Propagation protection within a network

• US 20060130142A1
• Filed: 01/21/2005
• Published: 06/15/2006
• Est. Priority Date: 11/30/2004
• Status: Active Grant

• Current Assignee: Cymtec Systems, Inc.
• Original Assignee: Cymtec Systems, Inc.
• Inventors: Mester, Michael L., Gunsalus, Bradley W.
• Granted Patent: US 7,478,424 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Described are methods and apparatus, including computer program products, for propagation protection within a network. A transparent network appliance monitors data being transmitted from a first portion of the network to a second portion of the network through the network appliance and analyzes the data to determine whether the data represents a threat to the network. The network appliance transmits the data to the second portion of the network if the data does not represent a threat to the network or prevents transmission of the data to the second portion of the network if the data represents a threat to the network.

Claims

1. A computerized method for propagation protection within a network, the method comprising:

monitoring, by a transparent network appliance, data being transmitted from a first portion of the network to a second portion of the network through the network appliance;

analyzing, by the network appliance, the data to determine whether the data represents a threat to the network; and

transmitting the data to the second portion of the network if the data does not represent a threat to the network or preventing transmission of the data to the second portion of the network if the data represents a threat to the network.

2. The method of claim 1, further comprising generating an alert when the data represents a threat to the network.

3. The method of claim 2, further comprising transmitting the alert to a management server.

4. The method of claim 1, further comprising terminating a (Transmission Control Protocol) TCP session associated with the data if the data represents a threat to the network.

5. The method of claim 1, wherein analyzing comprises comparing the data with known threat profiles.

6. The method of claim 1, wherein analyzing comprises:

establishing one or more statistics on traffic from the first portion of the network to the second portion of the network;

calculating current statistics associated with the data; and

comparing the current statistics with the established statistics.

7. The method of claim 1, wherein the one or more statistics comprise a number of connections initiated by a host, a type of connection initiated by the host, or an amount of data transferred from or to the host.

8. The method of claim 1, further comprising, receiving, by a management server, a message from the network appliance.

9. The method of claim 8, wherein the message includes an event message, a resource message, or a statistics message.

10. The method of claim 1, further comprising, receiving, by the network appliance, a message from a management server.

11. The method of claim 10, wherein the message includes a pause message, a signature activation message, a signature update message, or a signature update package message.

12. The method of claim 1, further comprising, assigning an Internet Protocol (IP) address to the network appliance.

13. The method of claim 1, further comprising, remotely upgrading the network appliance.

14. The method of claim 13, wherein remotely upgrading includes updating one or more threat profiles.

15. The method of claim 13, wherein remotely upgrading includes updating one or more threat analysis methods.

16. The method of claim 1, further comprising, enabling a user to restore the network appliance to factory defaults.

17. The method of claim 1, further comprising, automatically resetting, by the network appliance, to a previous configuration upon a failed condition.

18. The method of claim 1, further comprising, generating a Web interface to configure the network appliance to a specific configuration.

19. A transparent network appliance for propagation protection within a network, the network appliance comprising:

a transparent network interface card configured to act as a bridge between a first portion of the network and a second portion of the network; and

a data analyzer module configured to analyze data transmitted from the first portion of the network to the second portion of the network to determine whether the data represents a threat to the network and to transmit the data to the second portion of the network if the data does not represent a threat to the network or prevent transmission of the data to the second portion of the network if the data represents a threat to the network.

20. The network appliance of claim 19 further comprising a failsafe module configured to transmit data between a first portion of the network and a second portion of the network in a failed or powerless condition.

21. The network appliance of claim 20 wherein the failsafe module is further configured to monitor for a failed condition.

22. The network appliance of claim 19 further comprising a memory module.

24. The network appliance of claim 22 further comprising an extended CMOS module including a binary image of a Basic Input Output System (BIOS) of the network appliance.

25. The network appliance of claim 20 further comprising an interface configured to communicate with a management module located external to the network appliance.

27. The network appliance of claim 20 further comprising a serial interface, including a software console to enable IP address assignment for the network appliance and to enable initialization of the network appliance.

23. The network appliance of claim 23 wherein the memory module comprises a compact flash card.

26. The network appliance of claim 26 where the interface is associated with an Internet Protocol (IP) address.

28. A computer program product, tangibly embodied in an information carrier, for propagation protection within a network, the computer program product including instructions being operable to cause data processing apparatus to:

monitor, by a transparent network appliance, data being transmitted from a first portion of the network to a second portion of the network through the network appliance;

analyze, by the network appliance, the data to determine whether the data represents a threat to the network; and

transmit the data to the second portion of the network if the data does not represent a threat to the network or prevent transmission of the data to the second portion of the network if the data represents a threat to the network.