Systems and methods for detecting a network sniffer

• US 8,087,083 B1
• Filed: 10/09/2002
• Issued: 12/27/2011
• Est. Priority Date: 01/04/2002
• Status: Active Grant

• Current Assignee: Palo Alto Networks Incorporated
• Original Assignee: Verizon Laboratories Incorporated (Verizon Communications Inc.)
• Inventors: Norris, Edward James
• Primary Examiner(s): ZIA, SYED
• Application Number:
  US10/267,629
• Time in Patent Office: 3,366 Days
• Field of Search: 726 22- 24
• US Class Current: 726/24
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1475 Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A device (110) records traffic in a communications network. The device (110) monitors traffic received by the device (110) and determines whether the received traffic is unexpected. The device (110) records the traffic when the traffic is determined to be unexpected.

Claims

1. A security system for aiding in detection of an intruder device running a network sniffer, the security system comprising:

a honeypot;

a honeypot traffic agent for transmitting faç

ade advertisement traffic over the network to the honeypot in an attempt to direct said intruder device to said honeypot;

the honeypot comprising;

a memory configured to store instructions; and

a processor configured to execute the instructions to;

receive the faç

ade advertisement traffic

from the honeypot traffic agent;

receive non-faç

ade traffic from the intruder device;

determine whether received traffic is the faç

ade

advertisement traffic or the non-faç

ade traffic;

ignore the received traffic if determined to be the

faç

ade advertisement traffic; and

record the received traffic if determined to be the

non-faç

ade traffic.

2. The security system of claim 1 wherein, when determining whether the received traffic is the faç

ade advertisement traffic or the non-faç

ade traffic, the processor is configured to;

determine a source of the received traffic.

3. The security system of claim 1 wherein, when determining whether the received traffic is the faç

ade advertisement traffic or the non-faç

ade traffic, the processor is configured to;

determine a time at which the received traffic is received.

4. The security system of claim 1 wherein, when determining whether the received traffic is the faç

ade advertisement traffic or the non-faç

ade traffic, the processor is configured to;

determine a content of the received traffic.

5. The security system of claim 1 wherein, when determining whether the received traffic is the faç

ade advertisement traffic or the non-faç

ade traffic, the processor is configured to;

determine that the received traffic is non-faç

ade when the source of the received traffic is not the honeypot traffic agent.

6. The security system of claim 1 wherein the processor is further configured to:

notify a network administrator when the received traffic is determined to be the non-faç

ade traffic.

7. The security system of claim 1 wherein the recorded traffic is subsequently used for intrusion analysis or for taking remedial action.

8. A method for detecting when a communications network has been compromised, the method comprising:

generating faç

ade traffic from a traffic generator, the faç

ade traffic being transmitted to a honeypot in an attempt to direct intruder devices running sniffers to said honeypot;

monitoring traffic received by the honeypot, the received traffic including non-faç

ade traffic;

determining whether the received traffic is the faç

ade traffic or the non-faç

ade traffic;

ignoring the received traffic if determined to be the faç

ade traffic; and

recording the received traffic when the received traffic is the non-faç

ade traffic.

9. The method of claim 8 wherein the determining includes:

determining a source of the received traffic.

10. The method of claim 8 wherein the determining includes:

determining a time at which the received traffic was received.

11. The method of claim 8 wherein the determining includes:

determining a content of the received traffic.

12. The method of claim 8 further comprising:

notifying a network administrator when the received traffic is non-faç

ade traffic.

13. The method of claim 8 further comprising:

subsequently using the recorded traffic for network compromise analysis or for taking remedial action.

14. The method of claim 12 wherein the notifying includes:

sounding an alarm.

15. A communications network including network devices that detect operation of a network sniffer, the communications network comprising:

at least one honeypot traffic agent device configured to;

generate faç

ade packets only, and

transmit the faç

ade packets to a honeypot device in an attempt to direct an intruder device running said network sniffer to said honeypot; and

said honeypot device configured to;

receive packets which may include at least one of the faç

ade packets,

determine whether the received packets include the one of the faç

ade packets,

ignore a received packet when the received packet is the one of the faç

ade packets, and

store a received packet when the received packet is not the one of the faç

ade packets.

16. The communications network of claim 15 wherein the honeypot device is further configured to:

alert a network administrator when the received packet is not one of the faç

ade packets.

17. The communications network of claim 15 wherein the at least one honeypot traffic agent device is configured to:

transmit the faç

ade packets at predetermined time intervals.

18. The communications network of claim 15 wherein each of the faç

ade packets includes authentication information.

19. The communications network of claim 15 wherein each of the faç

ade packets includes at least one user name and password combination.

20. The communications network of claim 15 wherein the stored packet is subsequently used for network sniffer analysis or for taking remedial action.

21. The communications network of claim 17 wherein the honeypot device is further configured to:

determine whether the received packet was received at one of the predetermined time intervals.