System and method for reducing the vulnerability of a computer network to virus threats

• US 7,571,483 B1
• Filed: 08/25/2005
• Issued: 08/04/2009
• Est. Priority Date: 08/25/2005
• Status: Active Grant

• Current Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Original Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: Blair, Stephen M. Jr., Bascle, Jeff P., Quest, Jason J., Mahaffey, Paul David Jr.
• Primary Examiner(s): Cervetti; David Garcia
• Application Number:
  US11/211,867
• Time in Patent Office: 1,440 Days
• Field of Search: 726/22, 726/24
• US Class Current: 726/24
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A method for reducing vulnerability of a computer network to a detected virus threat includes receiving an identifier of a network device detected as a source of virus activity. The method also includes relating the identifier to a predetermined account of the detected device and then automatically disabling the device account. Accordingly, the detected device is isolated from the network to prevent infection of the network by the detected device.

Claims

1. A method for reducing vulnerability of a computer network to a detected virus threat from both a network device detected as a source of virus activity and a user of the detected device, the method comprising the steps of:

receiving an identifier of a network device detected as a source of virus activity from a network monitor monitoring a network of devices for activity indicative of a virus;

relating the identifier to a predetermined account of the detected device;

automatically disabling the device account, thereby isolating the detected device from the network to prevent infection of the network by the detected device;

identifying, by a pre-assigned user account, a user of the detected devices during virus activity; and

disabling the user account, thereby preventing the identified user from accessing the network, via another network device.

2. The method of claim 1, wherein disabling the user account comprises changing the identified user'"'"'s password for logging on to the network.

3. The method of claim 1, wherein automatically identifying the user of the detected device comprises querying the detected device to determine users logged on to the device during the activity.

4. The method of claim 3, wherein the identifier comprises a network address of the detected device, the address being useable in querying the device.

5. The method of claim 1, further comprising automatically reporting the identified user'"'"'s account to an account manager of the network.

6. The method of claim 1, further comprising automatically retrieving from a storage device predetermined contact information relating to the identified user.

7. The method of claim 6, further comprising automatically providing an alert to a system manager, using the retrieved contact information, to identify the user of the detected device.

8. The method of claim 7, further comprising automatically adding the identified user to a virus watch list accessible by system managers of the network.

9. A computer system having a processor, a memory, and an operating environment, the computer system operable to execute the method recited in claim 1.

10. A computer-readable medium having computer-executable instructions for performing the method recited in claim 1.

11. A computer program product comprising software recorded on a computer readable medium and operational on a computer for reducing a vulnerability of a computer network to a detected virus threat from both a network device detected as a source of virus activity and a user of the detected device, said operation comprising:

receiving an identifier of a network device connected to the network and identified as a source of virus activity from a network monitor monitoring a network of devices for activity indicative of a virus;

relating the identifier to a predetermined account of the detected device;

automatically disabling the device account, thereby isolating the detected device from the network to prevent infection of the network by the detected device;

automatically identifying by a pre-assigned user account, a user of the detected device during virus activity; and

disabling the user account, thereby preventing the identified user from accessing the network.

12. A system for reducing a vulnerability of devices of a computer network to a detected virus threat from both a network device detected as a source of virus activity and a user of the detected device, the system comprising:

at least one server, capable of communicating with the devices and accessing a database, and

computer software resident on the server and operational for receiving an identifier of a network device detected as a source of virus activity from a network monitor monitoring a network of devices for activity indicative of a virus, for relating the identifier to a predetermined account of the detected device, and for automatically disabling the device account, thereby isolating the detected device from the network to prevent infection of the network by the detected device;

automatically identifying, by a pre-assigned user account, a user of the detected device during virus activity, and automatically disabling the user account, thereby preventing the identified user from accessing the network.

13. In a networked client-server computing environment having a server computer with executable software and a database containing network system management data, a method for reducing vulnerability of the networked environment to detected virus threats from both a network device detected as a source of virus activity and a user of the detected device, comprising the steps of:

receiving an identifier of a network device detected as a source of virus activity from a network monitor monitoring a network of devices for activity indicative of a virus;

relating the identifier to a predetermined account of the detected device;

automatically disabling the device account, thereby isolating the detected device from the network to prevent infection of the network by the detected device;

automatically identifying by a pre-assigned user account, a user of the detected device during virus activity; and

disabling the user account, thereby preventing the identified user from accessing the network.