile based on the comparison, and acting on the data representing text identified as hostile in order to prevent an attack, wherein the data representing text identified as hostile is acted upon differently based on the type of the attack by at least one of blocking the data, alerting an administrator, and disconnecting the remote source, the intrusion detection system further capable of updating the predetermined list of data representing text associated with attacks; wherein the firewall and the intrusion detection system are included in a single device.
-
Specification