Methods and apparatus providing automatic signature generation and enforcement

• US 8,495,743 B2
• Filed: 05/01/2006
• Issued: 07/23/2013
• Est. Priority Date: 12/16/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Kraemer, Jeffrey A., Zawadowskiy, Andrew, Gladstone, Philip J. S.
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): LEE, JASON T
• Application Number:
  US11/414,909
• Publication Number:
  US 20070143847A1
• Time in Patent Office: 2,640 Days
• Field of Search: 726 22- 25, 713/200
• US Class Current: 726/25
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system inserts at least one notifying identifier in the computer system. The at least one notifying identifier provides execution information associated with the computer system. The system receives execution information from the at least one notifying identifier, the execution information identifies details associated with a traffic flow on the computer system. The system then generates a signature based on a deterministic link provided by the execution information provided by the at least one notifying identifier. The signature is utilized to prevent further damage caused to the computer system by at least one attack.

Claims

1. A method comprising:

inserting at least one notifying identifier in a computer system, the at least one notifying identifier providing execution information associated with the computer system;

receiving execution information from the at least one notifying identifier, the execution information identifying details associated with a traffic flow comprising a plurality of data payloads on the computer system; and

identifying a collection of sub strings from some of the plurality of data payloads on the at least one computer system;

assigning a probability to each of the sub strings within the collection of sub strings; and

associating the probability to a likelihood that a data payload associated with each of the sub strings is one of the group consisting of a good data payload and a bad data payload;

receiving notification that a policy violation has been triggered for at least one attack on the computer system;

in response to the notification, deterministically identifying, from the execution information provided by the at least one notifying identifier, a data payload that is associated with the at least one attack;

in response to deterministically identifying, from the execution information provided by the at least one notifying identifier, the data payload that is associated with the at least one attack, generating a signature that matches at least a first portion of the data payload;

refining the signature utilizing the traffic flow on the computer system to create an optimal signature by removing elements of the signature that are matched to good data payloads;

utilizing the optimal signature to filter out data processed by the computer system by preventing processing of a second data payload within the computer system;

wherein the method is performed by one or more computing devices.

2. The method of claim 1 wherein inserting at least one notifying identifier in the computer system, the at least one notifying identifier providing execution information associated with the computer system comprises:

utilizing the at least one notifying identifier to filter data processing on the computer system.

3. The method of claim 1 wherein inserting at least one notifying identifier in the computer system, the at least one notifying identifier providing execution information associated with the computer system comprises:

controlling a behavior of at least one application on the computer system by the insertion of the at least one notifying identifier in the computer system.

4. The method of claim 1 wherein receiving execution information from the at least one notifying identifier, the execution information identifying details associated with a traffic flow on the computer system comprises:

receiving execution information associated with the at least one attack that occurred on the computer system;

mapping the execution information associated with the at least one attack to at least one data entry point on the computer system; and

identifying that the at least one attack is specific to that at least one data entry point on the computer system.

5. The method of claim 1 wherein the signature exactly matches the data payload associated with the at least one attack.

6. The method of claim 1 wherein receiving the plurality of data payloads from at least one computer system to create an optimal signature that is operational on the at least one computer system comprises:

identifying a sequence of at least one sub string from the plurality of data payloads on the at least one computer system.

7. The method of claim 1 wherein identifying a collection of sub strings from some of the plurality of data payloads on the at least one computer system comprises:

identifying a common sub string from the plurality of data payloads on the at least one computer system.

8. The method of claim 1 wherein utilizing the signature to filter out data processed by the computer system by preventing processing of the second data payload within the computer system comprises:

after generating the signature;

receiving a new data payload on the computer system;

comparing the new data payload to the signature;

determining that the new data payload matches the signature; and

denying the new data payload access to the computer system based on the comparison of the new data payload to the signature.

9. A computerized device comprising:

a memory;

a processor;

a communications interface;

an interconnection mechanism coupling the memory, the processor and the communications interface;

wherein the memory is encoded with a signature generating application that when executed on the processor is capable of providing computer security on the computerized device by performing the operations of;

inserting at least one notifying identifier in a computer system, the at least one notifying identifier providing execution information associated with the computer system;

receiving execution information from the at least one notifying identifier, the execution information identifying details associated with a traffic flow comprising a plurality of data payloads on the computer system; and

identifying a collection of sub strings from some of the plurality of data payloads on the at least one computer system;

assigning a probability to each of the sub strings within the collection of sub strings; and

associating the probability to a likelihood that a data payload associated with each of the sub strings is one of the group consisting of a good data payload and a bad data payload;

receiving notification that a policy violation has been triggered for at least one attack on the computer system;

in response to the notification, deterministically identifying, from the execution information provided by the at least one notifying identifier, a data payload that is associated with the at least one attack;

in response to deterministically identifying, from the execution information provided by the at least one notifying identifier, the data payload that is associated with the at least one attack, generating a signature that matches at least a first portion of the data payload;

refining the signature utilizing the traffic flow on the computer system to create an optimal signature by removing elements of the signature that are matched to good data payloads;

utilizing the optimal signature to filter out data processed by the computer system by preventing processing of a second data payload within the computer system.

10. The computerized device of claim 9 wherein when the computerized device performs the operation of inserting at least one notifying identifier in the computer system, the at least one notifying identifier providing execution information associated with the computer system, the computerized device is capable of performing the operation of:

utilizing the at least one notifying identifier to filter data processing on the computer system.

11. The computerized device of claim 9 wherein when the computerized device performs the operation of receiving the plurality of data payloads from at least one computer system to create an optimal signature that is operational on the at least one computer system, the computerized device is capable of performing the operation of:

identifying an sequence of at least one sub string from the plurality of data payloads on the at least one computer system.

12. A non-transitory computer readable medium encoded with computer programming logic that when executed on a process in a computerized device provides computer security, the medium comprising:

instructions for inserting at least one notifying identifier in a computer system, the at least one notifying identifier providing execution information associated with the computer system;

instructions for receiving execution information from the at least one notifying identifier, the execution information identifying details associated with a traffic flow comprising a plurality of data payloads on the computer system;

instructions for identifying a collection of sub strings from some of the plurality of data payloads on the at least one computer system;

instructions for assigning a probability to each of the sub strings within the collection of sub strings; and

instructions for associating the probability to a likelihood that a data payload associated with each of the sub strings is one of the group consisting of a good data payload and a bad data payload;

instructions for receiving notification that a policy violation has been triggered for at least one attack on the computer system;

instructions for, in response to the notification, deterministically identifying, from the execution information provided by the at least one notifying identifier, a data payload that is associated with the at least one attack;

instructions for, in response to deterministically identifying, from the execution information provided by the at least one notifying identifier, a data payload that is associated with the at least one attack, generating a signature that matches at least a first portion of the data payload;

instructions for refining the signature utilizing the traffic flow on the computer system to create an optimal signature by removing elements of the signature that are matched to good data payloads;

instructions for utilizing the optimal signature to filter out data processed by the computer system by preventing processing of a second data payload within the computer system.

13. The non-transitory computer readable medium of claim 12 wherein the instructions for inserting at least one notifying identifier in the computer system, the at least one notifying identifier providing execution information associated with the computer system, comprise instructions for

utilizing the at least one notifying identifier to filter data processing on the computer system.

14. The non-transitory computer readable medium of claim 12 wherein the instructions for inserting at least one notifying identifier in the computer system, the at least one notifying identifier providing execution information associated with the computer system, comprise instructions for

controlling a behavior of at least one application on the computer system by the insertion of the at least one notifying identifier in the computer system.

15. The non-transitory computer readable medium of claim 12 wherein the instructions for receiving execution information from the at least one notifying identifier, the execution information identifying details associated with a traffic flow on the computer system, comprise instructions for:

receiving execution information associated with the at least one attack that occurred on the computer system;

mapping the execution information associated with the at least one attack to at least one data entry point on the computer system; and

identifying that the at least one attack is specific to that at least one data entry point on the computer system.

16. The non-transitory computer readable medium of claim 12 wherein the signature exactly matches the data payload associated with the at least one attack.

17. The non-transitory computer readable medium of claim 12 wherein the instructions for receiving the plurality of data payloads from at least one computer system to create an optimal signature that is operational on the at least one computer system, comprise instructions for

identifying a sequence of at least one sub string from the plurality of data payloads on the at least one computer system.

18. The non-transitory computer readable medium of claim 12 wherein the instructions for identifying a collection of sub strings from some of the plurality of data payloads on the at least one computer system comprise instructions for

identifying a common sub string from the plurality of data payloads on the at least one computer system.

19. The non-transitory computer readable medium of claim 12 comprising:

instructions for receiving a new data payload on the computer system;

instructions for comparing the new data payload to the signature; and

instructions for denying the new data payload access to the computer system based on the comparison of the data payload to the signature.