Correlating network information and intrusion information to find the entry point of an attack upon a protected computer

• US 7,845,004 B2
• Filed: 07/27/2001
• Issued: 11/30/2010
• Est. Priority Date: 07/27/2001
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Bardsley, Jeffrey Scott, Brock, Ashley Anderson, Lingafelt, Charles Steven, Kim, Nathaniel Wook
• Primary Examiner(s): Popham; Jeffrey D
• Application Number:
  US09/917,368
• Publication Number:
  US 20030023876A1
• Time in Patent Office: 3,413 Days
• Field of Search: 713200-201
• US Class Current: 726/22
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

A method for determining the entry point of an attack by a vandal such as a hacker upon a device such as a computer or a server such as a web server that operates under the protection of an intrusion detection system. Intrusion detection information regarding the attack and network information regarding the attack are correlated, and the entry point of the attack thereby deduced. In one embodiment, a source address of a message representative of the attack is found in a router table of a router that provides a connection supporting the attack. Logical ports of the connection are determined, and the corresponding physical ports found, thereby identifying the attack'"'"'s entry point into the protected device.

Claims

1. A computer-implemented method of identifying the entry point of an attack upon a device protected by an intrusion detection system, the method comprising the steps of;

obtaining intrusion information, from an intrusion detection system, regarding an attack upon a device protected by the intrusion detection system;

obtaining network information, from network equipment connected to the device, regarding the attack;

determining a logical entry point of the attack using a correlation engine to correlate the intrusion information and the network information; and

identifying a physical entry point associated with the logical entry point.

2. The computer-implemented method of claim 1, wherein the intrusion information includes an address.

3. The computer-implemented method of claim 2, wherein the address is a source address.

4. The computer-implemented method of claim 2, wherein the address is a destination address.

5. The computer-implemented method of claim 2, wherein the network information includes a logical port identifier of a logical port associated with the address.

6. The computer-implemented method of claim 5, wherein the step of determining a logical entry point includes the step of finding, in the network information, the logical port identifier of the logical port associated with the address.

7. The computer-implemented method of claim 5, wherein the step of identifying a physical entry point includes the step of identifying a physical port associated with the logical port.

8. The computer-implemented method of claim 1, wherein the network equipment includes a firewall with routing function.

9. The computer-implemented method of claim 1, wherein the network equipment includes a network dispatcher.

10. The computer-implemented method of claim 1, wherein the network equipment includes a load balancer.

11. The computer-implemented method of claim 1, wherein the intrusion detection system includes network based intrusion detection equipment.

12. The computer-implemented method of claim 1, wherein the intrusion detection system includes host based intrusion detection equipment.

13. The computer-implemented method of claim 1, wherein the intrusion detection system includes application based intrusion detection equipment.

14. A method of identifying the entry point of an attack upon a device protected by an intrusion detection system, said device one of a plurality of devices connected by a network, the method comprising the computer-implemented steps of:

detecting an attack on the device;

notifying a correlation engine of the attack on the device;

obtaining intrusion information regarding the attack;

obtaining network information regarding the attack;

using the correlation engine, correlating the intrusion information and the network information to produce correlation information;

using the correlation information, finding on the network a logical port of connection used by the attack; and

mapping the logical port on the network to a physical port on the network using the correlation engine.

15. The method of claim 14 comprising the further step of:

alerting a network manager to the location of the logical port and of the physical port.

16. The method of claim 14 wherein the step of mapping is performed using the correlation engine.

17. The method of claim 14 wherein:

the intrusion information includes an address; and

the network information includes a logical port identifier of a logical port associated with the address.

18. An apparatus for detecting a point of an attack on a network, the apparatus comprising:

network equipment for connecting a protected device to a network;

an intrusion detection system comprising intrusion detection equipment;

a correlation engine adapted to;

receive a notification of an attack on the protected device;

receive intrusion information regarding the attack;

receive network information regarding the attack, wherein the network information pertains to the network;

correlate the intrusion information and the network information to produce correlation information;

use the correlation information to find on the network a logical port of connection used by the attack; and

map the logical port on the network to a physical port on the network using the correlation engine.

19. The apparatus of claim 18 further comprising:

means for alerting a network manager to the location of the logical port and of the physical port.

20. The apparatus of claim 18 wherein:

the intrusion information includes an address; and

the network information includes a logical port identifier of a logical port associated with the address.