Tracking communication for determining device states

• US 7,506,360 B1
• Filed: 10/01/2003
• Issued: 03/17/2009
• Est. Priority Date: 10/01/2002
• Status: Active Grant

• Current Assignee: Sysxnet Ltd.
• Original Assignee: Mirage Networks Inc. (Singapore Telecommunications Limited)
• Inventors: Miller, Ronald J., McDaniels, Michael J., Wilkinson, Mark L.
• Primary Examiner(s): Truong; Thanhnga B
• Application Number:
  US10/676,541
• Time in Patent Office: 1,994 Days
• Field of Search: 726 22- 25, 726/26, 726/3, 726/11, 726/13, 709223-225, 348/143, 370229-230, 370/252, 715/764, 714/37
• US Class Current: 726/3
• CPC Class Codes: H04L 61/10 of different types
• CPC Class Codes: H04L 61/103 across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP]
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A system and method for tracking communication for determining device states. Communication between devices is observed and a respective state of at least one device is inferred. The inference is formed without directly communicating with the device. Various states of the devices include unknown, used, unfulfilled, virtual, omitted, and automatic. The respective state of a device is unknown when the observation shows that the device fails to respond to communication. The respective state of the device is unfulfilled when an ARP request comprising a destination address for the device is observed, and the device does not respond to the ARP request prior to expiration of a time limit. The respective state of a device is determined to be virtual when the observation shows that the device received a packet when its respective state was unfulfilled, and the device did not send a reply to the packet within a time limit.

Claims

1. A computer-implemented method comprising:

observing communication between a plurality of devices;

inferring a respective state of at least one device of the plurality of devices based upon the observing the communication;

the respective state of a first device of the at least one device is determined to be unfulfilled;

the respective state of the first device is determined to be unfulfilled when the observing the communication comprises

observing an address resolution protocol request comprising a destination address for the first device, and

observing that the first device does not respond to the address resolution protocol request prior to expiration of a time limit.

2. The method of claim 1 wherein

the inferring is performed without sending a packet to the at least one device.

3. The method of claim 1 wherein

the inferring is performed without participating in the communication with the at least one device.

4. The method of claim 1 wherein

the inferring is performed only by listening to the communication with the at least one device.

5. The method of claim 1 further comprising:

setting a designation for a first device of the plurality of devices to a threat when

the first device receives a packet and

the respective state of the first device is unfulfilled.

6. The method of claim 5 further comprising:

changing the designation for the first device to a non-threat when subsequent communication initiated by the first device does not violate a rule for the communication.

7. The method of claim 1 further comprising:

setting a designation for a first device of the plurality of devices to a possible threat when

the communication is initiated by the first device, and

the communication initiated by the first device violates a rule.

8. The method of claim 7 further comprising:

changing the designation for the first device to a non-threat when subsequent communication initiated by the first device does not violate a second rule for the communication.

9. The method of claim 1 further comprising:

setting a designation for a first device of the at least one device to a possible threat based upon a packet configuration for a packet sent by the first device as part of the communication.

10. The method of claim 1 wherein

the respective state of a first device of the at least one device is determined to be unknown.

11. The method of claim 10 wherein

the respective state of the first device is determined to be unknown when the observing the communication comprises

observing that the first device fails to respond to the communication sent to the first device.

12. The method of claim 1 wherein

the respective state of the first device is determined to be unfulfilled when the first device receives an address resolution protocol request.

13. The method of claim 1 wherein

the respective state of a first device of the plurality of devices is determined to be used.

14. The method of claim 13 wherein

the respective state of the first device is determined to be used when the observing the communication comprises

observing that the first device performs one of sending and receiving a packet.

15. The method of claim 13 wherein

the respective state of the first device is determined to be used when the observing the communication comprises

observing that the first device received a packet when the respective state for the first device was unfulfilled, and

observing that the first device sent a reply to the packet within a time limit.

16. The method of claim 1 wherein

the respective state of a first device of the plurality of devices is determined to be virtual.

17. The method of claim 16 wherein

the respective state of the first device is determined to be virtual when the observing the communication comprises

observing that the first device received a packet when the respective state for the first device was unfulfilled, and

observing that the first device did not send a reply to the packet within a time limit.

18. The method of claim 1 wherein

the respective state of a first device of the plurality of devices is determined to be automatic.

19. The method of claim 18 wherein

the respective state of the first device is determined to be automatic when

an automatic reply is programmed to be sent to a second address when the first device receives a packet from the second address.

20. The method of claim 1 wherein

the respective state of the first device is determined to be omitted.

21. The method of claim 20 wherein

the respective state of the first device is determined to be omitted when

the observing is programmed to omit communication with the first device from the observing.

22. The method of claim 1 further comprising:

initializing the respective state of at least one device of the plurality of devices to unknown prior to the observing.

23. The method of claim 1 wherein

the plurality of devices communicates via a segment of a network.

24. The method of claim 1 further comprising:

maintaining the respective state for one device of the at least one device in a storage area.

25. The method of claim 1 wherein

storing information about at least one packet of a plurality of packets communicated between the plurality of devices.

26. The method of claim 25 wherein

the information comprises a respective source address and a respective destination address for each packet of the plurality of packets.

27. The method of claim 25 wherein

the information comprises a protocol for each packet of the plurality of packets.

28. The method of claim 25 wherein

the information comprises a time that each packet of the plurality of packets was sent.

29. A processing system comprising:

observing means for observing communication between a plurality of devices; and

inferring means for inferring a respective state of at least one device of the plurality of devices based upon the observing the communication;

determining means for determining that the respective state of the first device is unfulfilled when the observing the communication comprises

observing an address resolution protocol request comprising a destination address for the first device, and

observing that the first device does not respond to the address resolution protocol request prior to expiration of a time limit.

30. The system of claim 29 further comprising:

determining means for determining that the respective state is unknown when the observing the communication comprises

observing that the first device fails to respond to the communication sent to the first device.

31. The system of claim 29 further comprising:

determining means for determining that the respective state of the first device is unfulfilled when the first device receives an address resolution protocol request.

32. The system of claim 29 further comprising:

determining means for determining that the respective state of the first device is used when the observing the communication comprises

observing that the first device performs one of sending and receiving a packet.

33. The system of claim 29 further comprising:

determining means for determining that the respective state of the first device is used when the observing the communication comprises

observing that the first device received a packet when the respective state for the first device was unfulfilled, and

observing that the first device sent a reply to the packet within a time limit.

34. The system of claim 29 further comprising:

determining means for determining that the respective state of a first device of the plurality of devices is virtual when the observing the communication comprises

observing that the first device received a packet when the respective state for the first device was unfulfilled, and

observing that the first device failed to send a reply to the packet within a time limit.

35. The system of claim 29 further comprising:

determining means for determining that the respective state of the first device is automatic when

an automatic reply is programmed to be sent to a second address when the first device receives a packet from the second address.

36. The system of claim 29 further comprising:

determining means for determining that the respective state of the first device is omitted when

the observing is programmed to omit communication with the first device from the observing.

37. The system of claim 29 further comprising:

initializing means for initializing the respective state of at least one device of the plurality of devices to unknown prior to the observing.

38. The system of claim 29 further comprising:

maintaining means for maintaining the respective state for one device of the at least one device in a storage area.

39. The system of claim 29 further comprising:

storing means for storing information about at least one packet of a plurality of packets communicated between the plurality of devices.

40. A system comprising:

an observing module configured to observe communication between a plurality of devices; and

an inferring module configured to infer a respective state of at least one device of the plurality of devices based upon the observing the communication;

a determining module configured to determine that the respective state of the first device is unfulfilled when the observing the communication comprises

observing an address resolution protocol request comprising a destination address for the first device, and

observing that the first device does not respond to the address resolution protocol request prior to expiration of a time limit; and

a processor configured to interpret the observing module, inferring module, and determining module.

41. The system of claim 40 further comprising:

the determining module is further configured to determine that the respective state is unknown when the observing the communication comprises

observing that the first device fails to respond to the communication sent to the first device.

42. The system of claim 40 further comprising:

the determining module is further configured to determine that the respective state of the first device is unfulfilled when the first device receives an address resolution protocol request.

43. The system of claim 40 further comprising:

the determining module is further configured to determine that the respective state of the first device is used when the observing the communication comprises

observing that the first device performs one of sending and receiving a packet.

44. The system of claim 40 further comprising:

the determining module is further configured to determine that the respective state of the first device is used when the observing the communication comprises

observing that the first device received a packet when the respective state for the first device was unfulfilled, and

observing that the first device sent a reply to the packet within a time limit.

45. The system of claim 40 further comprising:

the determining module is further configured to determine that the respective state of a first device of the plurality of devices is virtual when the observing the communication comprises

observing that the first device received a packet when the respective state for the first device was unfulfilled, and

observing that the first device failed to send a reply to the packet within a time limit.

46. The system of claim 40 further comprising:

the determining module is further configured to determine that the respective state of the first device is automatic when

an automatic reply is programmed to be sent to a second address when the first device receives a packet from the second address.

47. The system of claim 40 further comprising:

the determining module is further configured to determine that the respective state of the first device is omitted when

the observing is programmed to omit communication with the first device from the observing.

48. The system of claim 40 further comprising:

an initializing module configured to initialize the respective state of at least one device of the plurality of devices to unknown prior to the observing.

49. The system of claim 40 further comprising:

a maintaining module configured to maintain the respective state for one device of the at least one device in a storage area.

50. The system of claim 40 further comprising:

a storing module configured to store information about at least one packet of a plurality of packets communicated between the plurality of devices.

51. An article of manufacture comprising:

computer-readable medium encoded with computer interpretable instructions embodied therein including;

observing instructions configured to cause a processor to observe communication between a plurality of devices; and

inferring instructions configured to cause the processor to infer a respective state of at least one device of the plurality of devices based upon the observing the communication;

determining instructions configured to cause the processor to determine that the respective state of the first device is unfulfilled when the observing the communication comprises

observing an address resolution protocol request comprising a destination address for the first device, and

observing that the first device does not respond to the address resolution protocol request prior to expiration of a time limit.

52. The article of manufacture of claim 51 further comprising:

the determining instructions further configured to cause the processor to determine that the respective state is unknown when the observing the communication comprises

observing that the first device fails to respond to the communication sent to the first device.

53. The article of manufacture of claim 51 further comprising:

the determining instructions further configured to cause the processor to determine that the respective state of the first device is unfulfilled when the first device receives an address resolution protocol request.

54. The article of manufacture of claim 51 further comprising:

the determining instructions further configured to cause the processor to determine that the respective state of the first device is used when the observing the communication comprises

observing that the first device performs one of sending and receiving a packet.

55. The article of manufacture of claim 51 further comprising:

the determining instructions further configured to cause the processor to determine that the respective state of the first device is used when the observing the communication comprises

observing that the first device received a packet when the respective state for the first device was unfulfilled, and

observing that the first device sent a reply to the packet within a time limit.

56. The article of manufacture of claim 51 further comprising:

the determining instructions further configured to cause the processor to determine that the respective state of a first device of the plurality of devices is virtual when the observing the communication comprises

observing that the first device received a packet when the respective state for the first device was unfulfilled, and

observing that the first device failed to send a reply to the packet within a time limit.

57. The article of manufacture of claim 51 further comprising:

the determining instructions further configured to cause the processor to determine that the respective state of the first device is automatic when

an automatic reply is programmed to be sent to a second address when the first device receives a packet from the second address.

58. The article of manufacture of claim 51 further comprising:

the determining instructions further configured to cause the processor to determine that the respective state of the first device is omitted when

the observing is programmed to omit communication with the first device from the observing.

59. The article of manufacture of claim 51 further comprising:

initializing instructions configured to cause the processor to initialize the respective state of at least one device of the plurality of devices to unknown prior to the observing.

60. The article of manufacture of claim 51 further comprising:

maintaining instructions configured to cause the processor to maintain the respective state for one device of the at least one device in a storage area.

61. The article of manufacture of claim 51 further comprising:

storing instructions configured to cause the processor to store information about at least one packet of a plurality of packets communicated between the plurality of devices.