Circumstantial blocking of incoming network traffic containing code

• US 8,271,774 B1
• Filed: 08/11/2003
• Issued: 09/18/2012
• Est. Priority Date: 08/11/2003
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Nachenberg, Carey, McCorkendale, Bruce
• Primary Examiner(s): Gee, Jason
• Application Number:
  US10/639,158
• Time in Patent Office: 3,326 Days
• Field of Search: 726/11, 713/150, 713/154
• US Class Current: 713/150
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

An incoming network traffic manager circumstantially blocks incoming network traffic (103) containing code (107). The incoming network traffic manager (101) monitors (201) incoming network traffic (103) addressed to a target computer (105). The network traffic manager (101) detects (203) incoming network traffic (103) containing code (107). The network manager (101) blocks (205) incoming traffic (103) containing code (107) from reaching the target computer (105), responsive to circumstances being such that it is undesirable to allow incoming traffic (103) containing code (107) to reach the target computer (105).

Claims

1. A computer-implemented method for circumstantially blocking incoming network traffic containing code, the method comprising the steps of:

monitoring incoming network traffic of a protocol and being addressed to a target computer, the protocol comprising a transmission protocol, and the incoming network traffic being transmitted using the transmission protocol;

detecting incoming network traffic containing code; and

blocking incoming network traffic containing code from reaching the target computer, responsive to the incoming network traffic being traffic that should never contain code according to the protocol.

2. The method of claim 1 wherein the step of blocking incoming network traffic containing code from reaching the target computer further comprises:

blocking incoming network traffic containing code from reaching the target computer, responsive to a high alert state indicating a likelihood of a network based attack.

3. The method of claim 2 further comprising:

automatically detecting a condition indicating a likelihood of a network based attack; and

responsive to the detection, triggering a high alert state indicating a likelihood of a network based attack.

4. The method of claim 2 further comprising:

receiving a notification of a high alert state indicating a likelihood of a network based attack.

5. The method of claim 1 wherein the step of blocking incoming network traffic containing code from reaching the target computer further comprises:

blocking incoming network traffic containing code from reaching the target computer, responsive to the incoming network traffic originating from a source from which code should never be transmitted.

6. The method of claim 1 wherein the step of blocking incoming network traffic containing code from reaching the target computer further comprises:

blocking incoming network traffic containing code from reaching the target computer, responsive to the incoming network traffic being transmitted across a network path across which code should never be transmitted.

7. The method of claim 1 wherein the step of blocking incoming network traffic containing code from reaching the target computer responsive to the incoming network traffic being traffic that should never contain code according to the protocol further comprises:

blocking incoming network traffic containing code from reaching the target computer, responsive to the incoming network traffic being a type that should never contain code according to the protocol.

8. The method of claim 1 wherein the step of blocking incoming network traffic containing code from reaching the target computer further comprises:

blocking incoming network traffic containing code from reaching the target computer, responsive to the incoming network traffic not conforming to a statistical profile indicating under what circumstances code is permitted to be transmitted to the target computer.

9. The method of claim 8 wherein the step of blocking incoming network traffic containing code from reaching the target computer, responsive to the incoming network traffic not conforming to a statistical profile indicating under what circumstances code is permitted to be transmitted to the target computer further comprises:

blocking incoming network traffic containing code from reaching the target computer, responsive to the incoming network traffic having one or more characteristics from a list of characteristics consisting of;

being transmitted at a time at which code is not to be transmitted;

being transmitted via a port via which code is not to be transmitted;

being transmitted at a frequency at which code is not to be transmitted;

being transmitted in a protocol state that should never contain code;

being transmitted to an address to which code is not to be transmitted; and

being transmitted from an address from which code is not to be transmitted.

10. The method of claim 8 further comprising:

allowing incoming network traffic to reach the target computer during a specified period of time;

creating the statistical profile based upon circumstances under which the incoming network traffic during the period of time contains code.

11. The method of claim 1 wherein the step of monitoring incoming network traffic of a protocol and being addressed to the target computer further comprises:

scanning a stream.

12. The method of claim 1 wherein the step of monitoring incoming network traffic of a protocol and being addressed to the target computer further comprises:

analyzing packets.

13. The method of claim 1 wherein the steps are performed by an incoming network traffic manager which is incorporated into at least one of the following:

a firewall;

an intrusion detection system;

an intrusion detection system application proxy;

a router;

a switch;

a stand alone proxy;

a server;

a gateway;

a client.

22. The method of claim 1 wherein the step of blocking incoming network traffic containing code from reaching the target computer responsive to the incoming network traffic being traffic that should never contain code according to the protocol further comprises:

blocking incoming network traffic containing code from reaching the target computer, responsive to the incoming network traffic being in a state which should never contain code according to the protocol.

24. The method of claim 1, wherein the protocol comprises a content protocol, and content of the incoming network traffic should comply with the content protocol.

14. A non-transitory computer readable storage medium containing an executable computer program product for circumstantially blocking incoming network traffic containing code, the computer program product comprising:

program code for monitoring incoming network traffic of a protocol and being addressed to a target computer, the protocol comprising a transmission protocol, and the incoming network traffic being transmitted using the transmission protocol;

program code for detecting incoming network traffic containing code; and

program code for blocking incoming network traffic containing code from reaching the target computer, responsive to the incoming network traffic being traffic that should never contain code according to the protocol.

15. The non-transitory computer readable storage medium of claim 14 further comprising:

program code for blocking incoming network traffic containing code from reaching the target computer, responsive to a high alert state indicating a likelihood of a network based attack.

16. The non-transitory computer readable storage medium of claim 14 further comprising:

program code for blocking incoming network traffic containing code from reaching the target computer, responsive to the incoming network traffic originating from a source from which code should never be transmitted.

17. The non-transitory computer readable storage medium of claim 14 further comprising:

program code for blocking incoming network traffic containing code from reaching the target computer, responsive to the incoming network traffic being transmitted across a network path across which code should never be transmitted.

18. The non-transitory computer readable storage medium of claim 14 further comprising:

program code for blocking incoming network traffic containing code from reaching the target computer, responsive to the incoming network traffic being a type that should never contain code.

19. The non-transitory computer readable storage medium of claim 14 further comprising:

program code for blocking incoming network traffic containing code from reaching the target computer, responsive to the incoming network traffic not conforming to a statistical profile indicating under what circumstances code is permitted to be transmitted to the target computer.

23. The computer program product of claim 14 further comprising:

program code for blocking incoming network traffic containing code from reaching the target computer, responsive to the incoming network traffic being in a state which should never contain code according to the protocol.

25. The computer readable medium of claim 14, wherein the protocol comprises a content protocol, and content of the incoming network traffic should comply with the content protocol.

20. A computer system for circumstantially blocking incoming network traffic containing code, the computer system comprising:

a computer processor for executing computer program code; and

a computer-readable storage medium storing executable computer program code comprising;

a network traffic monitoring module configured to monitor incoming network traffic of a protocol and being addressed to a target computer, the protocol comprising a transmission protocol, and the incoming network traffic being transmitted using the transmission protocol;

a code detection module, configured to detect incoming network traffic containing code, the code detection module being communicatively coupled to the network traffic monitoring module; and

a code blocking module, configured to block incoming network traffic containing code from reaching the target computer, responsive to the incoming network traffic being traffic that should never contain code according to the protocol, the code blocking module being communicatively coupled to the code detection module.

21. The computer system of claim 20 wherein:

the network traffic monitoring module, the code detection module and the code blocking module are communicatively coupled to at least one of the following;

a firewall;

an intrusion detection system;

an intrusion detection system application proxy;

a router;

a switch;

a stand alone proxy;

a server;

a gateway;

a client.

26. The computer system of claim 20, wherein the protocol comprises a content protocol, and content of the incoming network traffic should comply with the content protocol.