Device for and method of computer intrusion anticipation, detection, and remediation

• US 8,898,784 B1
• Filed: 05/29/2013
• Issued: 11/25/2014
• Est. Priority Date: 05/29/2013
• Status: Active Grant

• Current Assignee: The United States of America As Represented By The Director National Security Agency
• Original Assignee: The United States of America As Represented By The Director National Security Agency
• Inventors: Grossman, Robert L., Alexander, Keith B., Dowd, Patrick W.
• Primary Examiner(s): SHOLEMAN, ABU S
• Application Number:
  US13/573,931
• Time in Patent Office: 545 Days
• Field of Search: 726/2, 726/23, 726/25, 726/26, 726/24, 726/27, 713/13, 713/15, 713/23, 709/232, 709/228, 709/238, 370/401, 370/229, 370/218
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Electronic network security by establishing a network topology, including multiple devices, where the network includes a command and control layer and a transport layer, where the command and control layer is changeable by the transport layer and vice versa. All phases of an intrusion attempt are monitored to anticipate an intrusion, prevent an intrusion, and remedy a successful intrusion. An assessment of the threat is made in multiple dimensions. The topology of the network may be changed in accordance with the threat assessment. In addition, computer traffic in the network and from the intrusion source may be modified or stopped to guard against an intrusion, prevent an intrusion, and remedy a successful intrusion. The command and control layer is changeable by the transport layer and vice versa.

Claims

1. An electronic network, comprising:

a) an electronic hardware network in a user-definable topology, where the electronic network includes multiple devices, where the electronic network includes a command and control layer for controlling the electronic network, where the electronic network includes a transport layer for transporting electronic messages to and from the electronic network, and where the command and control layer is changeable by the transport layer and vice versa;

b) a user-definable number of electronic hardware sensors for collecting computer traffic associated with phases of intrusion activity, where the phases are selected from the group of phases consisting of survey phase, reconnaissance phase, actual intrusion attempt phase, operating malware phase, maintenance phase and any combination of survey, reconnaissance, actual intrusion attempt, operating malware and maintenance phases;

c) a threat-assessment function block embodied in a computing device and connected to the user-definable sensors and producing an assessment of the threat to the electronic network by analyzing information collected by the sensors in user-definable combinations and permutations over a user-definable number of dimensions selected from the group of dimensions consisting of time, space, intrusion choreography, type of intrusion actor, number of intrusion actors, and any combination of time, space, intrusion choreography, type of intrusion actor and number of intrusion actors; and

d) a response function block embodied in a computing device and connected to the threat-assessment block for responding to the threat assessed by the threat-assessment function block, where the response is selected from the group of responses consisting of leaving the topology of the network unchanged, changing the topology of the network to a degree commensurate with the level of perceived threat assessed, modifying the computer traffic associated with an intrusion attempt, modifying the computer traffic associated with functioning malware, stopping computer traffic associated with an intrusion attempt within the network, stopping computer traffic associated with an intrusion attempt at a source of the computer traffic associated with the intrusion attempt, and any combination of leaving the topology of the network unchanged, changing the topology of the network to a degree commensurate with the level of perceived threat assessed, modifying the computer traffic associated with an intrusion attempt, modifying the computer traffic associated with functioning malware, stopping computer traffic associated with an intrusion attempt within the network and stopping computer traffic associated with an intrusion attempt at a source of the computer traffic associated with the intrusion attempt.

2. The electronic network of claim 1, wherein the electronic network is comprised of an electronic network selected from the group of electronic networks consisting of a hardware network, a software-defined network, a virtual-machine network, a mobile network, and a distributed network.

3. The electronic network of claim 1, wherein the electronic network includes devices selected from the group of devices consisting of workstations, laptop computers, tablet computers, mobile computing devices, servers, routers, and sensors.

4. The electronic network of claim 2, wherein the electronic network includes devices selected from the group of devices consisting of workstations, laptop computers, tablet computers, mobile computing devices, servers, routers, and sensors.

5. A method of electronic network security, comprising the steps of:

a) establishing a topology in an electronic network, where the electronic network includes multiple devices, where the electronic network includes a command and control layer for controlling the network, where the electronic network includes a transport layer for transporting electronic messages to and from the electronic network, and where the command and control layer is changeable by the transport layer and vice versa;

b) monitoring computer traffic to collect information associated with intrusion phases, where the intrusion phases are selected from the group of intrusion phases consisting of survey phase, reconnaissance phase, actual intrusion attempt phase, malware operation phase, and maintenance phase;

c) generating an assessment of the threat to the electronic network by analyzing information collected in step (b) in user-definable combinations and permutations over user-definable dimensions selected from the group of dimensions consisting of time, space, intrusion choreography, type of intrusion actor, number of intrusion actors, and any combination of time, space, intrusion choreography, type of intrusion actor and number of intrusion actors; and

d) responding to the threat assessed in step (c), where the response is selected from the group of responses consisting of leaving the topology of the network unchanged, changing the topology of the network to a degree commensurate with the threat assessment, modifying the computer traffic associated with an intrusion attempt, modifying the computer traffic associated with functioning malware, stopping computer traffic associated with an intrusion attempt within the network, stopping computer traffic associated with an intrusion attempt at a source of the computer traffic associated with the intrusion attempt, and any combination of leaving the topology of the network unchanged, changing the topology of the network to a degree commensurate with the threat assessment, modifying the computer traffic associated with an intrusion attempt, modifying the computer traffic associated with functioning malware, stopping computer traffic associated with an intrusion attempt within the network and stopping computer traffic associated with an intrusion attempt at a source of the computer traffic associated with the intrusion attempt.

6. The method of claim 5, wherein the step of establishing a topology in an electronic network is comprised of establishing a topology in an electronic network, where the electronic network is selected from the group of electronic networks consisting of a hardware network, a software-defined network, a virtual machine network, a mobile network, and a distributed network.

7. The method of claim 5, wherein the step of establishing a topology in an electronic network is comprised of establishing a topology in an electronic network, where the electronic network includes devices selected from the group of devices consisting of workstations, laptop computers, tablet computers, mobile computing devices, servers, routers, and sensors.

8. The method of claim 5, wherein said step of responding to the threat assessed in step (c) is further comprised of changing the command and control layer by the transport layer.

9. The method of claim 5, wherein said step of responding to the threat assessed in step (c) is further comprised of changing the transport layer by the command and control layer.

10. The method of claim 6, wherein the step of establishing a topology in an electronic network is comprised of establishing a topology in an electronic network, where the electronic network includes devices selected from the group of devices consisting of workstations, laptop computers, tablet computers, mobile computing devices, servers, routers, and sensors.

11. The method of claim 10, wherein said step of responding to the threat assessed in step (c) is further comprised of changing the command and control layer by the transport layer.

12. The method of claim 11, wherein said step of responding to the threat assessed in step (c) is further comprised of changing the transport layer by the command and control layer.