Wireless intrusion prevention system and method

• US 8,087,085 B2
• Filed: 11/27/2007
• Issued: 12/27/2011
• Est. Priority Date: 11/27/2006
• Status: Active Grant

• Current Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Original Assignee: Juniper Networks Incorporated
• Inventors: Hu, Guoning, Venugopal, Deepak, Bhardwaj, Shantanu
• Primary Examiner(s): CHEN, SHIN HON
• Application Number:
  US11/946,003
• Publication Number:
  US 20080178294A1
• Time in Patent Office: 1,491 Days
• Field of Search: None
• US Class Current: 726/24
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 12/125 Protection against power exhaustion attacks
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: Y02D 30/70 in wireless communication networks

Abstract

A wireless intrusion prevention system and method to prevent, detect, and stop malware attacks is presented. The wireless intrusion prevention system monitors network communications for events characteristic of a malware attack, correlates a plurality of events to detect a malware attack, and performs mitigating actions to stop the malware attack.

Claims

1. A malware detection and mitigation system, comprising:

a plurality of mobile devices configured to execute a respective plurality of monitors operably adapted to scan network communications to determine destinations of the network communications, amounts of network traffic including one or more of the network communications to the destinations over time intervals, and average packet size of the network communications;

a plurality of detection agents each executing on a respective one of the mobile devices and operably adapted to communicate with at least one of the plurality of monitors of the respective one of the plurality of mobile devices, to determine normal amounts of network traffic over the time intervals to the destinations, to determine normal average packet size of the network communications to the destinations, to detect changes in the amounts of network traffic over the time intervals to a particular destination relative to the determined normal amount of network traffic to the particular destination over the time intervals, to detect changes in the average packet size of the network communications to the particular destination relative to the determined normal average packet size of the network communications to the particular detection, to detect a malware attack based on at least one of detected changes in the amount of network traffic over the time intervals, detected changes in the average packet size, and the destinations of the network communications, and to communicate an attack indication when the malware attack is detected; and

a network device separate from the one of the plurality of mobile devices, wherein the network device comprises a mitigating agent operably adapted to communicate with the plurality of detection agents via a mobile network to receive the attack indication and to trigger a mitigating action in response in the mobile network to the attack indication.

2. The malware detection and mitigation system of claim 1, wherein the mitigating action comprises at least one mitigating action directed to the one of the plurality of mobile devices and at least one mitigating action directed to a network element.

3. The malware detection and mitigation system of claim 1, wherein the network communications are wireless network communications.

4. The malware detection and mitigation system of claim 1, wherein the malware attack is selected from the group consisting of a battery draining malware attack, a denial of service malware attack, and a mobile worm malware attack.

5. The malware detection and mitigation system of claim 1, wherein the plurality of detection agents are configured to detect changes in the amount of the network traffic over the time intervals and changes in the average packet size of the communications that are correlated with a characteristic of the malware attack, the characteristic selected from the group consisting of an increase in network traffic to the particular destination and an increase in network traffic to the particular destination and a decrease in the average packet size of the network communications to the particular destination.

6. The malware detection and mitigation system of claim 1, further comprising one or more network elements configured to execute respective ones of a second plurality of monitors.

7. The malware detection and mitigation system of claim 6, wherein the one or more network elements are each selected from the group consisting of a handset, a mobile device, a gateway, a traffic sniffer, a honeypot, a router, a switch, and a register.

8. The malware detection and mitigation system of claim 1, wherein the mitigating action is selected from the group consisting of reporting the malware attack, disabling the network communications, restricting the network communications, ignoring the network communications, performing a malware scan, and intercepting the network communications and forwarding to the security center.

9. The malware detection and mitigation system of claim 1, wherein the plurality of detection agents are configured to detect the malware attack in response to detecting a packet bound for an inactive mobile device.

10. The malware detection and mitigation system of claim 1, wherein the plurality of detection agents are further configured to detect a malware attack in response to detecting a program sent to a plurality of mobile devices.

11. The malware detection and mitigation system of claim 1,

wherein the monitors are further configured to determine senders of the network communications,

wherein the detection agents are configured to determine an identity of a sender associated with the malware attack and to provide information indicative of the identity of a sender in the attack indication, and

wherein the mitigating agent of the network device is configured to instruct the mobile devices to drop packets from the sender associated with the malware attack.