Method and system for protecting computer networks by altering unwanted network data traffic

• US 20050120243A1
• Filed: 10/28/2004
• Published: 06/02/2005
• Est. Priority Date: 10/28/2003
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: Internet Security Systems Incorporated (International Business Machines Corporation)
• Inventors: Graham, Robert David, Palmer, Bernard Paul Jr.
• Granted Patent: US 7,657,938 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Protecting computer networks by altering unwanted network data traffic. An Intrusion Protection System (IPS) or an Intrusion Detection System (IDS) can monitor network data traffic comprising byte information. This network security device analyzes network data traffic at the byte level to determine whether an intrusion event is present in the network data traffic. If an intrusion event is detected, the network security device alters at least a portion of the relevant byte information to prevent the occurrence of a successful intrusion event at the intended destination. This altered byte information is then passed to the destination by the network security device. If an intrusion event is not present, the network security device passes the byte information without alteration to the destination.

Claims

1. A computer-implemented method for protecting a computer network, comprising the steps of:

monitoring network data carried by the computer network;

analyzing byte information of the network data to determine whether the network data comprises one of a plurality of intrusion events; and

in response to detecting one of the intrusion events, altering at least a portion of the byte information associated with the intrusion event and forwarding the altered byte information to an intended destination on the computer network,

otherwise, passing the byte information without alteration to the destination in the absence of detecting one of the intrusion events.

2. The computer-implemented method of claim 1, wherein the byte information comprises a plurality of bytes for the network data, and the monitoring step comprises the steps of:

reading each byte of the network data; and

maintaining an application state for each byte of the network data.

3. The computer-implemented method according to claim 2, wherein said analyzing step comprises the steps of:

for each byte of the network data, identifying an event corresponding to the application state; and

determining whether the corresponding event is an intrusion event.

4. The computer-implemented method according to claim 1, wherein the byte information comprises a plurality of bytes for the network data, and the altering step comprises the steps of:

determining the location of the intrusion event within the network data;

inspecting each of the bytes at the location of the intrusion event; and

identifying each byte that requires alteration to prevent a successful occurrence of the intrusion event at the destination, the alteration defined by a response plan associated with the intrusion event; and

completing the alteration of each identified byte in accordance with the response plan.

5. The computer-implemented method according to claim 1,

wherein the response plan defines response plan bytes for substitution within the byte information associated with the intrusion event, and

the altering step comprises substituting the response plan bytes within a location of certain bytes for the byte information associated with the intrusion event,

thereby changing at least a portion of the byte information for the intrusion event in a manner that neutralizes the harmful effects of the intrusion event.

6. The computer-implemented method according to claim 1,

wherein the response plan defines response plan bytes for injection within the byte information associated with the intrusion event, and

the altering step comprises injecting the response plan bytes at a location adjacent to certain bytes for the byte information associated with the intrusion event.

7. The computer-implemented method according to claim 1, wherein said altering step further comprises correcting a checksum for the altered portion of the byte information associated with the intrusion event.

8. A computer-implemented method for protecting a computer network, comprising the steps of:

monitoring network data carried by the computer network;

analyzing byte information of the network data to determine whether the network data comprises one of a plurality of intrusion events, the byte information comprising a plurality of bytes for the network data;

in response to detecting one of the intrusion events, altering at least a portion of the byte information associated with the intrusion event by;

determining the location of the intrusion event within the network data, inspecting each of the bytes at the location of the intrusion event,

identifying each byte that requires alteration to prevent a successful occurrence of the intrusion event at the destination, the alteration defined by a response plan associated with the intrusion event, and

completing the alteration of each identified byte in accordance with the response plan,

forwarding the altered byte information to an intended destination on the computer network, and

in the absence of detecting one of the intrusion events, passing the byte information without alteration to the destination.

9. A computer-implemented system for protecting a computer network from intrusion by an unauthorized user, comprising:

a monitoring program module operative to analyze network data transported by the computer network to determine whether the network data comprises one of a plurality of intrusion events and, in the absence of identifying one of the intrusion events, passing the network data to an intended destination on the computer network; and

an alteration program module, communicatively coupled to the analysis program module, operative to respond to the detection of one of the intrusion events by altering at least a portion of byte-level information of the network data corresponding to the intrusion event and forwarding the altered portion of the network data to the intended destination on the computer network.

10. A computer-implemented method for protecting a computer network, comprising the steps of:

monitoring network data carried by the computer network;

analyzing the network data to determine whether the network data comprises an intrusion event; and

in the event that the network data fails to comprise one of a plurality of intrusion events, passing the network data to a destination coupled to the computer network;

in the event that the network data comprises one of the intrusion events, altering at least a portion of the network data associated with the intrusion event and forwarding the network data comprising the portion of altered network data and any remainder of unaltered network data to the destination, thereby preventing the occurrence of a successful intrusion event at the destination.