Method and apparatus for protecting networks from unauthorized applications

• US 8,230,513 B2
• Filed: 06/27/2011
• Issued: 07/24/2012
• Est. Priority Date: 03/27/2006
• Status: Active Grant

• Current Assignee: Avaya Incorporated
• Original Assignee: Avaya Incorporated
• Inventors: Felske, Kent, Montuno, Delfin, Ouellette, Michel, Chen, Wenfeng
• Primary Examiner(s): Pich, Ponnoreay
• Application Number:
  US13/169,627
• Publication Number:
  US 20110320596A1
• Time in Patent Office: 393 Days
• Field of Search: 726/25, 709223-225
• US Class Current: 726/25
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/1085 involving dynamic management of active down- or uploading connections

Abstract

A traffic controller is provided which integrates black-box tests of unauthorized applications to extract application characteristics from associated Internet traffic, exploits the networking information learned by host clients, actively scans and controls hosts on the corporate network, and dynamically configures a corporate firewall to block traffic to and from critical application network elements. As a result, the traffic controller effectively manages unauthorized applications and their associated traffic in a corporate environment.

Claims

1. An apparatus for controlling application traffic in a computer network includes:

a client device including physical processing hardware and logic for modeling the operation of a potential unauthorized application;

a traffic controller including a traffic analyzer, coupled to the client device and operable to monitor traffic associated with the potential unauthorized application to extract application configuration information including addresses of devices communicating with the potential unauthorized application and resources accessed by the potential unauthorized application; and

wherein the application configuration information is used to generate rules for selectively blocking the communications associated with the application activities.

2. The apparatus of claim 1, wherein the client device includes a physical computer readable storage device for storing the potential unauthorized application, the client device for executing the potential unauthorized application.

3. The apparatus of claim 1, wherein the traffic controller further comprises a configuration collector comprising:

means for scanning one or more coupled hosts in the computer network to determine whether a version of the potential unauthorized application is executing on the one or more coupled hosts; and

means for collecting application configuration information from other hosts in the computer network determined to be executing versions of the potential unauthorized application.

4. The apparatus of claim 3, further including means for limiting the execution of the versions of the unauthorized application by the one or more hosts.

5. The apparatus of claim 4, wherein the means for limiting the execution of the versions of the potential unauthorized application includes means for forwarding a daemon to a host determined to be executing at least one of the versions, which is a peer-to-peer application, to terminate operation of the potential unauthorized application.

6. The apparatus of claim 5, wherein the means for collecting application configuration information from the other hosts includes means for flushing respective caches of the other hosts.

7. The apparatus of claim 1 further including a traffic tap, coupled to the traffic analyzer, the client device and an external firewall, for forwarding inbound traffic destined for the client device to the traffic analyzer and for filtering outbound traffic from the client device to assist in application configuration information collection.

8. The apparatus of claim 7, wherein the traffic analyzer further comprises:

means, responsive to the application configuration information, for configuring the external firewall.

9. The apparatus of claim 1 embodied in a firewall device of an enterprise network.

10. The apparatus of claim 9, wherein the enterprise network is a distributed multi-site enterprise network, and wherein the firewall device is provided at least one site of the distributed multi-site enterprise network.