Methods, media, and systems for securing communications between a first node and a second node

• US 9,419,981 B2
• Filed: 10/31/2006
• Issued: 08/16/2016
• Est. Priority Date: 10/31/2005
• Status: Active Grant

• Current Assignee: Trustees Of Columbia University In The City Of New York (Columbia University)
• Original Assignee: Trustees Of Columbia University In The City Of New York (Columbia University)
• Inventors: Stolfo, Salvatore J., Ciocarlie, Gabriela F., Frias-Martinez, Vanessa, Parekh, Janak, Keromytis, Angelos D., Sherrick, Joseph
• Primary Examiner(s): AVERY, JEREMIAH L
• Application Number:
  US12/092,224
• Publication Number:
  US 20110214161A1
• Time in Patent Office: 3,577 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Methods, media, and systems for securing communications between a first node and a second node are provided. In some embodiments, methods for securing communication between a first node and a second node are provided. The methods comprising: receiving at least one model of behavior of the second node at the first node; and authorizing the first node to receive traffic from the second node based on the difference between the at least one model of behavior of the second node and at least one model of behavior of the first node.

Claims

1. A method for securing communications between a first node and a second node, comprising:

receiving via a network at least one model of behavior of the second node at least one hardware processor of the first node, which the at least one model of behavior of the second node was generated by a node other than the first node and which at least one model of behavior of the second node represents a payload profile of normal traffic of the second node;

authorizing, using the at least one hardware processor of the first node, the first node to receive traffic from the second node based on how similar are the at least one model of behavior of the second node and at least one model of behavior of the first node, which at least one model of behavior of the first node represents a payload profile of normal traffic of the first node; and

rejecting, using the at least one hardware processor of the first node, traffic sent from the second node to the first node based on how different are the at least one model of behavior of the second node and the at least one model of behavior of the first node.

2. The method of claim 1, further comprising determining a distance between the at least one model of behavior of the second node and the at least one model of behavior of the first node.

3. The method of claim 2, further comprising comparing the distance to a threshold.

4. The method of claim 3, further comprising calculating the threshold based on the distance between the at least one model of behavior of the first node and at least one model of behavior of at least one other node.

5. The method of claim 1, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of output behavior.

6. The method of claim 1, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of input behavior.

7. The method of claim 1, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a Bloom filter.

8. The method of claim 1, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is the output of n-gram frequency analysis.

9. The method of claim 1, further comprising rejecting traffic sent to the first node from the second node based on how different are the at least one model of behavior of the second node and actual behavior of the second node.

10. The method of claim 9, wherein the actual behavior of the second node is its output behavior.

11. The method of claim 1, further comprising:

receiving at least one model of behavior of the first node at the second node; and

authorizing the second node to receive traffic from the first node based on how similar are the at least one model of behavior of the first node and the at least one model of behavior of the second node.

12. A device that secures communications between a first node and a second node, comprising:

an interface in communication with a network;

a memory; and

a processor in communication with the memory and the interface;

wherein the processor;

receives via a network at least one model of behavior of the second node, which the at least one model of behavior of the second node was generated by a node other than the first node and which at least one model of behavior of the second node represents a payload profile of normal traffic of the second node;

authorizes the first node to receive traffic from the second node based on how similar are the at least one model of behavior of the second node and at least one model of behavior of the first node, which at least one model of behavior of the first node represents a payload profile of normal traffic of the first node; and

rejects traffic sent from the second node to the first node based on how different are the at least one model of behavior of the second node and the at least one model of behavior of the first node.

13. The device of claim 12, wherein the processor further determines a distance between the at least one model of behavior of the second node and the at least one model of behavior of the first node.

14. The device of claim 13, wherein the processor further compares the distance to a threshold.

15. The device of claim 14, where the processor further calculates the threshold based on the distance between the at least one model of behavior of the first node and at least one model of behavior of at least one other node.

16. The device of claim 12, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of output behavior.

17. The device of claim 12, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of input behavior.

18. The device of claim 12, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a Bloom filter.

19. The device of claim 12, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is the output of n-gram frequency analysis.

20. The device of claim 12, where the processor further rejects traffic sent from the second node based on the difference between the at least one model of behavior of the second node and actual behavior of the second node.

21. The device of claim 20, wherein the actual behavior of the second node is its output behavior.

22. A non-transitory computer-readable medium containing computer executable instructions that, when executed by a processor of a first node, cause the processor to perform a method for securing communications between the first node and a second node, comprising:

receiving via a network at least one model of behavior of the second node, which the at least one model of behavior of the second node was generated by a node other than the first node and which at least one model of behavior of the second node represents a payload profile of normal traffic of the second node;

authorizing the first node to receive traffic from the second node based on how similar are the at least one model of behavior of the second node and at least one model of behavior of the first node, which at least one model of behavior of the first node represents a payload profile of normal traffic of the first node; and

rejecting traffic sent from the second node to the first node based on how different are the at least one model of behavior of the second node and the at least one model of behavior of the first node.

23. The non-transitory computer-readable medium of claim 22, the method further comprising determining a distance between the at least one model of behavior of the second node and the at least one model of behavior of the first node.

24. The non-transitory computer-readable medium of claim 23, the method further comprising comparing the distance to a threshold.

25. The non-transitory computer-readable medium of claim 24, the method further comprising calculating the threshold based on the distance between the at least one model of behavior of the first node and at least one model of behavior of at least one other node.

26. The non-transitory computer-readable medium of claim 22, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of output behavior.

27. The non-transitory computer-readable medium of claim 22, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of input behavior.

28. The non-transitory computer-readable medium of claim 22, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a Bloom filter.

29. The non-transitory computer-readable medium of claim 22, wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is the output of n-gram frequency analysis.

30. The non-transitory computer-readable medium of claim 22, the method further comprising rejecting traffic from the second node based on how different are the at least one model of behavior of the second node and actual behavior of the second node.

31. The non-transitory computer-readable medium of claim 30, wherein the actual behavior of the second node is its output behavior.