Adaptive behavioral intrusion detection systems and methods

• US 20050044406A1
• Filed: 03/28/2003
• Published: 02/24/2005
• Est. Priority Date: 03/29/2002
• Status: Active Grant

• Current Assignee: Masergy Communications Incorporated (Comcast Corporation)
• Original Assignee: Global DataGuard, Inc. (Comcast Corporation)
• Inventors: Stute, Michael
• Granted Patent: US 8,205,259 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: C12Q 1/6804 Nucleic acid analysis using immunogens immunoassay G01N33/53
• CPC Class Codes: C12Q 1/6865 Promoter-based amplification, e.g. nucleic acid sequence amplification [NASBA], self-sustained sequence replication [3SR] or transcription-based amplification system [TAS]
• CPC Class Codes: C12Q 2521/313 Type II endonucleases, i.e. cutting outside recognition site
• CPC Class Codes: C12Q 2521/319 Exonuclease
• CPC Class Codes: C12Q 2525/121 incorporating both deoxyribonucleotides and ribonucleotides
• CPC Class Codes: C12Q 2525/143 incorporating a promoter sequence
• CPC Class Codes: C12Q 2537/1373 Displacement by a nucleic acid
• CPC Class Codes: C12Q 2563/179 the label being a nucleic acid
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Systems and methods for analyzing historical network traffic and determining which traffic does not belong in a network are disclosed. Intrusion detection is performed over a period of time, looking for behavioral patterns within networks or information systems and generating alerts when these patterns change. The intrusion detection system intelligently forms correlations between disparate sources to find traffic anomalies. Over time, behaviors are predictive, and the intrusion detection system attempts to predict outcomes, becoming proactive instead of just reactive. Intrusions occur throughout whole information systems, including both network infrastructure and application servers. By treating the information system as a whole and performing intrusion detection across it, the chances of detection are increased significantly.

Claims

1. A method for detecting network intrusion attempts associated with network objects on a communications network, the method comprising:

collecting normal traffic behavior associated with network objects on the network on a continuing basis to establish historical data regarding traffic across the network;

monitoring network traffic associated with network objects on the network to detect anomalies;

analyzing the anomalies using the historical data;

generating alerts identifying possible intrusion attempts based on analysis of the anomalies; and

updating the historical data based on the anomalies, the alerts, and network traffic.

2. The method of claim 1, wherein monitoring network traffic to detect anomalies comprises monitoring network traffic for known strings and series of bytes that indicate signature attacks.

3. The method of claim 1, wherein monitoring network traffic to detect anomalies further comprises applying a series of rules to identify anomalous packets and adding the anomalous packets to an anomaly pool.

4. The method of claim 3, wherein analyzing the anomalies using the historical data comprises analyzing packets in the anomaly pool independently of any of the series of rules that identified the packet for addition to the anomaly pool.

5. The method of claim 1, wherein analyzing the anomalies using the historical data comprises conducting a threshold analysis to determine whether a statistic or data point is within threshold values.

6. The method of claim 1, wherein generating alerts identifying possible intrusion attempts comprises adding alerts to an alert pool and releasing alerts to a console for viewing by an operator.

7. The method of claim 1, wherein generating alerts identifying possible intrusion attempts comprises:

adding a first set of alerts to an alert pool;

resolving internet protocol addresses associated with each alert in the alert pool with a name and renaming each alert in the alert pool with a name recognizable by an operator,

applying a set of rules to select alerts from the alert pool to be displayed on a console for viewing by the operator, the rules comprising high level selection parameters that have been previously defined; and

releasing the selected alerts by name to the console for viewing by the operator.

8. The method of claim 1, further comprising performing the method across a plurality of networks and compiling results in a global database.

9. The method of claim 8, further comprising updating the historical data based on results in the global database.

10. The method of claim 1, wherein updating the historical data includes storing sources of possible intrusion attempts in a database with an indicator of their hostility to the network and removing a source of possible intrusion attempts from the database when a value of the indicator is sufficiently low due to a period of inactivity of the source.

11. A computer storage medium storing a computer program which, when executed by a computer-controlled apparatus, causes the computer-controlled apparatus to perform the method of claim 1.

12. A computer-controlled apparatus operative for implementing the method of claim 1.

13. A method for detecting network intrusion attempts associated with network objects on a communications network, the method comprising:

collecting normal traffic behavior associated with network objects on the network on a continuing basis to establish historical data regarding traffic across the network;

monitoring network traffic associated with network objects on the network to detect anomalies comprising;

looking for known strings and series of bytes that indicate signature attacks; and

applying a series of rules to identify anomalous packets and adding the anomalous packets to an anomaly pool;

analyzing the anomalies using the historical data;

generating alerts identifying possible intrusion attempts based on analysis of the anomalies; and

updating the historical data based on the anomalies, the alerts, and network traffic.

14. The method of claim 13, wherein analyzing the anomalies using the historical data comprises:

analyzing packets in the anomaly pool independently of any of the series of rules that identified the packet for addition to the anomaly pool; and

conducting a threshold analysis to determine whether a statistic or data point is within threshold values.

15. The method of claim 13, wherein generating alerts identifying possible intrusion attempts comprises:

adding a first set of alerts to an alert pool;

resolving internet protocol addresses associated with each alert in the alert pool with a name and renaming each alert in the alert pool with a name recognizable by an operator;

applying a set of rules to select alerts from the alert pool to be displayed on a console for viewing by the operator, the rules comprising high level selection parameters that have been previously defined; and

releasing the selected alerts by name to the console for viewing by the operator.

16. The method of claim 13, further comprising:

performing the method across a plurality of networks;

compiling results in a global database; and

updating the historical data based on results in the global database.

17. The method of claim 13, wherein updating the historical data includes storing sources of possible intrusion attempts in a database with an indicator of their hostility to the network and removing a source of possible intrusion attempts from the database when a value of the indicator is sufficiently low due to a period of inactivity of the source.

18. A computer storage medium storing a computer program which, when executed by a computer-controlled apparatus, causes the computer-controlled apparatus to perform the method of claim 13.

19. A computer-controlled apparatus operative for implementing the method of claim 13.

20. An intrusion detection system for detecting network intrusion attempts associated with network objects on a communications network, the system comprising:

a sensor connected to the network for monitoring network traffic associated with network objects on the network comprising;

a knowledge-based component for examining network traffic for known strings and series of bytes that indicate signature attacks; and

a packet logger for reading packets in network traffic, classifying packets by protocols, and creating packages of compressed packets;

a server connected to the sensor that accepts real-time alerts for possible signature attacks and a converter for converting alerts from native signature format to a unified format for storage in at least one relational database;

an analysis server that receives compressed packets from the sensor at periodic intervals, wherein the analysis server conducts a behavioral analysis of the data received from the sensor; and

the at least one relational database, which stores raw packet data, behavioral data, and index data.

21. The system of claim 20, further comprising a plurality of sensors connected to the network.

22. The system of claim 20, further comprising two or more virtual private network tunnels connecting the sensor to the network.