System and method for identification and blocking of unwanted network traffic

• US 9,628,511 B2
• Filed: 04/29/2016
• Issued: 04/18/2017
• Est. Priority Date: 09/28/2007
• Status: Active Grant

• Current Assignee: SecureWorks Corp. (Dell Technologies Inc.)
• Original Assignee: SecureWorks Corp. (Dell Technologies Inc.)
• Inventors: Ramsey, Jon R., Haber, Wayne Howard, Hubbard, Michael Joseph, Banerjee, Uday
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US15/142,867
• Publication Number:
  US 20160241591A1
• Time in Patent Office: 354 Days
• Field of Search: None
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

Network traffic can be prevented from entering a protected network. An alert can be received that can be triggered by network traffic that matches at least one signature that is associated with undesired network behavior. A source of the network traffic that triggered the alert can be determined, and network traffic that originates from the source can be blocked. Blocking the source can include assigning a determination to the alert. It can then be determined whether network traffic from the source should be blocked based on the determination. The source can then be provided to the protected network such that a network device coupled to the protected network can be configured to block network traffic that originates from the source.

Claims

1. A method comprising:

receiving at a network protection system an alert from an intrusion detection system associated with a protected network, wherein the alert is triggered by network traffic that is evaluated by the intrusion detection system and that is determined to match a signature that is associated with undesired network behavior;

determining a source of the network traffic that triggered the alert;

grouping at the network protection system the alert into an alert group;

assigning a determination to the alert group, the determination indicating a threat level associated with the alert group;

generating an entry in an undesired source database based on the alert group, the entry including a first Internet Protocol (IP) address associated with the alert; and

providing the undesired source database to the intrusion detection system, such that the intrusion detection system is configured to block network traffic that originates from the first IP address.

2. The method of claim 1, wherein generating the entry further comprises:

determining that a second IP address associated with a second alert is a spoofed IP address; and

disregarding the second IP address from the undesired source database in response to determining that the second IP address is a spoofed IP address.

3. The method of claim 1, wherein generating the entry further comprises:

determining that traffic associated with a second alert is a Universal Datagram Protocol (UDP) traffic; and

disregarding a second IP address associated with the second alert in response to determining that the traffic UDP traffic.

4. The method of claim 1, wherein generating the entry further comprises:

determining that the first IP address is associated with a geolocation, wherein the first IP address is included in the entry in response to determining that the first IP address is associated with the geolocation.

5. The method of claim 1, wherein generating the entry further comprises:

determining that the alert group includes more than a predetermined number of reconnaissance activities; and

determining that the first IP address is associated with a reconnaissance activity, wherein the first IP address in included in the entry in response to determining that the alert group includes more than the predetermined number of reconnaissance activities.

6. The method of claim 1, wherein generating the entry further comprises:

determining that the alert group includes more than a predetermined number of alerts from matched signatures received by a predetermined number of target devices in a predetermined period of time.

7. The method of claim 6, further comprising:

determining that the generating of the entry resulted in an excess number of entries in the undesired source database; and

increasing at least one of the predetermined number of alerts, the predetermined number of target devices, and the predetermined period of time.

8. The method of claim 6, further comprising:

determining that the undesired source database includes an insufficient number of entries; and

decreasing at least one of the predetermined number of alerts, the predetermined number of target devices, and the predetermined period of time.

9. A non-transitory computer-readable medium encoded with computer-executable instructions for performing a method, the method comprising:

receiving at a network protection system an alert from an intrusion detection system associated with a protected network, wherein the alert is triggered by network traffic that is evaluated by the intrusion detection system and that is determined to match a signature that is associated with undesired network behavior;

determining a source of the network traffic that triggered the alert;

grouping at the network protection system the alert into an alert group;

assigning a determination to the alert group, the determination indicating a threat level associated with the alert group;

generating an entry in an undesired source database based on the alert group, the entry including a first Internet Protocol (IP) address associated with the alert; and

providing the undesired source database to the intrusion detection system, such that the intrusion detection system is configured to block network traffic that originates from the first IP address.

10. The computer-readable medium of claim 9, wherein, in generating the entry, the method further comprises:

determining that a second IP address associated with a second alert is a spoofed IP address; and

disregarding the second IP address from the undesired source database in response to determining that the second IP address is a spoofed IP address.

11. The computer-readable medium of claim 9, wherein, in generating the entry, the method further comprises:

determining that traffic associated with a second alert is a Universal Datagram Protocol (UDP) traffic; and

disregarding a second IP address associated with the second alert in response to determining that the traffic UDP traffic.

12. The computer-readable medium of claim 9, wherein, in generating the entry, the method further comprises:

determining that the first IP address is associated with a geolocation, wherein the first IP address is included in the entry in response to determining that the first IP address is associated with the geolocation.

13. The computer-readable medium of claim 9, wherein, in generating the entry, the method further comprises:

determining that the alert group includes more than a predetermined number of reconnaissance activities; and

determining that the first IP address is associated with a reconnaissance activity, wherein the first IP address in included in the entry in response to determining that the alert group includes more than the predetermined number of reconnaissance activities.

14. The computer-readable medium of claim 9, wherein, in generating the entry, the method further comprises:

determining that the alert group includes more than a predetermined number of alerts from matched signatures received by a predetermined number of target devices in a predetermined period of time.

15. The computer-readable medium of claim 14, the method further comprising:

determining that the generating of the entry resulted in an excess number of entries in the undesired source database; and

increasing at least one of the predetermined number of alerts, the predetermined number of target devices, and the predetermined period of time.

16. The computer-readable medium of claim 14, the method further comprising:

determining that the undesired source database includes an insufficient number of entries; and

decreasing at least one of the predetermined number of alerts, the predetermined number of target devices, and the predetermined period of time.