Systems and methods for dynamic protection from electronic attacks

• US 9,160,764 B2
• Filed: 03/25/2014
• Issued: 10/13/2015
• Est. Priority Date: 07/15/2011
• Status: Expired due to Fees

• Current Assignee: Norse Networks, Inc.
• Original Assignee: Norse Corporation
• Inventors: Stiansen, Tommy, Glines, Samuel M., Foss, Sheldon H. Jr.
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US14/224,822
• Publication Number:
  US 20140366132A1
• Time in Patent Office: 567 Days
• Field of Search: 726 22- 27, 709223-225, 713/150, 713152-154, 713/162, 705/64
• US Class Current: 1/1
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/302 gathering intelligence information for situation awareness or reconnaissance

Abstract

Systems and methods for gathering, classifying, and evaluating real time security intelligence data concerning security threats presented by an IP address, and reporting in real time the degree and character of such security threats.

Claims

1. A system for reducing the security risk of transactions with a computer over a computer network, said system comprising:

a. a computer network;

b. a first computer on said computer network, said first computer having a first computer network address and said first computer communicating with a second computer on said computer network;

c. a communication between said first computer and said second computer, said act of said first computer communicating with said second computer being indicative of a user of said first computer being engaged in a risk activity and said communication including said first computer network address;

d. a monitoring system on said computer network having one or more monitoring agents autonomously obtaining said first computer network address from said communication between said first computer and said second computer; and

e. one or more algorithms assigning a risk score to transactions over said computer network from said first computer network address, said risk based at least in part on content on said second computer;

wherein said monitoring system utilizes said risk score to inhibit a communication between said first computer and a third computer.

2. The system of claim 1, wherein said computer network is the Internet.

3. The system of claim 1, wherein said first computer network address is an Internet Protocol address.

4. The system of claim 1, wherein one or more of said one or more monitoring agents is selected from the group consisting of:

a bot;

a daemon;

a terminate-and-stay-resident program;

a honeypot;

a computer;

a virtual computer;

a network device;

a virtual network device;

a spider;

a P2P networking client;

a P2P networking server;

a packet filter;

a packet sniffer;

a firewall;

a chat client;

a chat server;

a file transfer client;

a file transfer server;

a newsgroup reader;

a newsgroup server provider;

a file sharing client;

a file sharing server;

a web server;

a web site;

a web page;

a translation program;

a genetic algorithm;

a learning algorithm;

a self-replicating program;

a worm;

a Trojan horse.

5. The system of claim 1, wherein one or more of said one or more algorithms is selected from the group consisting of:

pattern recognition;

inferential algorithm;

planning algorithm;

heuristic algorithm;

logical algorithm;

search algorithm;

decision tree algorithm;

red-black tree algorithm;

Levensthein algorithm;

CacheHill algorithm;

PCRE algorithm;

Oliver decision graph algorithm;

genetic algorithm;

learning algorithm;

self-teaching algorithm;

self-modifying algorithm.

6. The system of claim 1, wherein said risk activity is selected from the group consisting of:

fraud;

identify theft;

crime;

cyberbullying;

denial-of-service;

hacking;

virus authoring or distribution;

exploit authoring or distribution;

digital piracy;

intellectual property infringement;

pornography production or distribution;

controlled substance trade;

terrorism;

insurrection;

smuggling;

organized crime;

civil disobedience;

money laundering.

7. The system of claim 1, wherein said risk score is provided through an application programming interface.

8. The system of claim 1, wherein said risk score is in the value range 0 to 100 inclusive.

9. A non-transitory computer readable media, said media comprising:

a. computer-readable instructions for detecting a communication between a first computer and a second computer, said act of said first computer communicating with said second computer being indicative of a user of said first computer being engaged in a risk activity;

b. computer-readable instructions for obtaining a network address from said first computer;

c. computer-readable instructions for assigning a risk score and a risk category to said first computer network address, said risk category based at least in part on the content of said second computer;

d. computer-readable instructions for storing said risk score and said risk category; and

e. computer-readable instructions for utilizing said risk score and said risk category to inhibit communication between said first computer and a third computer.

10. The media of claim 9, wherein said first computer network address is an Internet Protocol address.

11. The media of claim 9, wherein said risk category is selected from the group consisting of:

commercial risk;

fraud risk;

identify theft risk;

criminal risk;

social risk;

denial-of-service risk;

hacking risk;

virus risk;

exploit risk;

infringement risk;

pornography risk;

drug risk;

terrorism risk.

12. The media of claim 9, wherein said risk score is in the value range 0 to 100 inclusive.