WIRELESS INTRUSION PREVENTION SYSTEM AND METHOD

• US 20080178294A1
• Filed: 11/27/2007
• Published: 07/24/2008
• Est. Priority Date: 11/27/2006
• Status: Active Grant

• Current Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Original Assignee: Juniper Networks Incorporated
• Inventors: Hu, Guoning, Venugopal, Deepak, Bhardwaj, Shantanu
• Granted Patent: US 8,087,085 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 12/125 Protection against power exhaustion attacks
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: Y02D 30/70 in wireless communication networks

Abstract

A wireless intrusion prevention system and method to prevent, detect, and stop malware attacks is presented. The wireless intrusion prevention system monitors network communications for events characteristic of a malware attack, correlates a plurality of events to detect a malware attack, and performs mitigating actions to stop the malware attack.

Claims

1. A malware detection and mitigation system, comprising:

a plurality of monitors operably adapted to scan network communications for a plurality of events;

a detection agent operably adapted to communicate with at least one of said plurality of monitors, to correlate said plurality of said events to detect a malware attack, and to communicate an attack indication when said malware attack is detected; and

a mitigating agent operably adapted to communicate with said detection agent and to trigger a mitigating action in response to said attack indication.

2. The malware detection and mitigation system of claim 1, wherein said mitigating action comprises at least one mitigating action directed to a mobile device and at least one mitigating action directed to a network element.

3. The malware detection and mitigation system of claim 1, wherein said network communications are wireless network communications.

4. The malware detection and mitigation system of claim 1, wherein said malware attack is selected from the group consisting of a battery draining malware attack, a denial of service malware attack, and a mobile worm malware attack.

5. The malware detection and mitigation system of claim 1, wherein said plurality of events is correlated with a characteristic of said malware attack, said characteristic selected from the group consisting of an increase in network traffic to a network element, an increase in network traffic to a network element and a decrease in average packet size, a packet bound for an inactive mobile device, a packet bound for an invalid mobile devices, and a program sent to a plurality of mobile devices.

6. The malware detection and mitigation system of claim 1, wherein each of said plurality of monitors is operably adapted to run on a network element.

7. The malware detection and mitigation system of claim 6, wherein said network element is selected from the group consisting of a handset, a mobile device, a gateway, a traffic sniffer, a honeypot, a router, a switch, and a register.

8. The malware detection and mitigation system of claim 1, wherein said mitigating action is selected from the group consisting of reporting said malware attack, disabling said network communications, restricting said network communications, ignoring said network communications, performing a malware scan, and intercepting said network communications and forwarding to said security center.