Intrusion and misuse deterrence system employing a virtual network

• US 7,240,368 B1
• Filed: 04/13/2000
• Issued: 07/03/2007
• Est. Priority Date: 04/14/1999
• Status: Expired due to Fees

• Current Assignee: Level 3 Communications LLC (Lumen Technologies, Inc.), Raytheon BBN Technlogies Corp. (Rtx Corporation), Verizon Corporate Services Group Incorporated (Verizon Communications Inc.)
• Original Assignee: Level 3 Communications Incorporated (Lumen Technologies, Inc.), BBN Technologies (Rtx Corporation), Verizon Corporate Services Group Incorporated (Verizon Communications Inc.)
• Inventors: Roesch, Martin F., Gula, Ronald J.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Lanier, Benjamin E.
• Application Number:
  US09/548,547
• Time in Patent Office: 2,637 Days
• Field of Search: 713/151, 713/152, 713/153, 713/154, 713/201, 726/13, 726/14, 726/15, 726/23, 726/25
• US Class Current: 726/23
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A method and apparatus is disclosed for increasing the security of computer networks through the use of an Intrusion and Misuse Deterrence System (IMDS) operating on the network. The IMDS is a system that creates a synthetic network complete with synthetic hosts and routers. It is comprised of a network server with associated application software that appears to be a legitimate portion of a real network to a network intruder. The IMDS consequently invites inquiry and entices the intruder away from the real network. Simulated services are configured to appear to be running on virtual clients with globally unique, class “C” IP addresses. Since there are no legitimate users of the virtual network simulated by the IMDS, all such activity must be inappropriate and can be treated as such. Consequently, the entire set of transactions by an intruder can be collected and identified rather than just those transactions that meet a predefined attack profile. Also, new exploits and attacks are handled just as effectively as known attacks, resulting in better identification of attack methodologies as well as the identification and analysis of new attack types. Since the IMDS only has to be concerned with the traffic going to its simulated hosts it additionally eliminates the bandwidth limitation that plagues a traditional intrusion detection system (IDS).

Claims

1. An intruder detection system comprising:

a server coupled to a computer network, said server configured to;

simulate a plurality of client computers; and

notify a network administrator when an intruder attempts to access one of said plurality of client computers.

2. The system of claim 1, wherein said server is further configured to record a change log entry of each server access event.

3. The system of claim 1, wherein said plurality of client computers is a class “

C”

IP network.

4. The system of claim 1, wherein said server is further comprised of:

a network address translator;

an IP filter,

an internet services daemon; and

a plurality of facade services.

5. A computer system for identifying unauthorized users, comprising:

a memory having program instructions; and

a processor configured to use the program instructions to;

simulate a plurality of client computers; and

notify a network administrator provided a user attempts to access one of said plurality of client computers.

6. The computer system of claim 5, wherein the processor is further configured to record a change log record of each access event.