Methods, systems and devices for the detection and prevention of malware within a network

• US 8,726,376 B2
• Filed: 06/14/2011
• Issued: 05/13/2014
• Est. Priority Date: 03/11/2011
• Status: Active Grant

• Current Assignee: Openet Telecom Limited (Amdocs Ltd.)
• Original Assignee: Openet Telecom Limited (Amdocs Ltd.)
• Inventors: Rieschick, Gary, Dunne, Cameron Ross, McNamee, Alan, Hogan, Joe
• Primary Examiner(s): Khoshnoodi, Nadia
• Application Number:
  US13/159,710
• Publication Number:
  US 20120233656A1
• Time in Patent Office: 1,064 Days
• Field of Search: None
• US Class Current: 726/22
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 88/16 Gateway arrangements

Abstract

Methods, systems and devices examine data flows in a communication system control network for known malware threats and suspicious properties typically associated with malware threats. A policy management system inside the control network accesses a user repository and a charging network, and performs pattern matching and/or observed behavior detection methods to determine if the data flows carry content (e.g., malware) that poses a security risk to network or wireless devices. The policy management system generates policy rules based on user preferences and risk-level. The policy management system sends the generated policy rules to a gateway/PCEF, which blocks the data flows, allows the data flows, or restricts the data flow based on the policy rules.

Claims

1. A communication method, comprising:

receiving in a server outside of a first and a second telecommunication network from one or more communication system control network components in the first telecommunication network data flow parameters identifying characteristics of a first data flow;

performing in the server a detection method to determine whether the first data flow carries malicious content;

sending security information generated from the performance of the detection method to a policy server in the second telecommunication network;

receiving the security information in the policy server;

querying a charging system to receive charging information related to a second data flow in the policy server;

determining in the policy server whether the second data flow carries malicious content based on the security information received from the server and the charging information received from the charging system;

generating in the policy server restrictive policy rules in response to determining from the security information received from the server and the charging information received from the charging system that the second data flow carries malicious content;

generating in the policy server non-restrictive policy rules in response to determining from the security information received from the server and the charging information received from the charging system that the second data flow does not carry malicious content; and

pushing the generated policy rules to a communication system gateway configured to control the second data flow between a wireless device and an external network.

2. The method of claim 1, wherein generating in the policy server restrictive policy rules in response to determining from the security information received from the server and the charging information received from the charging system that the second data flow carries malicious content comprises:

generating restrictive policy rules based on a subscriber'"'"'s usage history and a subscription level.

3. The method of claim 1, wherein generating in the policy server restrictive policy rules in response to determining from the security information received from the server and the charging information received from the charging system that the second data flow carries malicious content comprises:

generating constraints that are proportional to a threat-level associated with the malicious content; and

generating restrictive policy rules that impose the generated constraints on the communication system gateway.

4. The method of claim 1, further comprising transmitting malware detection feedback to a network component in a second external network.

5. The method of claim 1, further comprising interacting with a wireless device user to determine user preferences in real-time via alert messages sent through a notification server to receive user preference parameters.

6. The method of claim 1, wherein the second data flow originates from the wireless device, and generating in the policy server restrictive policy rules in response to determining from the security information received from the server and the charging information received from the charging system that the data flow carries malicious content comprises:

generating restrictive policy rules that instruct the communication system gateway to block future data flows originating from the wireless device.

7. The method of claim 1, wherein performing in the server a detection method to determine whether the first data flow carries malicious content comprises performing in the server a pattern matching detection method.

8. The method of claim 7, wherein:

receiving in the server data flow parameters identifying characteristics of the first data flow comprises receiving parameters identifying binary-file characteristic information; and

performing in the server the pattern matching detection method comprises comparing the identified binary-file characteristic information with a binary-file characteristic of a known malware type to determine whether the first data flow carries content having binary-file characteristics of known malware.

9. The method of claim 7, wherein:

receiving in the server data flow parameters identifying characteristics of the first data flow comprises receiving parameters identifying source and destination information; and

performing in the server the pattern matching detection method comprises comparing the identified source and destination information against a list of known offender sources and destinations to determine whether the first data flow originates from a wireless device known to engage in malicious activity and whether the first data flow is destined for a website/server known to engage in malicious activities.

10. The method of claim 7, wherein:

receiving in the server data flow parameters identifying characteristics of the first data flow comprises receiving parameters identifying destination information; and

performing in the server the pattern matching detection method comprises comparing the identified destination information against a list of destinations known to be under attack to determine whether a destination of the first data flow is a network server under attack.

11. The method of claim 7, wherein:

receiving in the server data flow parameters identifying characteristics of the first data flow comprises receiving parameters identifying messaging information; and

performing in the server the pattern matching detection method comprises comparing the identified messaging information with spam heuristics.

12. The method of claim 1, wherein performing in the server the detection method to determine whether the first data flow carries malicious content comprises performing a behavior oriented detection method.

13. The method of claim 12, wherein performing the behavior oriented detection method comprises accessing information stored in a user repository of a control network.

14. The method of claim 12, wherein performing the behavior oriented detection method comprises accessing information stored in a second charging system.

15. The method of claim 12, wherein performing the behavior oriented detection method comprises updating a counter value to monitor a number of data flows matching a specific behavior.

16. The method of claim 12, wherein performing the behavior oriented detection method comprises performing monitoring operations in order to detect an unexpected rise in a number of requests matching a defined behavior from a specific wireless device.

17. A system, comprising:

a server outside of a first telecommunication network and a second telecommunication network;

a communication system control network component inside the first telecommunication network; and

a policy server in the second telecommunication network, wherein;

the server comprises;

a server memory; and

a server processor coupled to the server memory, wherein the server processor is configured with processor-executable instructions to perform operations comprising;

receiving data flow parameters identifying characteristics of a first data flow from the communication system control network component;

performing a detection method to determine whether the first data flow carries malicious content; and

sending security information generated from the performance of the detection method to the policy server, and

the policy server comprises a processor configured with processor-executable instruction to perform operations comprising;

receiving the security information;

querying a charging system to receive charging information related to a second data flow;

determining whether the second data flow carries malicious content based on the security information received from the server and the charging information received from the charging system;

generating restrictive policy rules in response to determining from the security information received from the server and the charging information received from the charging system that the second data flow carries malicious content;

generating non-restrictive policy rules in response to determining from the security information received from the server and the charging information received from the charging system that the second data flow does not carry malicious content; and

pushing the generated policy rules to a communication system gateway configured to control the second data flow between a wireless device and an external network.

18. The system of claim 17, wherein the processor of the policy server is configured with processor-executable instructions to perform operations further comprising:

transmitting malware detection feedback to the server.