Non-invasive monitoring of the effectiveness of electronic security services

• US 7,509,675 B2
• Filed: 05/29/2002
• Issued: 03/24/2009
• Est. Priority Date: 05/29/2002
• Status: Expired due to Fees

• Current Assignee: RPX Corporation
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Aaron, Jeffrey A.
• Primary Examiner(s): Smithers, Matthew B
• Assistant Examiner(s): Fields, Courtney D
• Application Number:
  US10/159,757
• Publication Number:
  US 20090044277A1
• Time in Patent Office: 2,491 Days
• Field of Search: 726/22, 726/23, 726/24, 726/26, 726/25, 380/247, 380/248, 380/250
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Systems for the non-invasive monitoring of the effectiveness of a customer'"'"'s electronic security services include a test generation engine for generating and launching a denatured attack towards a customer'"'"'s network. A monitoring and evaluation agent is operatively coupled to the test generation engine and is adapted to monitor and evaluate the denatured attack. A recording and analysis engine is adapted to record and analyze the results of the denatured attack. Other systems and methods are also provided.

Claims

1. A system for the non-invasive monitoring of the effectiveness of a customer'"'"'s electronic security services, comprising:

test generation means for generating and launching a denatured attack towards a customer'"'"'s network;

monitoring and evaluation means operatively coupled to the test generation means the monitoring and evaluation means for monitoring and evaluating the denatured attack; and

recording and analysis means operatively coupled to the test generation means and the monitoring and evaluation means, the recording and analysis means for recording and analyzing results of the denatured attack.

2. The system of claim 1, wherein the monitoring and evaluation means further comprise at least one of a sniffer module, an innoculator module, an analyzer module, an evaluator module, a communicator module, a decryption and encryption module, or a cryptographic key module.

3. The system of claim 2, wherein the analyzer module is adapted to determine configuration changes that have occurred on the customer'"'"'s network and to transmit the configuration changes to the recording and analysis means.

4. The system of claim 2, wherein the evaluator module is adapted to receive test data from the communicator module and analyzer module, and to evaluate whether a test or attack on the customer'"'"'s network has caused harm to the customer'"'"'s network, or would have caused harm, if not denatured.

5. The system of claim 2, wherein the innoculator module is adapted to receive at least one of test list of attacks, attack schedule, and attack identifiers from the test generation means.

6. The system of claim 2, wherein the sniffer module is adapted to process all communications incoming and outgoing to the monitoring and evaluation means and to access data packets received or transmitted.

7. The system of claim 2, wherein the communicator module is adapted to perform a communication interface function between selected modules of the monitoring and evaluation means and the provider'"'"'s network.

8. The system of claim 1, further comprising further test generation means operatively coupled to the test generation means for use when multiple denatured attacks are launched that require coordination.

9. The system of claim 1, further comprising a scheduling module coupled to the test generation means for coordinating the denatured attacks between the test generation means, monitoring and evaluation means and recording and analysis means.

10. The system of claim 1, wherein the recording and analysis means further comprise a scheduling module for coordinating the denatured attacks between the test generation means, monitoring and evaluation means and recording and analysis means.

11. The system of claim 1, further comprising further monitoring and evaluation means associated with each component, device, or resource in the customer'"'"'s network that requires non-invasive monitoring.

12. The system of claim 1, wherein the recording and analysis means further comprise at least one of a scheduler module, a global evaluator module, a user interface module, a communicator module, or a database interface module.

13. The system of claim 12, wherein the scheduler module is adapted to provide test scheduling, and to make test schedule test information available to the test generation means and the monitoring and evaluation means.

14. The system of claim 12, wherein the global evaluator module is adapted to analyze data returned by the monitoring and evaluation means.

15. The system of claim 12, wherein the user interface module is adapted to provide user interaction functionality and command line capabilities of an underlying operating system.

16. The system of claim 12, wherein the communicator module is adapted to provide a communication interface function between other modules and the provider network.

17. The system of claim 12, wherein the database interface module is adapted to provide functionality to enable provisioning and access to a database that contains customer data.

18. The system of claim 1, wherein the test generation means further comprise at least one of a tester module, a library module, a coordinator module, a server module or a communicator module.

19. The system of claim 18, wherein the tester module is adapted to perform testing.

20. The system of claim 18, wherein the library module is adapted to provide functionality to enable provisioning and access to a database that contains test or attack data.

21. The system of claim 18, wherein the coordinator module is adapted to obtain schedule information from the recording and analysis means, to handshake with the monitoring and evaluation means to signal when ready and finished, to handshake with further test generation means for cooperative tests requiring multiple test generation means, to control the server module, and to control the tester module.

22. The system of claim 18, wherein the server module is adapted to provide the test generation engine means with server functionality, including at least one of web, file, or email server.

23. The system of claim 18, wherein the communicator module is adapted to provide a communication interface function between other modules and the provider network.

24. The system of claim 1, wherein the denatured attack comprises a data packet reconfigured such that a harmful portion of the data packet has been rendered harmless.

25. The system of claim 1, wherein the denatured attack comprises a portion of executable or interpretable program code, the program code reconfigured as a harmless code and having an externally observable actions that mimic a harmful attack.

26. The system of claim 1, wherein the denatured attack comprises redirecting an attack from a targeted customer'"'"'s resource to a nearby agent.

27. The system of claim 22, wherein the at least one of web, file or email server are configured to denature attacks involving requests to a server originating from a customer'"'"'s client or from the monitoring and evaluation means.

28. The system of claim 1, wherein the monitoring and evaluation means are configured to adjust the rate of generation and launching of the denatured attack.

29. A non-invasive system for determining the effectiveness of electronic security service, comprising:

a customer network having a plurality of electronic security services;

a center having a test generation engine adapted to generate and launch denatured attacks towards the customer'"'"'s network;

an agent coupled to the customer'"'"'s network, the agent adapted to monitor and evaluate the denatured attack; and

a recording and analysis engine operatively coupled to the agent, the recording and analysis engine adapted to record and analyze the results of the denatured attack.

30. The system of claim 29, further comprising a scheduling module operative coupled to the test generation engine, agent and recording and analysis engine, the scheduling module adapted to coordinate the tasks of the test generation engine, agent and recording and analysis engine.

31. The system of claim 29, wherein the recording and analysis engine further comprises a scheduling module, the scheduling module adapted to coordinate the tasks of the test generation engine and agent.

32. The system of claim 29, wherein the agent further comprises at least one of a sniffer module, an innoculator module, an analyzer module, an evaluator module, a communicator module, a decryption and encryption module or a cryptographic key module.

33. The system of claim 29, wherein the test generation engine further comprises at least one of a tester module, a library module, a coordinator module, a server module, and a communicator module.

34. The system of claim 29, wherein the denatured attack comprises a data packet reconfigured such that a harmful portion of the data packet has been rendered harmless.

35. The system of claim 29, wherein the denatured attack comprises a portion of executable or interpretable program code, the program code reconfigured as a harmless code and having an externally observable actions that mimic a harmful attack.

36. The system of claim 29, wherein the denatured attack comprises redirecting an attack from a targeted customer'"'"'s resource to a nearby agent.

37. The system of claim 29, wherein the test generation engine further comprises a server module adapted to provide the test generation engine with server functionality, including at least one of web, file, or email server, and wherein the servers are configured to denature attacks involving requests to a server originating from a customer'"'"'s client or from the agent.

38. The system of claim 29, wherein the agent is configured to adjust the rate of generation and launching of the denatured attack.

39. A system for the non-invasive monitoring of a customer'"'"'s electronic security services network, comprising:

means for generating and launching a denatured attack towards a customer'"'"'s network;

means for monitoring and evaluating the denatured attack; and

means for recording and analyzing the results of the denatured attack.

40. The system of claim 39, further comprising means for scheduling the launch of the denatured attack.

41. A method for the non-invasive monitoring of the effectiveness of electronic security services on a customer'"'"'s network, comprising:

launching a denatured attack of the customer'"'"'s network; and

detecting and evaluating the effects of the denatured attack of the customer'"'"'s network.

42. The method of claim 41, wherein launching a denatured attack over a communications network toward a monitored customer'"'"'s network is performed using a test generation engine.

43. The method of claim 41, further comprising examining the customer'"'"'s network for configuration changes.

44. The method of claim 41, further comprising scheduling a test list of denatured attacks to perform on the customer'"'"'s network.

45. The method of claim 43, further comprising sending a schedule of the test list to each monitoring and evaluation agent coupled to customer'"'"'s equipment and to at least one test generation engines coupled to a service provider'"'"'s network.

46. The method of claim 41, further comprising originating passive tests of the customer'"'"'s network by a monitoring and evaluation agent.

47. The method of claim 41, further comprising sending results of tests performed on the customer'"'"'s network to a results and analysis engine.

48. The method of claim 47, further comprising analyzing, recording and reporting the results of the tests performed on the customer'"'"'s network.

49. The method of claim 41, further comprising monitoring the customer'"'"'s network for a non-denatured attack.

50. The method of claim 41, further comprising determining whether it is necessary to schedule the launching of the denatured attack.

51. The method of claim 50, further comprising scheduling the denatured attack if necessary.

52. The method of claim 51, further comprising generating the denatured attack.

53. The method of claim 41, wherein the denatured attack is performed by restructuring a harmful data packet into a data packet that closely resembles the harmful data packet with the harmful portions of the data packet rendered harmless.

54. The method of claim 41, further comprising adjusting the rate of launching of the denatured attack of the customer'"'"'s network.

55. The method of claim 51, further comprising adjusting the rate of generating the denatured attack of the customer'"'"'s network.

56. The method of claim 41, further comprising redirecting an attack from a targeted customer'"'"'s resource to a nearby agent.

57. The method of claim 41, further comprising reconfiguring at least a portion of the denatured attack as a harmless portion, the harmless portion having externally observable actions that mimic a harmful attack.

58. A computer-readable storage medium having computer executable instructions stored thereon which, when executed by a computer, cause the computer to:

launch a denatured attack over a communications network toward a monitored customer'"'"'s network by implementing a test library module to obtain data which defines how to launch the attack.

60. The computer-readable storage medium of claim 58, comprising further computer-readable instructions which, when executed by the computer, cause the computer to:

monitor of the customer'"'"'s network for a denatured or non-denatured attack.

59. A computer-readable storage medium having computer executable instructions stored thereon which, when executed by a computer, cause the computer to:

schedule a launch of a denatured attack over a communications network toward a monitored customer'"'"'s network.

61. A computer-readable storage medium executable on a computer having a computer program for the non-invasive monitoring of a customer'"'"'s electronic security services network, the program for performing having computer executable instructions stored thereon which, when executed by a computer, cause the computer to:

analyze results of a launch of a denatured attack over a communications network toward a monitored customer'"'"'s network.