Identifying source of malicious network messages
First Claim
1. A method for identifying a source of malicious network messages, said method comprising steps implemented by a computer of:
- responsive to identifying, from a plurality of destination locations having a same internet protocol (IP) address, one destination location subject to malicious messages, identifying a subset of a multiplicity of source networks, said subset including one or more source networks which have sent messages to said one destination location, wherein identifying said subset comprises;
the computer determining for each of said multiplicity of source networks whether there are fewer intervening hops from said each source network to said one destination location than from said each source network to other of said plurality of destination locations, andresponsive to a determination that there are fewer intervening hops for said each source network of said multiplicity of source networks, the computer identifying said each source network as included in said subset, andresponsive to determining there are not fewer intervening hops for said each source network of said multiplicity of source networks, the computer not identifying said each source network as included in said subset, wherein the determining step comprises steps of;
collecting from routers information indicating a routing path from each of said multiplicity of source networks to each of said plurality of destination locations, anddetermining from said router paths a number of hops from each of said multiplicity of source networks to each of said plurality of destination locations; and
notifying an administrator of said each source network included in said subset.
2 Assignments
0 Petitions
Accused Products
Abstract
System, method and program for identifying a subset of a multiplicity of source networks. The subset including one or more source networks which have sent messages to one of a plurality of destination locations having a same IP address. For each of the multiplicity of source networks, a determination is made whether there are fewer intervening hops from the source network to the one destination location than from the source network to other of the plurality of destination locations. If so, the source network is included in the subset. If not, the source network is not included in the subset. One application of the present invention is to identify a source of a denial of service attack. After the subset is identified, filters can be sequentially applied to block messages from respective source networks in the subset to determine which source network in the subset is sending the messages.
-
Citations
9 Claims
-
1. A method for identifying a source of malicious network messages, said method comprising steps implemented by a computer of:
-
responsive to identifying, from a plurality of destination locations having a same internet protocol (IP) address, one destination location subject to malicious messages, identifying a subset of a multiplicity of source networks, said subset including one or more source networks which have sent messages to said one destination location, wherein identifying said subset comprises; the computer determining for each of said multiplicity of source networks whether there are fewer intervening hops from said each source network to said one destination location than from said each source network to other of said plurality of destination locations, and responsive to a determination that there are fewer intervening hops for said each source network of said multiplicity of source networks, the computer identifying said each source network as included in said subset, and responsive to determining there are not fewer intervening hops for said each source network of said multiplicity of source networks, the computer not identifying said each source network as included in said subset, wherein the determining step comprises steps of; collecting from routers information indicating a routing path from each of said multiplicity of source networks to each of said plurality of destination locations, and determining from said router paths a number of hops from each of said multiplicity of source networks to each of said plurality of destination locations; and notifying an administrator of said each source network included in said subset. - View Dependent Claims (2, 3)
-
-
4. A system for identifying a source of malicious network messages, said system comprising:
-
a CPU, a computer readable memory and a computer readable storage media; program instructions, responsive to identifying, from a plurality of destination locations having a same internet protocol (IP) address, a destination location subject to malicious messages, to identify a subset of a multiplicity of source networks, said subset including one or more source networks which have sent messages to said one destination location, wherein said program instructions to identify said subset comprises; first program instructions to determine for each of said multiplicity of source networks whether there are fewer intervening hops from said each source network to said one destination location than from said each source network to other of said plurality of destination locations; and second program instructions, responsive to a determination that there are fewer intervening hops from said each source network to said one destination location than from said each source network to other of said plurality of destination locations, to identify said each source network as included in said subset, and responsive to a determination that there are not fewer intervening hops from said each source network to said one destination location than from said each source network to other of said plurality of destination locations, for not identifying said each source network as included in said subset;
wherein said first program instructions comprises;program instructions to collect from routers information indicating a routing path from each of said multiplicity of source networks to each of said plurality of destination locations, and program instructions to determine from said router paths a number of hops from each of said multiplicity of source networks to each of said plurality of destination locations; and program instructions to notify an administrator of said each source network included in said subset; and
whereinthe first and second program instructions are stored on the computer readable storage media for execution by the CPU via the computer readable memory. - View Dependent Claims (5, 6)
-
-
7. A computer program product for identifying a source of malicious network messages, said computer program product comprising:
-
a non-transitory computer readable storage medium; program instructions, responsive to identifying, from a plurality of destination locations having a same internet protocol (IP) address, a destination location subject to malicious messages, to identify a subset of a multiplicity of source networks, said subset including one or more source networks which have sent messages to said one destination location, wherein said program instructions to identify said subset comprises; first program instructions to determine for each of said multiplicity of source networks whether there are fewer intervening hops from said each source network to said one destination location than from said each source network to other of said plurality of destination locations; and second program instructions, responsive to a determination that there are fewer intervening hops from said each source network to said one destination location than from said each source network to other of said plurality of destination locations, to identify said each source network as included in said subset, and responsive to a determination that there are not fewer intervening hops from said each source network to said one destination location than from said each source network to other of said plurality of destination locations, to not identify said each source network as included in said subset;
wherein said first program instructions comprises;instructions to collect from routers information indicating a routing path from each of said multiplicity of source networks to each of said plurality of destination locations, and instructions to determine from said router paths a number of hops from each of said multiplicity of source networks to each of said plurality of destination locations; and program instructions to notify an administrator of said each source network included in said subset; and
whereinsaid first and second program instructions are stored on said medium. - View Dependent Claims (8, 9)
-
Specification