Identifying source of malicious network messages

• US 9,191,396 B2
• Filed: 09/08/2005
• Issued: 11/17/2015
• Est. Priority Date: 09/08/2005
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated (Kyndryl Holdings, Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Nesbitt, Richard E., O'Connell, Brian M., Pearthree, Herbert D., Vaughan, Kevin E.
• Primary Examiner(s): SCHMIDT, KARI L
• Application Number:
  US11/221,619
• Publication Number:
  US 20070064697A1
• Time in Patent Office: 3,722 Days
• Field of Search: 726/22, 726/23, 726/25, 713/181, 370/229, 370/254, 370/352, 370/392, 709/229, 709/238, 709/239
• US Class Current: 1/1
• CPC Class Codes: H04L 2101/668 Internet protocol [IP] address subnets
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 2463/146 Tracing the source of attacks
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks

Abstract

System, method and program for identifying a subset of a multiplicity of source networks. The subset including one or more source networks which have sent messages to one of a plurality of destination locations having a same IP address. For each of the multiplicity of source networks, a determination is made whether there are fewer intervening hops from the source network to the one destination location than from the source network to other of the plurality of destination locations. If so, the source network is included in the subset. If not, the source network is not included in the subset. One application of the present invention is to identify a source of a denial of service attack. After the subset is identified, filters can be sequentially applied to block messages from respective source networks in the subset to determine which source network in the subset is sending the messages.

Claims

1. A method for identifying source of malicious network messages, said method comprising steps implemented by a computer of:

identifying a subset of a multiplicity of source networks, said subset including one or more source networks which have sent messages to one of a plurality of destination locations having a same Internet Protocol (IP) address, wherein identifying said subset comprises;

the computer determining for each of said multiplicity of source networks whether there are fewer intervening hops from said each source network to said one destination location than from said each source network to other of said plurality of destination locations;

responsive to a determination that there are fewer intervening hops for said each source network of said multiplicity of source networks, the computer identifying said each source network as included in said subset, and

responsive to determining there are not fewer intervening hops for said each source network of said multiplicity of source networks, the computer not identifying said each source network as included in said subset;

wherein one or more source networks are continuing to send messages to said one destination location, and further comprising a step of sequentially applying filters to block messages from respective source networks in said subset to determine which source network in said subset is sending said messages, wherein one of said source networks in said subset has sent said messages to said one destination location and said messages are malicious.

2. A method as set forth in claim 1 wherein said one destination location has received many messages from a source network in said subset as part of a denial of service attack.

3. A method as set forth in claim 1 wherein the determining step comprises the step of:

collecting from routers information indicating a routing path from each of said multiplicity of source networks to each of said plurality of destination locations.

4. A method as set forth in claim 3 wherein the determining step further comprises the step of:

determining from said router paths a number of hops from each of said multiplicity of source networks to each of said plurality of destination locations.

5. A system for identifying source of malicious network messages, said system comprising:

a CPU, a computer readable memory and a computer readable storage media;

program instructions to identify a subset of a multiplicity of source networks, said subset including one or more source networks which have sent messages to one of a plurality of destination locations having a same Internet Protocol (IP) address, wherein said program instructions to identify said subset comprises;

first program instructions to determine for each of said multiplicity of source networks whether there are fewer intervening hops from said each source network to said one destination location than from said each source network to other of said plurality of destination locations; and

second program instructions, responsive to a determination that there are fewer intervening hops from said each source network to said one destination location than from said each source network to other of said plurality of destination locations, to identify said each source network as included in said subset, and responsive to a determination that there are not fewer intervening hops from said each source network to said one destination location than from said each source network to other of said plurality of destination locations, for not identifying said each source network as included in said subset;

wherein one or more source networks are continuing to send messages to said one destination location, and further comprising program instructions to sequentially apply filters to block messages from respective source networks in said subset to determine which source network in said subset is sending said messages, wherein one of said source networks in said subset has sent said messages to said one destination location and said messages are malicious; and

wherein

all of the program instructions are stored on the computer readable storage media for execution by the CPU via the computer readable memory.

6. A system as set forth in claim 5 wherein said one destination location has received many messages from a source network in said subset as part of a denial of service attack.

7. A system as set forth in claim 5 wherein the determining means comprises:

means for collecting from routers information indicating a routing path from each of said multiplicity of source networks to each of said plurality of destination locations.

8. A system as set forth in claim 7 wherein the determining means further comprises:

means for determining from said router paths a number of hops from each of said multiplicity of source networks to each of said plurality of destination locations.

9. A computer program product for source of malicious network messages, said computer program product comprising:

a non-transitory computer readable storage medium;

program instructions to identify a subset of a multiplicity of source networks, said subset including one or more source networks which have sent messages to one of a plurality of destination locations having a same Internet Protocol (IP) address, wherein said program instructions to identify said subset comprises;

first program instructions to determine for each of said multiplicity of source networks whether there are fewer intervening hops from said each source network to said one destination location than from said each source network to other of said plurality of destination locations; and

second program instructions, responsive to a determination that there are fewer intervening hops from said each source network to said one destination location than from said each source network to other of said plurality of destination locations, to identify said each source network as included in said subset, and responsive to a determination that there are not fewer intervening hops from said each source network to said one destination location than from said each source network to other of said plurality of destination locations, to not identify said each source network as included in said subset;

wherein one or more source networks are continuing to send messages to said one destination location, and further comprising program instructions to sequentially apply filters to block messages from respective source networks in said subset to determine which source network in said subset is sending said messages, wherein one of said source networks in said subset has sent said messages to said one destination location and said messages are malicious; and

wherein

all of said program instructions are stored on said non-transitory computer readable storage medium.

10. A computer program product as set forth in claim 9 wherein said one destination location has received many messages from a source network in said subset as part of a denial of service attack.

11. A computer program product as set forth in claim 9 wherein the first program instructions comprise:

third program instructions to collect from routers information indicating a routing path from each of said multiplicity of source networks to each of said plurality of destination locations; and

wherein said third program instructions are stored on said medium.

12. A computer program product as set forth in claim 11 wherein the first program instructions further comprise:

fourth program instructions to determine from said router paths a number of hops from each of said multiplicity of source networks to each of said plurality of destination locations; and

wherein said fourth program instructions are stored on said medium.