Method and apparatus for predictive and actual intrusion detection on a network

• US 20060150249A1
• Filed: 05/04/2004
• Published: 07/06/2006
• Est. Priority Date: 05/07/2003
• Status: Active Grant

• Current Assignee: Sysxnet Ltd.
• Original Assignee: Trustwave Holdings Incorporated (Singapore Telecommunications Limited)
• Inventors: Gassen, Derek, Donahue, Thomas P.
• Granted Patent: US 8,640,234 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A method of managing network usage by defining a set of linguistic patterns, where each linguistic pattern is associated with a condition that is to be monitored. Network packets are captured during transmission and analyzed to identify linguistic patterns. Captured network packets are scored based on similarity of at least one linguistic pattern to one or more of the defined set of linguistic patterns. When a packet that is scored above a specified threshold value is identified, at least one responsive action is implemented. In this manner, a system implementing the method is able to identify network traffic that is associated with prospective malicious activity and thereby provide an early warning before damage has occurred.

Claims

1. A method of managing network usage comprising:

defining a set of linguistic patterns, where each linguistic pattern is associated with a condition that is to be monitored;

capturing network packets during transmission;

decapsulating the network packets;

identifying linguistic patterns in the captured network packets;

scoring captured network packets based on similarity of at least one identified linguistic pattern to one or more of the defined set of linguistic patterns; and

when a packet that is scored above a specified threshold value is identified, implementing at least one responsive action.

2. The method of claim 1 further comprising:

defining a set of categories, wherein each category is associated with a set of linguistic patterns; and

categorizing network packets into one or more of a plurality of the predefined categories based upon similarity to one or more of the defined set of linguistic patters for that category.

3. The method of claim 1 wherein the act of capturing comprises passively capturing;

4. The method of claim 1 wherein the act of capturing comprises actively capturing;

5. The method of claim 1 wherein decapsulating comprises:

determining from packet header information a type of application layer protocol used by the packet; and

parsing the packet to extract payload information from the packet.

6. The method of claim 5 wherein the type of protocol identified in decapsulating is used can be used to score and categorize the captured content.

7. The method of claim 5 wherein the type of protocol identified in decapsulating is used to provide context for scoring the actual content.

8. The method of claim 1 further comprising normalizing the decapsulated information;

9. The method of claim 1 further comprising parsing the decapsulated information

10. The method of claim 1 further comprising generating a report comprising the categorized information.

11. Network management software comprising computer implemented code stored on a tangible media, wherein the computer code is configured to implement the method of claim 1.

12. A system for managing network usage implementing the method of claim 1.

13. A monitored networked computing system comprising:

a network;

a plurality of computing devices coupled to the network and configured to exchange information packets with each other;

a network analyzer coupled to the network, wherein the network analyzer includes mechanisms for capturing information packets; and

a linguistic analyzer coupled to the network analyzer and operable to identify preselected linguistic patterns in the captured information packets, wherein the linguistic patters are preselected to identify network packets that preemptively indicate a future network attack.

14. The monitored network of claim 13 wherein the linguistic analyzer is operable to assign a score to the data based upon a degree to which the linguistic patterns of a particular packet are similar to linguistic patterns.

15. The monitored network of claim 13 wherein the network analyzer and linguistic analyzer operate in substantially real time

16. The monitored network of claim 13 wherein the network analyzer passively captures information packets.

17. The monitored network of claim 13 further comprising means for decapsulating protocol information from the information packet and use the protocol information

18. The monitored network of claim 13 further comprising a database coupled to the linguistic analyzer for storing the preselected linguistic patterns for each of a plurality of categories.

19. The monitored network of claim 18 wherein the preselected linguistic patterns are represented as regular expressions.

20. The monitored network of claim 13 wherein the network comprises an internet protocol network

21. The monitored network of claim 13 wherein the network comprises a fibre channel fabric.

22. The monitored network of claim 13 further comprising a report generator coupled to the linguistic analyzer and operable to generate reports based on the categorization

22-1. A computer implemented device for monitoring network traffic comprising:

computer code configured to be executed on a processor to cause the processor to capture information packets from a network;

computer code configured to be executed on a processor to cause the processor to identify linguistic patterns in the captured network packets;

computer code configured to be executed on a processor to cause the processor to score captured network packets based on similarity of at least one identified linguistic pattern to one or more of the defined set of linguistic patterns; and

computer code configured to be executed on a processor to cause the processor to implement at least one responsive action when a packet that is scored above a specified threshold value is identified.

23. A computing device configured to monitor network traffic, the computing device comprising:

a processor;

memory coupled to the processor;

a port coupled to an external network;

computer code executable using the processor and memory and operable to identify network traffic on the external network that is associated with prospective malicious activity.

24. The computing device of claim 23 wherein the computer code is operable to detect network traffic associated with hacker research activity.

25. The computing device of claim 23 wherein the computer code is operable to detect network traffic associated with malicious attack preparation activity.

26. The computing device of claim 23 wherein the computer code is operable to detect network traffic associated with a successfully initiated attack.

27. The computing device of claim 23 wherein the computer code is operable to detect network traffic associated with unauthorized access attempts made to a network resource other than the computing device itself.

28. The computing device of claim 23 wherein the computer code is operable to detect linguistic patterns in the network traffic.

29. The computing device of claim 28 wherein the computer code is operable to score network traffic based on similarity of at least one detected linguistic pattern to one or more preselected linguistic patterns.

30. A method of detecting a prospective network attack by monitoring network traffic, the method comprising:

defining a set of linguistic patterns, where each linguistic pattern is associated with a condition that has been determined to be indicative of a prospective network attack;

monitoring the network traffic over time;

identifying the linguistic patterns when they occur in network traffic;

accumulating information about the identified occurrences of the linguistic patterns over time; and

using the accumulated information as a basis for determining likelihood of a prospective network attack.

31. The method of claim 30 further comprising reporting the occurrence of network traffic when the occurrence of the linguistic patterns in the network traffic exceeds a preselected threshold.

32. The method of claim 30 wherein the act of accumulating information further comprises maintaining a score based on similarity of at least one identified linguistic pattern to one or more of the defined set of linguistic patterns;

and

when the score exceeds a specified threshold value, implementing at least one responsive action.