Apparatus, system and method for identifying and mitigating malicious network threats

• US 10,129,270 B2
• Filed: 09/27/2013
• Issued: 11/13/2018
• Est. Priority Date: 09/28/2012
• Status: Active Grant

• Current Assignee: Level 3 Communications LLC (Lumen Technologies, Inc.)
• Original Assignee: Level 3 Communications LLC (Lumen Technologies, Inc.)
• Inventors: Doctor, Brad Bernay, Bingham, Skyler Jameson, Berg, Keshava, Reynolds, II, John Sherwood, Mohr, Justin George
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US14/039,251
• Publication Number:
  US 20140096251A1
• Time in Patent Office: 1,873 Days
• Field of Search: 726 23, 726 22, 726 24, 726 25
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 2463/142 Denial of service attacks against network infrastructure
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Implementations of the present disclosure involve a system and/or method for identifying and mitigating malicious network threats. Network data associated is retrieved from various sources across a network and analyzed to identify a malicious network threat. When a threat is found, the system performs a mitigating action to neutralize the malicious network threat.

Claims

1. A system for identifying malicious threats on a network comprising:

a computing device including a processor coupled to a system memory, the system memory storing instructions for execution on the processor, the instructions configured to cause the processor to;

retrieve a network data associated with at least one of an IP address or a domain, wherein the network data comprises information indicating an amount of data transceived by at least one element of the network;

analyze the network data and identify a malicious network threat, including identifying at least one bot command computer by tracing at least some of the data transceived by the at least one element of the network to a bot, and then tracing communications between the bot and the bot command computer;

push a notification including a mitigating action for the malicious network threat to a third party device; and

cause the mitigating action to be performed to neutralize the malicious network threat.

2. The system of claim 1, wherein the network data is retrieved from an edge router, wherein the network data comprises a snapshot of traffic being routed through the edge router.

3. The system of claim 1, further comprising a traffic measurement aggregator module logically connected to an edge router interface.

4. The system of claim 1, wherein the network data comprises data from a border gateway protocol table associated with a primary computer network'"'"'s connectivity relationships with at least one secondary network.

5. The system of claim 1, wherein the instructions are further configured to cause the processor to:

normalize the network data to a standard format;

decorate the network data with at least one tag that identifies the network activity data;

store the network data in a database;

weight the network data according to a threat associated with the data; and

generate a risk score for the weighted data.

6. The system of claim 5, wherein the instructions are further configured to cause the processor to generate the risk score by:

compare a new activity at the IP address or the domain to a past activity at the IP address or the domain;

determine whether the new activity fits a profile for a malicious IP address or domain;

correlate the risk score with a previous malicious threat; and

adjust the risk score according to the correlation.

7. The system of claim 6, wherein the instructions are further configured to cause the processor to predict a network based attack according at least the risk score.

8. The system of claim 1, wherein the mitigating action comprises at least one of a null routing the malicious network threat, adjusting an access control list (ACL) to block the malicious network threat, publishing a list identifying a bad actor committing the malicious network threat, or logically separating the IP address or domain from a network.

9. A method for identifying malicious threats on a network comprising:

retrieving a network data associated with at least one of an IP address or a domain, wherein the network data comprises information indicating an amount of data transceived by at least one element of the network;

analyzing the network data to identify a malicious network threat, including identifying at least one bot command computer by tracing at least some of the data transceived by the at least one element of the network to a bot, and then tracing communications between the bot and the bot command computer;

pushing a notification including a mitigating action for the malicious network threat to a third party device; and

causing the mitigating action to be performed to neutralize the malicious network threat.

10. The method of claim 9, wherein the network data is retrieved from an edge router.

11. The method of claim 10, further comprising measuring a rate of data transceived by the edge router at a measurement aggregator module logically connected to an edge router interface.

12. The method of claim 11, wherein the network data comprises data from a border gateway protocol table associated with a primary computer network'"'"'s connectivity relationships with at least one secondary network.

13. The method of claim 9, further comprising:

normalizing the network data to a standard format;

decorating the network data with at least one tag that identifies the network activity data;

storing the network data in a database;

weighing the network data according to a threat associated with the data; and

generating a risk score for the weighted data.

14. The method of claim 13, wherein the risk score is generated by:

comparing a new activity at the IP address or the domain to a past activity at the IP address or the domain;

determining whether the new activity fits a profile for a malicious IP address or domain;

correlating the risk score with a previous malicious threat; and

adjust the risk score according to the correlation.

15. The method of claim 14, further comprising predicting a network based attack according at least the risk score.

16. The method of claim 9, wherein the mitigating action comprises at least one of a null routing the malicious network threat, adjusting an access control list (ACL) to block the malicious network threat, publishing a list identifying a bad actor committing the malicious network threat, or logically separating the IP address or domain from a network.