Systems and methods for distributed network protection

• US 20010052014A1
• Filed: 05/31/2001
• Published: 12/13/2001
• Est. Priority Date: 05/31/2000
• Status: Active Grant

• Current Assignee: Invicta Networks, Inc.
• Original Assignee: Invicta Networks, Inc.
• Inventors: Sheymov, Victor I., Turner, Roger B.
• Granted Patent: US 7,089,303 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

By distributing various information and monitoring centers that monitor distributed networks and unauthorized access attempts, it is possible to, for example, more quickly defend against an unauthorized access attempts. For example, a Level 1 monitoring center could monitor a predetermined geographical area serving, for example, a wide variety of commercial and public sites, an organizational structure, or the like, for alarms. Upon analyzing an alarm for various characteristics, the Level 1 monitoring center can refer the unauthorized access attempt to an appropriate Level 2 center for, for example, possible retaliatory and/or legal action. Then, a Level 3 monitoring center can record and maintain an overall picture of the security of one or more networks, the plurality of monitoring centers and information about one or more hacking attempts.

Claims

1. A distributed network monitoring system comprising:

one or more hierarchical monitoring systems; and

one or more alarm signals that represent an unauthorized access attempt into one or more portions of the distributed network, wherein the one or more hierarchical monitoring systems at least one of analyze the unauthorized access attempt, determine a responsive action to the unauthorized access attempt, or forward information regarding the unauthorized access attempt to one or more of the one or more hierarchical monitoring systems.

2. The system of

claim 1

, further comprising a monitoring device that monitors information on one or more distributed networks.

3. The system of

claim 1

, further comprising an intrusion analysis system that receives the one or more alarm signals and at least one of determines the origin of the unauthorized access attempt, logs communications and evaluates the threat of the unauthorized access attempt.

4. The system of

claim 1

, further comprising an intrusion interaction system that is capable of communicating with the origin of the unauthorized access attempt.

5. The system of

claim 1

, further comprising an escalation determination system that, based on an evaluation the unauthorized access attempt and a comparison to one or more other unauthorized access attempts, forwards information regarding the unauthorized access attempt to the one or more of the one or more hierarchical monitoring systems.

6. The system of

claim 1

, wherein the one or more alarm signals is generated by one or more recipients of the unauthorized access attempt.

7. The system of

claim 1

, further comprising a response system that communicates information to one or more of a monitored site and a law enforcement agency.

8. A method of protecting a distributed network comprising:

monitoring one or more portions of the distributed network through one or more hierarchical monitoring systems; and

receiving one or more alarm signals that represent an unauthorized access attempt into one or more portions of the distributed network, wherein the one or more hierarchical monitoring systems at least one of analyze the unauthorized access attempt, determine a responsive action to the unauthorized access attempt, or forward information regarding the unauthorized access attempt to one or more of the one or more hierarchical monitoring systems.

9. The method of

claim 8

, further comprising monitoring information on one or more geographic or organizational portions of the distributed network.

10. The method of

claim 8

, further comprising receiving the one or more alarm signals and at least one of determining the origin of the unauthorized access attempt, logging communications and evaluating the threat of the unauthorized access attempt.

11. The method of

claim 10

, wherein the logging can be restricted based on an analysis of the unauthorized access attempt.

12. The method of

claim 8

, further comprising communicating with the origin of the unauthorized access attempt.

13. The method of

claim 8

, further comprising forwarding, based on an evaluation of the unauthorized access attempt and a comparison to one or more other unauthorized access attempts, information regarding the unauthorized access attempt to the one or more of the one or more hierarchical monitoring systems.

14. The method of

claim 8

, wherein the one or more alarm signals is generated by one or more recipients of the unauthorized access attempt.

15. The method of

claim 8

, further comprising communicating information to one or more of a monitored site and a law enforcement agency.