Systems and methods for detecting, identifying and categorizing intermediate nodes

• US 9,348,927 B2
• Filed: 05/07/2012
• Issued: 05/24/2016
• Est. Priority Date: 05/07/2012
• Status: Active Grant

• Current Assignee: Smart Security Systems, LLC
• Original Assignee: Smart Security Systems, LLC
• Inventors: Tola, Kenneth C. Jr.
• Primary Examiner(s): ABRAHAM, AHMED M
• Application Number:
  US13/465,799
• Publication Number:
  US 20130297606A1
• Time in Patent Office: 1,478 Days
• Field of Search: 707/623, 707/736, 707/737, 709/223, 709/232
• US Class Current: 1/1
• CPC Class Codes: G06F 16/954 Navigation, e.g. using categorised browsing
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/562 Brokering proxy services

Abstract

A system and method for obtaining node information from a variety of potential sources and storing the information in a logical repository, and a system and method for identifying and categorizing Intermediate Nodes using a combination of requesting and responding node information.

Claims

1. A system for identifying and categorizing intermediate nodes based on obtained intermediate node data, the system comprising:

a node configured to initiate resource requests based on a set of rules through a controlled requesting subsystem;

a memory configured to store data from the controlled requesting subsystem;

wherein the controlled requesting subsystem further comprises;

at least one system node configured to obtain intermediate node data of at least one intermediate node, to apply a plurality of rules comprising at least one custom expression command to the intermediate node data to extract candidate node data from the intermediate node data, wherein the custom expression command comprises a workflow process that is iteratively applied to the intermediate node data of the at least one intermediate node;

a controlled requesting node configured to test the intermediate node by generating at least one node request to a controlled responding node for target content based on the candidate node data of the at least one intermediate node, wherein the requesting and responding nodes represent endpoints of the node that initiates resource requests; and

wherein the system node is further configured to determine if the intermediate node changes a behavior in response to the at least one node request; and

wherein the system node both categorizes a type of the intermediate node and determines a safety or functional capability of the intermediate node based on requesting node data collected by the controlled requesting node as a result of the test, including the determination of whether the intermediate node behavior changes in response to the at least one node request, and the candidate node data.

2. The system of claim 1, wherein the at least one system node comprises the memory which stores the candidate node data.

3. The system of claim 1, further comprising at least one other node external to the at least one system node, the at least one other node comprising the logical data repository which stores the candidate node data.

4. The system of claim 1, wherein the at least one intermediate node is a plurality of intermediate nodes.

5. The system of claim 4, further comprising a set of intermediate node information including at least one Uniform Resource Identifier (URI), wherein the at least one URI points to a corresponding intermediate node of the plurality of intermediate nodes, and the at least one system node obtains the intermediate node data for the corresponding intermediate node based on the at least one URI.

6. The system of claim 1, wherein the plurality of rules are selected from the group consisting of:

regular expressions, publically available processing sources, WebKit sources and combinations of any of the foregoing.

7. The system of claim 6, wherein the at least one system node iteratively applies at least a portion of the plurality of rules to the intermediate node data of the at least one node to extract the candidate node data from the intermediate node data.

8. The system of claim 6, wherein the plurality of rules are configured to extract candidate node data having a plurality of different formats.

9. The system of claim 1, wherein the plurality of rules comprise at least one regular expression command.

10. The system of claim 6, further comprising a rule generation tool configured to create rules based on input from a user and store the created rules in the dynamic rule repository.

11. The system of claim 6, wherein, after a first rule is applied which successfully obtains candidate node data from the intermediate node data of the at least one intermediate node, the at least one system node does not apply the remainder of the plurality of rules to the intermediate node data of the at least one intermediate node.

12. The system of claim 6, wherein the at least one system node applies the plurality of rules by successively iterating through the plurality of rules in increasing complex logic to progressively filter content from the intermediate node data until a desired level of the candidate node data is obtained.

13. The system of claim 1, wherein the at least one intermediate node is a plurality of intermediate nodes of a given network, and the at least one system node is configured to apply the at least one rule to the intermediate node data of each of the plurality of intermediate nodes of the given network to extract candidate node data for each said node of the given network, and send the candidate node data for each said node of the given network to the logical data repository.

38. The system of claim 1, wherein the at least one system node comprises at least one of the logical data repository, the controlled requesting node and the controlled responding node.

39. The system of claim 1, wherein the controlled requesting node generates a plurality of node requests to the controlled responding node for target content based on the candidate node data of the at least one intermediate node, a communication type of each of the plurality of node requests is different, and the at least one system node determines one or more communication types supported by the intermediate node based on the plurality of requests.

40. The system of claim 1, wherein the controlled requesting node includes one or more static values in the node request, the controlled responding node receives a content request from the intermediate node based on the node request, and the controlled responding node checks the one or more static values in the content request to determine a functionality of the intermediate node.

41. The system of claim 40, wherein the controlled responding node generates a content response including at least one of the one or more static values and at least one new static value, the controlled requesting node receives an intermediate node response based on the content response, and the controlled requesting node checks the at least one of the one or more static values and the at least one new static value in the intermediate node response to determine a functionality of the intermediate node.

42. The system of claim 1, wherein the controlled responding node generates a content response including a script or piece of code, the controlled requesting node receives an intermediate node response based on the content response, and the controlled requesting node checks the script or the piece of code in the intermediate node response to determine if the intermediate node is filtering the script or piece of code.

43. The system of claim 1, wherein the at least one system node determines if an amount of traffic that the intermediate node can support based on a number of the node requests.

44. The system of claim 1, wherein the controlled requesting node generates a plurality of node requests to a controlled responding node based on the candidate node data of the at least one intermediate node, wherein a data type requested by each of the plurality of node requests is different, and the at least one system node determines one or more communication types supported data types supported by the intermediate node based on the data types requested and received.

45. The system of claim 1, wherein the controlled responding node receives a content request from the intermediate node based on the node request, and the controlled responding node checks the static values in the content request to determine a functionality of the intermediate node.

46. The system of claim 1, wherein the controlled responding node receives a content request from the intermediate node based on the node request, the controlled responding node generates a content response based on the content request, the controlled requesting node receives an intermediate node response based on the content response, the controlled requesting node collects the requesting node data, the requesting node data including at least one of the node request, the intermediate node response, the controlled responding node collects responding node data including at least one of the content request and the content response, and the at least one system node determines a functionality of the intermediate node based on at least one of the requesting node data and the responding node data.

47. The system of claim 1, wherein at least one of the requesting node data and responding node data is stored in the logical data repository.

48. The system of claim 38, wherein the controlled requesting node determines whether a known set of data received from the controlled responding node has been modified.

49. The system of claim 48, wherein the system node discerns that the data has been modified and the intermediate node is not viable.

50. The system of claim 49, wherein the system node discerns how the data had been modified.

51. The system of claim 50, wherein the system node takes corrective measures to render the intermediate node viable.

52. The system of claim 1, wherein the controlled requesting node is further configured to iterate through a series of tests, the results of which are used by the system node to determine safety- or functionality-related data of the intermediate node.

53. The system of claim 52 wherein the tests comprise one selected from the group consisting of:

the controlled requesting node using different types of communication standards and comparing results of using each of the types of communication standard, the controlled requesting node using different TCP commands and comparing results of using each of the types of TCP command, and the controlled requesting node using different HTTP/TCP header values and comparing results of using each of the HTTP/TCP header values.

14. A method for obtaining and storing node data, and for identifying and categorizing intermediate nodes based on the node data the method comprising:

obtaining, by at least one system node, intermediate node data of at least one intermediate node;

applying, by the at least one system node, a plurality of rules comprising at least one custom expression command to the intermediate node data to extract candidate node data from the intermediate node data, wherein the custom expression command comprises a workflow process that is iteratively applied to the intermediate node data of the at least one intermediate node; and

sending and storing, by the at least one system node, the candidate node data to a logical data repository;

storing, by the logical data repository, candidate node data for at least one intermediate node;

testing the intermediate node by generating, by a controlled requesting node, at least one node request to a controlled responding node for target content based on the candidate node data of the at least one intermediate node;

determining, by at least one system node, if the intermediate node changes behavior in response to the at least one node request; and

categorizing, by the at least one system node, a type of the intermediate node and determining a safety or functional capability of the intermediate node, both the categorizing and the determining being based on requesting node data collected by the controlled requesting node as a result of testing the intermediate node, including the determination of whether the intermediate node behavior changes in response to the at least one node request, and the candidate node data.

15. The method of claim 14, further comprising storing, by the logical data repository, the candidate node data in the at least one system node.

16. The method of claim 14, further comprising storing, by the logical data repository, the candidate node data in at least one other node external to the at least one system node.

17. The method of claim 14, wherein the at least one intermediate node is a plurality of intermediate nodes.

18. The method of claim 17, further comprising reading, by the at least one system node, a set of intermediate node information including at least one Uniform Resource Identifier (URI), wherein the at least one URI points to a corresponding intermediate node of the plurality of intermediate nodes, and the intermediate node data for the corresponding source node is obtained by the at least one system node based on the at least one URI.

19. The method of claim 14, wherein the plurality of rules is stored by a dynamic rule repository.

20. The method of claim 19, further comprising iteratively applying, by the at least one system node, at least a portion of the plurality of rules to the intermediate node data of the at least one node to extract the candidate node data from the intermediate node data.

21. The method of claim 19, wherein the plurality of rules extract candidate node data having a plurality of different formats.

22. The method of claim 19, wherein the plurality of rules comprise at least one regular expression command.

23. The method of claim 19, further comprising creating, by a rule generation tool, rules based on input from a user and storing the created rules in the dynamic rule repository.

24. The method of claim 19, wherein, after a first rule is applied which successfully obtains candidate node data from the intermediate node data of the at least one intermediate node, the at least one system node does not apply the remainder of the plurality of rules to the intermediate node data of the at least one intermediate node.

25. The method of claim 19, further comprising applying, by the at least one system node, the plurality of rules by successively iterating through the plurality of rules in increasing complex logic to progressively filter content from the intermediate node data until a desired level of the candidate node data is obtained.

26. The method of claim 14, wherein the at least one intermediate node is a plurality of intermediate nodes of a given network, and the at least one rule is applied to the intermediate node data of each of the plurality of intermediate nodes of the given network to extract candidate node data for each said node of the given network, and the candidate node data for each said node of the given network is sent to the logical data repository.

27. The method of claim 14, wherein the at least one system node comprises at least one of the logical data repository, the controlled requesting node and the controlled responding node.

28. The method of claim 14, further comprising:

generating, by the controlled requesting node, a plurality of node requests to the controlled responding node for target content based on the candidate node data of the at least one intermediate node, wherein a communication type of each of the plurality of node requests is different; and

determining, by the at least one system node, one or more communication types supported by the intermediate node based on the plurality of node requests.

29. The method of claim 14, further comprising:

including, by the controlled requesting node, one or more static values in the node request;

receiving, by the controlled responding node, a content request from the intermediate node based on the node request; and

checking, by the controlled responding node, the one or more static values in the content request to determine a functionality of the intermediate node.

30. The method of claim 29, further comprising:

generating, by the controlled responding node, a content response including at least one of the one or more static values and at least one new static value;

receiving, by the controlled requesting node, an intermediate node response based on the content response; and

checking, by the controlled requesting node, the at least one of the one or more static values and the at least one new static value in the intermediate node response to determine a functionality of the intermediate node.

31. The method of claim 14, further comprising:

generating, by the controlled responding node, a content response including a script or piece of code;

receiving, by the controlled requesting node, an intermediate node response based on the content response; and

checking, by the controlled requesting node, the script or the piece of code in the intermediate node response to determine if the intermediate node is filtering the script or piece of code.

32. The method of claim 14, further comprising

determining, by the at least one system node, if an amount of traffic that the intermediate node can support changes based on a number of the node requests.

33. The method of claim 14, further comprising:

generating, by the controlled requesting node, a plurality of node requests to a controlled responding node based on the candidate node data of the at least one intermediate node, wherein a data type requested by each of the plurality of node requests is different; and

determining, by the at least one system node, one or more communication types supported data types supported by the intermediate node.

34. The method of claim 14, further comprising:

receiving, by the controlled responding node, a content request from the intermediate node based on the node request; and

checking, by the controlled responding node, the static values in the content request to determine a functionality of the intermediate node.

35. The method of claim 14, further comprising:

receiving, by the controlled responding node, a content request from the intermediate node based on the node request;

generating, by the controlled responding node, a content response based on the content request;

receiving, by the controlled requesting node, an intermediate node response based on the content response;

collecting, by the controlled requesting node, the requesting node data, the requesting node data including at least one of the node request, the intermediate node response;

collecting, by the controlled responding node, responding node data including at least one of the content request and the content response; and

determining, by the at least one system node, a functionality of the intermediate node based on at least one of the requesting node data and the responding node data.

36. The method of claim 35, further comprising storing at least one of the requesting node data and responding node data in the logical data repository.

37. The method of claim 14, further comprising determining whether a known set of data received from the controlled responding node has been modified.