System and method for detection of network attacks

• US 8,302,180 B1
• Filed: 03/02/2012
• Issued: 10/30/2012
• Est. Priority Date: 05/23/2011
• Status: Active Grant

• Current Assignee: Kaspersky Lab ZAO
• Original Assignee: Kaspersky Lab ZAO
• Inventors: Levashov, Dmitry A., Gudov, Nikolay V.
• Primary Examiner(s): Cervetti, David Garcia
• Application Number:
  US13/410,660
• Time in Patent Office: 242 Days
• Field of Search: 726/11, 726/12, 726/13, 726/22, 726/23, 726/24, 726/25
• US Class Current: 726/13
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Disclosed are systems, methods and computer program products for detection of network attacks on a protected computer. In one example, the system comprises a proxy device configured to redirect and mirror traffic directed to the protected computer; a traffic sensor configured to collect statistical information about the mirrored traffic; a data collector configured to aggregate information collected by the traffic sensor and to generate traffic filtering rules based on the aggregated statistical information; a filtering center configured to, in parallel with collection of statistical information, filter redirected traffic based on the traffic filtering rules provided by the data collector.

Claims

1. A system for detection of network attacks on a protected computer, the system comprising:

a proxy device configured to receive network traffic directed to the protected computer, redirect the received traffic to a filtering center and mirror the received traffic to a traffic sensor;

the traffic sensor configured to collect information about the mirrored traffic;

a data collector configured to generate, based on the collected information, traffic filtering rules for detecting network attacks on the protected computer; and

the filtering center configured to, in parallel with collection of the information from the mirrored traffic by the traffic sensor and based on the traffic filtering rules provided by the data collector, detect, in the redirected traffic, network attacks on the protected computer and filter out from the redirected traffic network traffic associated with the detected network attacks.

2. The system of claim 1, wherein the data collector generates a model of the average statistical traffic directed to the protected computer based on the collected information and generates traffic filtering rules based on the generated statistical model.

3. The system of claim 1, wherein the filtering center uses white and black lists of IP addresses to identify allowed or prohibited network traffic.

4. The system of claim 3, wherein the filtering center is further configured to:

check if an address of the network traffic is found in the white list or black list of addresses to identify allowed or prohibited network traffic; and

if address is not found in the white list or black list, apply the traffic filtering rules to filter out from the traffic network traffic associated with network attacks.

5. The system of claim 1, wherein the data collector is configured to organize traffic filtering rules into a plurality of filtering profiles, which are used by the filtering center to filter out from the traffic network traffic associated with network attacks.

6. The system of claim 1, wherein filtering center is further configured to apply an anomaly detection profile for evaluating conformance of the network traffic with established threshold values.

7. The system of claim 6, wherein when an anomaly is detected in the network traffic using the anomaly profile, the filtering center applies appropriate filtering rules for blocking excess or atypical network traffic.

8. A computer implemented method for detection of network attacks on a protected computer, the method comprising:

receiving at a proxy device network traffic directed to the protected computer;

redirecting by the proxy device the received network traffic to a filtering center;

mirroring by the proxy device the received network traffic to a traffic sensor;

analyzing the mirrored network traffic by the traffic sensor and collecting information about the mirrored network traffic;

generating, based on the collected information, traffic filtering rules for detecting network attacks on the protected computer; and

filtering, in parallel with collection of the information from the mirrored traffic by the traffic sensor, the redirected traffic by the filtering center using the generated filtering rules.

9. The method of claim 8, wherein collecting information about the mirrored network traffic further includes:

generating a model of the average statistical traffic directed to the protected computer based on the collected information; and

generating traffic filtering rules based on the generated statistical model.

10. The method of claim 8, further comprising using black list and white list of addresses to identify allowed or prohibited network traffic.

11. The method of claim 10, further comprising:

checking if an address of the network traffic is found in the white list or black list of addresses to identify allowed or prohibited network traffic; and

if address is not found in the white list or black list, applying the traffic filtering rules to filter out from the traffic network traffic associated with network attacks.

12. The method of claim 8, wherein generating traffic filtering rules further comprises:

organizing traffic filtering rules into a plurality of filtering profiles for filtering out from the network traffic network traffic associated with network attacks.

13. The method of claim 8, wherein the traffic center is further configured to apply an anomaly detection profile for evaluating conformance of the network traffic with established threshold values.

14. The method of claim 13, wherein when an anomaly is detected in the network traffic using the anomaly profile, applying by the filtering center appropriate filtering rules for blocking excess or atypical network traffic.

15. A computer program product embedded in a non-transitory computer-readable storage medium, the computer-readable storage medium comprising computer-executable instructions detection of network attacks on a protected computer, the medium includes instructions for:

receiving at a proxy device network traffic directed to the protected computer;

redirecting by the proxy device the received network traffic to a filtering center;

mirroring by the proxy device the received network traffic to a traffic sensor;

analyzing the mirrored network traffic by the traffic sensor and collecting information about the mirrored network traffic;

generating, based on the collected information, traffic filtering rules for detecting network attacks on the protected computer; and

filtering, in parallel with collection of the information from the mirrored traffic by the traffic sensor, the redirected traffic by the filtering center using the generated filtering rules.

16. The computer program product of claim 15, wherein instructions for filtering further comprise instructions for using white and black lists of IP addresses to identify allowed or prohibited network traffic.

17. The computer program product of claim 15, wherein instructions for filtering further comprise instructions for:

checking if an address of the network traffic is found in the white list or black list of addresses to identify allowed or prohibited network traffic; and

if address is not found in the white list or black list, applying the traffic filtering rules to filter out from the traffic network traffic associated with network attacks.

18. The computer program product of claim 15, wherein instructions for generating traffic filtering rules further comprise instructions for:

organizing traffic filtering rules into a plurality of filtering profiles for filtering out from the network traffic network traffic associated with network attacks.

19. The computer program product of claim 15, wherein instructions for filtering further include instructions for applying an anomaly detection profile for evaluating conformance of the network traffic with established threshold values.

20. The computer program product of claim 19, further comprising instructions for, when an anomaly is detected in the network traffic using the anomaly profile, applying by the filtering center appropriate filtering rules for blocking excess or atypical network traffic.