US20030229703A1 - Method and apparatus for identifying intrusions into a network data processing system - Google Patents

Method and apparatus for identifying intrusions into a network data processing system Download PDF

Info

Publication number
US20030229703A1
US20030229703A1 US10/165,079 US16507902A US2003229703A1 US 20030229703 A1 US20030229703 A1 US 20030229703A1 US 16507902 A US16507902 A US 16507902A US 2003229703 A1 US2003229703 A1 US 2003229703A1
Authority
US
United States
Prior art keywords
data processing
processing system
node
intrusion
network data
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US10/165,079
Inventor
Dolapo Falola
Vinit Jain
Shannon MacAlpine
Shawn Mullen
James Tesauro
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Airbnb Inc
Original Assignee
International Business Machines Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by International Business Machines Corp filed Critical International Business Machines Corp
Priority to US10/165,079 priority Critical patent/US20030229703A1/en
Assigned to INTERNATIONAL BUSINESS MACHINES CORPORATION reassignment INTERNATIONAL BUSINESS MACHINES CORPORATION ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: JAIN, VINIT, MULLEN, SHAWN PATRICK, TESAURO, JAMES STANLEY, FALOLA, DOLAPO MARTIN, MACALPINE, SHANNON MARIE
Publication of US20030229703A1 publication Critical patent/US20030229703A1/en
Priority to US12/819,502 priority patent/US8448189B2/en
Assigned to Airbnb, Inc. reassignment Airbnb, Inc. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: INTERNATIONAL BUSINESS MACHINES CORPORATION
Abandoned legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/14Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416Event detection, e.g. attack signature detection
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/146Tracing the source of attacks

Definitions

  • the present invention relates generally to an improved data processing system, and in particular, to a method and apparatus for handling intrusions. Still more particularly, the present invention provides a method and apparatus for identifying the source of an intrusion into a network data processing system.
  • Network data processing systems are commonly used in all aspects of business and research. These networks are used for communicating data and ideas as well as providing a repository to store information. Further, in many cases the different nodes making up a network data processing system may be employed to process information. Individual nodes may have different tasks to perform. Additionally, it is becoming more common to have the different nodes work towards solving a common problem, such as a complex calculation.
  • a set of nodes participating in a resource sharing scheme is also referred to as a “grid” or “grid network”. For example, nodes in a grid network may share processing resources to perform a complex computation, such as deciphering keys.
  • the nodes in a grid network may be contained within a network data processing system, such as a local area network (LAN) or a wide area network (WAN). These nodes also may be located in different geographically diverse locations. For example, different computers connected to the Internet may provide processing resources to a grid network. By applying the use of thousands of individual computers, large problems can be solved quickly. Grids are used in many areas, such as cancer research, physics, and geosciences. One problem with grids is that they are inherently vulnerable to network hacking because of the larger number of nodes typically present in grids.
  • the present invention provides a method, apparatus, and computer instructions for handling intrusions.
  • a tracer packet is sent back to an intruder causing the intrusion in response to receiving notification of an intrusion from a particular node in a network data processing system.
  • Nodes in the network data processing system are notified of the tracer packet.
  • Identification of the node is stored for use in tracing a route of the tracer packet through the data processing system in response to receiving a message from a node indicating receipt of the tracer packet.
  • FIG. 1 depicts a pictorial representation of a network of data processing systems in which the present invention may be implemented
  • FIG. 2 is a block diagram of a data processing system that may be implemented as a server in accordance with a preferred embodiment of the present invention
  • FIG. 3 is a block diagram illustrating a data processing system in which the present invention may be implemented
  • FIG. 4 is a diagram illustrating components used in tracking the source of an intrusion into a network data processing system in accordance with a preferred embodiment of the present invention
  • FIG. 5 is a diagram illustrating a set of connection parameters in accordance with a preferred embodiment of the present invention.
  • FIG. 6 is an example of a tracer packet illustrated in accordance with a preferred embodiment of the present invention.
  • FIG. 7 is a flowchart of a process used for handling detection of an intrusion in accordance with a preferred embodiment of the present invention.
  • FIG. 8 is a flowchart of a process used for monitoring for tracer packets in accordance with a preferred embodiment of the present invention.
  • FIG. 9 is a flowchart of a process used for handling a report of an intrusion in accordance with a preferred embodiment of the present invention.
  • FIG. 1 depicts a pictorial representation of a network of data processing systems in which the present invention may be implemented.
  • Network data processing system 100 is a network of computers in which the present invention may be implemented.
  • Network data processing system 100 contains a network 102 , which is the medium used to provide communications links between various devices and computers connected together within network data processing system 100 .
  • Network 102 may include connections, such as wire, wireless communication links, or fiber optic cables.
  • server 104 is connected to network 102 along with storage unit 106 .
  • clients 108 , 110 , and 112 are connected to network 102 . These clients 108 , 110 , and 112 may be, for example, personal computers or network computers.
  • server 104 provides data, such as boot files, operating system images, and applications to clients 108 - 112 .
  • Clients 108 , 110 , and 112 are clients to server 104 .
  • Network data processing system 100 may include additional servers, clients, and other devices not shown.
  • network data processing system 100 is the Internet with network 102 representing a worldwide collection of networks and gateways that use the Transmission Control Protocol/Internet Protocol (TCP/IP) suite of protocols to communicate with one another.
  • TCP/IP Transmission Control Protocol/Internet Protocol
  • network data processing system 100 also may be implemented as a number of different types of networks, such as for example, an intranet, a local area network (LAN), or a wide area network (WAN).
  • FIG. 1 is intended as an example, and not as an architectural limitation for the present invention.
  • the different servers and clients within network data processing system 100 are also referred to as nodes.
  • Data processing system 200 may be a symmetric multiprocessor (SMP) system including a plurality of processors 202 and 204 connected to system bus 206 . Alternatively, a single processor system may be employed. Also connected to system bus 206 is memory controller/cache 208 , which provides an interface to local memory 209 . I/O bus bridge 210 is connected to system bus 206 and provides an interface to I/O bus 212 . Memory controller/cache 208 and I/O bus bridge 210 may be integrated as depicted.
  • SMP symmetric multiprocessor
  • Peripheral component interconnect (PCI) bus bridge 214 connected to I/O bus 212 provides an interface to PCI local bus 216 .
  • PCI Peripheral component interconnect
  • a number of modems may be connected to PCI local bus 216 .
  • Typical PCI bus implementations will support four PCI expansion slots or add-in connectors.
  • Communications links to clients 108 - 112 in FIG. 1 may be provided through modem 218 and network adapter 220 connected to PCI local bus 216 through add-in boards.
  • Additional PCI bus bridges 222 and 224 provide interfaces for additional PCI local buses 226 and 228 , from which additional modems or network adapters may be supported. In this manner, data processing system 200 allows connections to multiple network computers.
  • a memory-mapped graphics adapter 230 and hard disk 232 may also be connected to I/O bus 212 as depicted, either directly or indirectly.
  • FIG. 2 may vary.
  • other peripheral devices such as optical disk drives and the like, also may be used in addition to or in place of the hardware depicted.
  • the depicted example is not meant to imply architectural limitations with respect to the present invention.
  • the data processing system depicted in FIG. 2 may be, for example, an IBM eServer pSeries system, a product of International Business Machines Corporation in Armonk, N.Y., running the Advanced Interactive Executive (AIX) operating system or LINUX operating system.
  • AIX Advanced Interactive Executive
  • Data processing system 300 is an example of a client computer.
  • Data processing system 300 employs a peripheral component interconnect (PCI) local bus architecture.
  • PCI peripheral component interconnect
  • AGP Accelerated Graphics Port
  • ISA Industry Standard Architecture
  • Processor 302 and main memory 304 are connected to PCI local bus 306 through PCI bridge 308 .
  • PCI bridge 308 also may include an integrated memory controller and cache memory for processor 302 . Additional connections to PCI local bus 306 may be made through direct component interconnection or through add-in boards.
  • local area network (LAN) adapter 310 SCSI host bus adapter 312 , and expansion bus interface 314 are connected to PCI local bus 306 by direct component connection.
  • audio adapter 316 graphics adapter 318 , and audio/video adapter 319 are connected to PCI local bus 306 by add-in boards inserted into expansion slots.
  • Expansion bus interface 314 provides a connection for a keyboard and mouse adapter 320 , modem 322 , and additional memory 324 .
  • Small computer system interface (SCSI) host bus adapter 312 provides a connection for hard disk drive 326 , tape drive 328 , and CD-ROM drive 330 .
  • Typical PCI local bus implementations will support three or four PCI expansion slots or add-in connectors.
  • An operating system runs on processor 302 and is used to coordinate and provide control of various components within data processing system 300 in FIG. 3.
  • the operating system may be a commercially available operating system, such as Windows XP, which is available from Microsoft Corporation.
  • An object oriented programming system such as Java may run in conjunction with the operating system and provide calls to the operating system from Java programs or applications executing on data processing system 300 . “Java” is a trademark of Sun Microsystems, Inc. Instructions for the operating system, the object-oriented operating system, and applications or programs are located on storage devices, such as hard disk drive 326 , and may be loaded into main memory 304 for execution by processor 302 .
  • FIG. 3 may vary depending on the implementation.
  • Other internal hardware or peripheral devices such as flash read-only memory (ROM), equivalent nonvolatile memory, or optical disk drives and the like, may be used in addition to or in place of the hardware depicted in FIG. 3.
  • the processes of the present invention may be applied to a multiprocessor data processing system.
  • data processing system 300 may be a personal digital assistant (PDA) device or a notebook computer.
  • PDA personal digital assistant
  • the present invention recognizes that one characteristic of a grid is that different nodes within the grid may be geographically diverse. The nodes may be scattered throughout the Internet.
  • the present invention takes advantage of this characteristic in providing a security tool. Routers are used to segregate Internet protocol (IP) packets and keep packets in line to their destination. Although this feature often prevents an unauthorized intruder from being easily tracked down, the present invention also recognizes that IP packets originating from a hacker can be uniquely identified by the IP checksum or very accurately identified by computing a digest on the packet of payloads.
  • IP Internet protocol
  • the present invention recognizes that these packets cannot be detected from a single point, but within a network data processing system, such as a LAN, a WAN, or the Internet, a central command point may be employed to tell different nodes within a network what IP packet characteristics should be reported. The reports of IP packets meeting these characteristics may be used by the central command point to identify a route back to the source of the intrusion.
  • a network data processing system such as a LAN, a WAN, or the Internet
  • nodes, 400 , 402 , 404 , 406 , 408 , 410 , and 412 are nodes in a grid.
  • Nodes 414 , 416 , and 418 are nodes that are not part of the grid. In this example, these nodes are all nodes that are part of the Internet.
  • Node 414 is the hacker source in this example, while node 406 is the victim.
  • a hacker connects from node 414 and makes a connection to node 416 . This connection may be, for example, via telnet.
  • the hacker takes over node 416 and from this node attacks and takes over node 418 . From node 418 , the hacker attacks and takes over node 402 and uses this node to connect to and take over node 404 . From node 404 , the hacker reaches and attacks node 406 , which is the victim.
  • the hacker at node 414 breaks into multiple machines making it difficult to trace the source of the attack.
  • Node 406 detects an attack, but only sees packets originating from node 404 .
  • the mechanism of the present invention is able to trace a path back to node 414 through connections 420 and 422 to identify a point in which the hacker first entered the grid.
  • node 406 upon detecting the intrusion, does not break communication with the attacker. Node 406 , however, does not send or receive data using the connection established by the hacker to avoid any further damage to this node. Node 406 notifies a “grid security eye”, which is a central command point for use in identifying a source of intrusions.
  • the grid security eye is embodied in node 400 .
  • the notification includes connection parameters for the connection made by the intruder, which is illustrated in FIG. 5.
  • connection parameters 500 contains connection information, such as source IP address 502 , destination IP address 504 , protocol 506 , ports 508 , and sequence number 510 .
  • Connection parameters 500 are illustrated as examples and the particular parameters may vary depending on the type of connection used in the intrusion.
  • tracer packet 424 is generated. This tracer packet is made to appear is if it originated from the victim node, node 406 .
  • FIG. 6, is a diagram illustrating a tracer packet used to identify the source of an intrusion.
  • Tracer packet 600 includes a header 602 and a payload 604 .
  • tracer packet 600 includes source 606 and destination 608 .
  • Source 606 is the IP address of the victim while destination 608 is the IP address of the node next to the victim.
  • the source is node 406 and the destination is node 404 in FIG. 4.
  • payload 604 includes identifier 610 .
  • the identifier may be used to generate a unique digital fingerprint.
  • An algorithm such as MD5 or SHA, may be used to generate a digital fingerprint from this identifier.
  • Identifier 610 is tailored for the type of connection used by the hacker. For example, if the connection is through a telnet session, identifier 610 and payload 604 would include a series of spaces and backspaces. Such a payload may cause the cursor at node 414 , in FIG. 4, to flutter but would not necessarily tip off the hacker that the intrusion has been identified and is being traced.
  • all of the nodes within the grid are notified or requested to monitor for tracer packet 424 .
  • the nodes are sent an identifier, such as identifier 610 , in FIG. 6, for use in detecting whether tracer packet 424 has been received by a particular node.
  • tracer packet 424 is sent to node 404 from node 400 .
  • node 404 identifies tracer packet 424 based on the identifier located within tracer packet 424
  • notification is sent to node 400 that the packet has been received by node 404 .
  • node 404 sends tracer packet 424 to node 402 , which identifies this packet as a tracer packet and sends tracer packet 424 on to node 418 .
  • node 402 sends a notification or report to node 400 that tracer packet 424 has been received by this node.
  • Node 418 is not part of the grid and will send the packet on to node 416 , which in turn sends the packet back to node 414 , the source of the intrusion.
  • Node 414 treats tracer packet 424 as a corrupted packet or as garbage and discards tracer packet 424 .
  • the entry point into the grid at node 402 is identified and any necessary actions to prevent intrusions at this point may be taken.
  • the hacker is located at a grid node, then the source of the hacker may be pinpointed to a specific machine.
  • a grid node is not along the path in the connection setup between the hacker source and the victim, but the node may detect a packet that is not intended for the node. In such an instance, the node still alerts the grid security eye of the vicinity of the tracer.
  • the ability to track the tracer packet goes beyond having only nodes that are part of the hacker break-in path report detecting the tracer packet.
  • the mechanism of the present invention includes having all participating grid nodes look for the tracer packet.
  • the grid security eye, node 400 sends a message to all participating grid nodes to be on the lookout for the tracer packet. Then, all nodes start monitoring all of the network traffic. This type of monitoring may be performed by monitoring the network in a promiscuous mode (iptrace in AIX, snoop in Solaris). Thus, in a preferred embodiment of the present invention, nodes 412 and 410 would report seeing the tracer packet going into the hacker node 414 .
  • FIG. 7 a flowchart of a process used for handling detection of an intrusion is depicted in accordance with a preferred embodiment of the present invention.
  • the process illustrated in FIG. 7 may be implemented in a node, such as node 406 in FIG. 4.
  • the process begins by monitoring for an intrusion (step 700 ).
  • the monitoring for intrusions may be implemented using various known mechanisms for detecting unauthorized access.
  • promiscuous network monitoring may be employed in which the node sees all network traffic. Examples are Iptrace in AIX and snoop with Solaris.
  • connection parameters are identified (step 704 ). Examples of connection parameters are illustrated in connection parameters 500 in FIG. 5. of course, the particular types of parameters will depend on the type of connection used in the attack. Notification is sent to the grid security eye (step 706 ) and communication with the attacker ceases (step 708 ). The connection is maintained (step 710 ) and the process terminates thereafter. The connection is maintained to avoid alerting the attacker to the fact that the intrusion has been detected.
  • step 702 if an intrusion is not detected, the process returns to step 700 as described above.
  • FIG. 8 a flowchart of a process used for monitoring for tracer packets is depicted in accordance with a preferred embodiment of the present invention.
  • the process illustrated in FIG. 8 may be implemented in a node, such as node 402 or 412 in FIG. 4. Specifically, this process may be implemented in any node within a network.
  • the process begins by receiving a packet (step 800 ).
  • a determination is made as to whether the packet is a tracer packet (step 802 ). This determination may be made by comparing information in the packet with information received from the grid security eye. For example, this information may be an identifier containing a digital signature. If the packet is a tracker packet, the tracker packet sighting is reported to the security grid eye (step 804 ) and the process terminates thereafter. This report may include, for example, the identification of the node and a time stamp identifying when a packet was received.
  • step 802 if the packet is not a tracer packet, the process terminates.
  • FIG. 9 a flowchart of a process used for handling a report of an intrusion is depicted in accordance with a preferred embodiment of the present invention.
  • the process illustrated in FIG. 9 may be implemented in a command node or grid security eye, such as node 400 in FIG. 4.
  • the process begins by receiving an intrusion notification (step 900 ).
  • the intrusion notification also includes connection parameters, such as connection parameters 500 in FIG. 5.
  • a tracer packet is generated (step 902 ). Notification is sent to all nodes in the grid to snoop for the tracer packet (step 904 ). This notification allows for all of the nodes in a network to monitor for the tracer packet. For example, an identifier, such as a digital signature or other unique identification information in the payload or elsewhere in the packet may be sent to all of the nodes within the network for use in monitoring for the tracer packet.
  • the tracer packet is sent to the node identified in the connection parameters as the source (step 906 ). Monitoring for a report of the tracer packet is initiated (step 908 ).
  • step 910 a determination is made as to whether a report has been received. If a report has been received, the node information from the report is stored (step 912 ). A determination is made as to whether monitoring is completed (step 914 ). Monitoring may finish or complete if the source or the entry point of the attack is identified. If monitoring is completed, the process terminates. Otherwise, the process returns to step 908 as described above.
  • step 916 a determination is made as to whether a timeout has occurred. If a timeout has occurred, the process terminates. If a timeout has not occurred, the process returns to step 908 as described above.
  • the reports may be used to generate or identify a route through which the hacker has used to attack the victim. With this information, the location of the hacker or an entry point may be identified with appropriate security measures being taken based on the identification.
  • the present invention provides an improved method, apparatus, and computer instructions for identifying a source of an intrusion.
  • the actual location of the hacker or an entry point into the network may be identified using the mechanism of the present invention.
  • a tracer packet and a monitoring process are used to detect a path within the network along which intrusions have occurred. In this manner, attacks on a network, such as a grid, may be quickly identified and handled.

Abstract

A method, apparatus, and computer instructions for handling intrusions. A tracer packet is sent back to an intruder causing the intrusion in response to receiving notification of an intrusion from a particular node in a network data processing system. Nodes in the network data processing system are notified of the tracer packet. Identification of the node is stored for use in tracing a route of the tracer packet through the data processing system in response to receiving a message from a node indicating receipt of the tracer packet.

Description

    BACKGROUND OF THE INVENTION
  • 1. Technical Field [0001]
  • The present invention relates generally to an improved data processing system, and in particular, to a method and apparatus for handling intrusions. Still more particularly, the present invention provides a method and apparatus for identifying the source of an intrusion into a network data processing system. [0002]
  • 2. Description of Related Art [0003]
  • Network data processing systems are commonly used in all aspects of business and research. These networks are used for communicating data and ideas as well as providing a repository to store information. Further, in many cases the different nodes making up a network data processing system may be employed to process information. Individual nodes may have different tasks to perform. Additionally, it is becoming more common to have the different nodes work towards solving a common problem, such as a complex calculation. A set of nodes participating in a resource sharing scheme is also referred to as a “grid” or “grid network”. For example, nodes in a grid network may share processing resources to perform a complex computation, such as deciphering keys. [0004]
  • The nodes in a grid network may be contained within a network data processing system, such as a local area network (LAN) or a wide area network (WAN). These nodes also may be located in different geographically diverse locations. For example, different computers connected to the Internet may provide processing resources to a grid network. By applying the use of thousands of individual computers, large problems can be solved quickly. Grids are used in many areas, such as cancer research, physics, and geosciences. One problem with grids is that they are inherently vulnerable to network hacking because of the larger number of nodes typically present in grids. [0005]
  • Currently, hackers attack victim computers through a maze of network hops to mask the true location and identity of the source of the attacks. Typically, a hacker or other unauthorized user will take over one node and then from that node take over another node. This series of takeovers occurs until reaching a targeted victim. Current computer forensic methods may take months to track down a hacker if identifying a source is even possible. Therefore, it would be advantageous to have an improved method, apparatus, and computer instructions for identifying and tracking intrusions into nodes in a network data processing system, such as a grid. [0006]
  • SUMMARY OF THE INVENTION
  • The present invention provides a method, apparatus, and computer instructions for handling intrusions. A tracer packet is sent back to an intruder causing the intrusion in response to receiving notification of an intrusion from a particular node in a network data processing system. Nodes in the network data processing system are notified of the tracer packet. Identification of the node is stored for use in tracing a route of the tracer packet through the data processing system in response to receiving a message from a node indicating receipt of the tracer packet. [0007]
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as a preferred mode of use, further objectives and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein: [0008]
  • FIG. 1 depicts a pictorial representation of a network of data processing systems in which the present invention may be implemented; [0009]
  • FIG. 2 is a block diagram of a data processing system that may be implemented as a server in accordance with a preferred embodiment of the present invention; [0010]
  • FIG. 3 is a block diagram illustrating a data processing system in which the present invention may be implemented; [0011]
  • FIG. 4 is a diagram illustrating components used in tracking the source of an intrusion into a network data processing system in accordance with a preferred embodiment of the present invention; [0012]
  • FIG. 5 is a diagram illustrating a set of connection parameters in accordance with a preferred embodiment of the present invention; [0013]
  • FIG. 6 is an example of a tracer packet illustrated in accordance with a preferred embodiment of the present invention; [0014]
  • FIG. 7 is a flowchart of a process used for handling detection of an intrusion in accordance with a preferred embodiment of the present invention; [0015]
  • FIG. 8 is a flowchart of a process used for monitoring for tracer packets in accordance with a preferred embodiment of the present invention; and [0016]
  • FIG. 9 is a flowchart of a process used for handling a report of an intrusion in accordance with a preferred embodiment of the present invention. [0017]
  • DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT
  • With reference now to the figures, FIG. 1 depicts a pictorial representation of a network of data processing systems in which the present invention may be implemented. Network [0018] data processing system 100 is a network of computers in which the present invention may be implemented. Network data processing system 100 contains a network 102, which is the medium used to provide communications links between various devices and computers connected together within network data processing system 100. Network 102 may include connections, such as wire, wireless communication links, or fiber optic cables. In the depicted example, server 104 is connected to network 102 along with storage unit 106. In addition, clients 108, 110, and 112 are connected to network 102. These clients 108, 110, and 112 may be, for example, personal computers or network computers. In the depicted example, server 104 provides data, such as boot files, operating system images, and applications to clients 108-112. Clients 108, 110, and 112 are clients to server 104. Network data processing system 100 may include additional servers, clients, and other devices not shown.
  • In the depicted example, network [0019] data processing system 100 is the Internet with network 102 representing a worldwide collection of networks and gateways that use the Transmission Control Protocol/Internet Protocol (TCP/IP) suite of protocols to communicate with one another. At the heart of the Internet is a backbone of high-speed data communication lines between major nodes or host computers, consisting of thousands of commercial, government, educational and other computer systems that route data and messages. Of course, network data processing system 100 also may be implemented as a number of different types of networks, such as for example, an intranet, a local area network (LAN), or a wide area network (WAN). FIG. 1 is intended as an example, and not as an architectural limitation for the present invention. The different servers and clients within network data processing system 100 are also referred to as nodes.
  • Referring to FIG. 2, a block diagram of a data processing system that may be implemented as a server, such as [0020] server 104 in FIG. 1, is depicted in accordance with a preferred embodiment of the present invention. Data processing system 200 may be a symmetric multiprocessor (SMP) system including a plurality of processors 202 and 204 connected to system bus 206. Alternatively, a single processor system may be employed. Also connected to system bus 206 is memory controller/cache 208, which provides an interface to local memory 209. I/O bus bridge 210 is connected to system bus 206 and provides an interface to I/O bus 212. Memory controller/cache 208 and I/O bus bridge 210 may be integrated as depicted.
  • Peripheral component interconnect (PCI) [0021] bus bridge 214 connected to I/O bus 212 provides an interface to PCI local bus 216. A number of modems may be connected to PCI local bus 216. Typical PCI bus implementations will support four PCI expansion slots or add-in connectors. Communications links to clients 108-112 in FIG. 1 may be provided through modem 218 and network adapter 220 connected to PCI local bus 216 through add-in boards.
  • Additional [0022] PCI bus bridges 222 and 224 provide interfaces for additional PCI local buses 226 and 228, from which additional modems or network adapters may be supported. In this manner, data processing system 200 allows connections to multiple network computers. A memory-mapped graphics adapter 230 and hard disk 232 may also be connected to I/O bus 212 as depicted, either directly or indirectly.
  • Those of ordinary skill in the art will appreciate that the hardware depicted in FIG. 2 may vary. For example, other peripheral devices, such as optical disk drives and the like, also may be used in addition to or in place of the hardware depicted. The depicted example is not meant to imply architectural limitations with respect to the present invention. [0023]
  • The data processing system depicted in FIG. 2 may be, for example, an IBM eServer pSeries system, a product of International Business Machines Corporation in Armonk, N.Y., running the Advanced Interactive Executive (AIX) operating system or LINUX operating system. [0024]
  • With reference now to FIG. 3, a block diagram illustrating a data processing system is depicted in which the present invention may be implemented. [0025] Data processing system 300 is an example of a client computer. Data processing system 300 employs a peripheral component interconnect (PCI) local bus architecture. Although the depicted example employs a PCI bus, other bus architectures such as Accelerated Graphics Port (AGP) and Industry Standard Architecture (ISA) may be used. Processor 302 and main memory 304 are connected to PCI local bus 306 through PCI bridge 308. PCI bridge 308 also may include an integrated memory controller and cache memory for processor 302. Additional connections to PCI local bus 306 may be made through direct component interconnection or through add-in boards. In the depicted example, local area network (LAN) adapter 310, SCSI host bus adapter 312, and expansion bus interface 314 are connected to PCI local bus 306 by direct component connection. In contrast, audio adapter 316, graphics adapter 318, and audio/video adapter 319 are connected to PCI local bus 306 by add-in boards inserted into expansion slots. Expansion bus interface 314 provides a connection for a keyboard and mouse adapter 320, modem 322, and additional memory 324. Small computer system interface (SCSI) host bus adapter 312 provides a connection for hard disk drive 326, tape drive 328, and CD-ROM drive 330. Typical PCI local bus implementations will support three or four PCI expansion slots or add-in connectors.
  • An operating system runs on [0026] processor 302 and is used to coordinate and provide control of various components within data processing system 300 in FIG. 3. The operating system may be a commercially available operating system, such as Windows XP, which is available from Microsoft Corporation. An object oriented programming system such as Java may run in conjunction with the operating system and provide calls to the operating system from Java programs or applications executing on data processing system 300. “Java” is a trademark of Sun Microsystems, Inc. Instructions for the operating system, the object-oriented operating system, and applications or programs are located on storage devices, such as hard disk drive 326, and may be loaded into main memory 304 for execution by processor 302.
  • Those of ordinary skill in the art will appreciate that the hardware in FIG. 3 may vary depending on the implementation. Other internal hardware or peripheral devices, such as flash read-only memory (ROM), equivalent nonvolatile memory, or optical disk drives and the like, may be used in addition to or in place of the hardware depicted in FIG. 3. Also, the processes of the present invention may be applied to a multiprocessor data processing system. [0027]
  • The depicted example in FIG. 3 and above-described examples are not meant to imply architectural limitations. As a further example, [0028] data processing system 300 may be a personal digital assistant (PDA) device or a notebook computer.
  • The present invention recognizes that one characteristic of a grid is that different nodes within the grid may be geographically diverse. The nodes may be scattered throughout the Internet. The present invention takes advantage of this characteristic in providing a security tool. Routers are used to segregate Internet protocol (IP) packets and keep packets in line to their destination. Although this feature often prevents an unauthorized intruder from being easily tracked down, the present invention also recognizes that IP packets originating from a hacker can be uniquely identified by the IP checksum or very accurately identified by computing a digest on the packet of payloads. The present invention recognizes that these packets cannot be detected from a single point, but within a network data processing system, such as a LAN, a WAN, or the Internet, a central command point may be employed to tell different nodes within a network what IP packet characteristics should be reported. The reports of IP packets meeting these characteristics may be used by the central command point to identify a route back to the source of the intrusion. [0029]
  • With reference now to FIG. 4, a diagram illustrating components used in tracking the source of an intrusion into a network data processing system is depicted in accordance with a preferred embodiment of the present invention. In this example, nodes, [0030] 400, 402, 404, 406, 408, 410, and 412 are nodes in a grid. Nodes 414, 416, and 418 are nodes that are not part of the grid. In this example, these nodes are all nodes that are part of the Internet. Node 414 is the hacker source in this example, while node 406 is the victim. A hacker connects from node 414 and makes a connection to node 416. This connection may be, for example, via telnet. The hacker takes over node 416 and from this node attacks and takes over node 418. From node 418, the hacker attacks and takes over node 402 and uses this node to connect to and take over node 404. From node 404, the hacker reaches and attacks node 406, which is the victim.
  • In this example, the hacker at [0031] node 414 breaks into multiple machines making it difficult to trace the source of the attack. Node 406 detects an attack, but only sees packets originating from node 404. In this example, the mechanism of the present invention is able to trace a path back to node 414 through connections 420 and 422 to identify a point in which the hacker first entered the grid.
  • Basically, [0032] node 406, upon detecting the intrusion, does not break communication with the attacker. Node 406, however, does not send or receive data using the connection established by the hacker to avoid any further damage to this node. Node 406 notifies a “grid security eye”, which is a central command point for use in identifying a source of intrusions. In this example, the grid security eye is embodied in node 400. The notification includes connection parameters for the connection made by the intruder, which is illustrated in FIG. 5.
  • Turning now to FIG. 5, a diagram illustrating a set of connection parameters is depicted in accordance with a preferred embodiment of the present invention. In this example, [0033] connection parameters 500 contains connection information, such as source IP address 502, destination IP address 504, protocol 506, ports 508, and sequence number 510. Connection parameters 500 are illustrated as examples and the particular parameters may vary depending on the type of connection used in the intrusion.
  • With reference back to FIG. 4, when the grid security eye, represented by [0034] node 400, receives connection parameters, such as connection parameters 500 in FIG. 5, from node 406, tracer packet 424 is generated. This tracer packet is made to appear is if it originated from the victim node, node 406. An example of a tracer packet is illustrated in FIG. 6, which is a diagram illustrating a tracer packet used to identify the source of an intrusion. Tracer packet 600 includes a header 602 and a payload 604. As formed by the grid security eye, tracer packet 600 includes source 606 and destination 608. Source 606 is the IP address of the victim while destination 608 is the IP address of the node next to the victim. In this example, the source is node 406 and the destination is node 404 in FIG. 4.
  • In this example, [0035] payload 604 includes identifier 610. In this example, the identifier may be used to generate a unique digital fingerprint. An algorithm, such as MD5 or SHA, may be used to generate a digital fingerprint from this identifier. Identifier 610 is tailored for the type of connection used by the hacker. For example, if the connection is through a telnet session, identifier 610 and payload 604 would include a series of spaces and backspaces. Such a payload may cause the cursor at node 414, in FIG. 4, to flutter but would not necessarily tip off the hacker that the intrusion has been identified and is being traced.
  • Turning back to FIG. 4, all of the nodes within the grid are notified or requested to monitor for [0036] tracer packet 424. In this example, the nodes are sent an identifier, such as identifier 610, in FIG. 6, for use in detecting whether tracer packet 424 has been received by a particular node. Thereafter, tracer packet 424 is sent to node 404 from node 400. As node 404 identifies tracer packet 424 based on the identifier located within tracer packet 424, notification is sent to node 400 that the packet has been received by node 404. Thereafter, node 404 sends tracer packet 424 to node 402, which identifies this packet as a tracer packet and sends tracer packet 424 on to node 418. In addition, node 402 sends a notification or report to node 400 that tracer packet 424 has been received by this node. Node 418 is not part of the grid and will send the packet on to node 416, which in turn sends the packet back to node 414, the source of the intrusion. Node 414 treats tracer packet 424 as a corrupted packet or as garbage and discards tracer packet 424.
  • Through these notifications, the entry point into the grid at [0037] node 402 is identified and any necessary actions to prevent intrusions at this point may be taken. In some cases, if the hacker is located at a grid node, then the source of the hacker may be pinpointed to a specific machine.
  • In some cases, a grid node is not along the path in the connection setup between the hacker source and the victim, but the node may detect a packet that is not intended for the node. In such an instance, the node still alerts the grid security eye of the vicinity of the tracer. In the depicted examples, the ability to track the tracer packet goes beyond having only nodes that are part of the hacker break-in path report detecting the tracer packet. Such a feature allows for a situation in which a hacker breaks into a grid node and disables the node's ability to report seeing a tracer packet. The mechanism of the present invention includes having all participating grid nodes look for the tracer packet. The grid security eye, [0038] node 400, sends a message to all participating grid nodes to be on the lookout for the tracer packet. Then, all nodes start monitoring all of the network traffic. This type of monitoring may be performed by monitoring the network in a promiscuous mode (iptrace in AIX, snoop in Solaris). Thus, in a preferred embodiment of the present invention, nodes 412 and 410 would report seeing the tracer packet going into the hacker node 414.
  • With reference now to FIG. 7, a flowchart of a process used for handling detection of an intrusion is depicted in accordance with a preferred embodiment of the present invention. The process illustrated in FIG. 7 may be implemented in a node, such as [0039] node 406 in FIG. 4.
  • The process begins by monitoring for an intrusion (step [0040] 700). The monitoring for intrusions may be implemented using various known mechanisms for detecting unauthorized access. For example, promiscuous network monitoring may be employed in which the node sees all network traffic. Examples are Iptrace in AIX and snoop with Solaris.
  • A determination is made as to whether an intrusion has been detected (step [0041] 702). If an intrusion has been detected, connection parameters are identified (step 704). Examples of connection parameters are illustrated in connection parameters 500 in FIG. 5. of course, the particular types of parameters will depend on the type of connection used in the attack. Notification is sent to the grid security eye (step 706) and communication with the attacker ceases (step 708). The connection is maintained (step 710) and the process terminates thereafter. The connection is maintained to avoid alerting the attacker to the fact that the intrusion has been detected.
  • Referring again to step [0042] 702, if an intrusion is not detected, the process returns to step 700 as described above.
  • Turning now to FIG. 8, a flowchart of a process used for monitoring for tracer packets is depicted in accordance with a preferred embodiment of the present invention. The process illustrated in FIG. 8 may be implemented in a node, such as [0043] node 402 or 412 in FIG. 4. Specifically, this process may be implemented in any node within a network.
  • The process begins by receiving a packet (step [0044] 800). A determination is made as to whether the packet is a tracer packet (step 802). This determination may be made by comparing information in the packet with information received from the grid security eye. For example, this information may be an identifier containing a digital signature. If the packet is a tracker packet, the tracker packet sighting is reported to the security grid eye (step 804) and the process terminates thereafter. This report may include, for example, the identification of the node and a time stamp identifying when a packet was received.
  • Referring again to step [0045] 802, if the packet is not a tracer packet, the process terminates.
  • With reference now to FIG. 9, a flowchart of a process used for handling a report of an intrusion is depicted in accordance with a preferred embodiment of the present invention. The process illustrated in FIG. 9 may be implemented in a command node or grid security eye, such as [0046] node 400 in FIG. 4.
  • The process begins by receiving an intrusion notification (step [0047] 900). In these examples, the intrusion notification also includes connection parameters, such as connection parameters 500 in FIG. 5. A tracer packet is generated (step 902). Notification is sent to all nodes in the grid to snoop for the tracer packet (step 904). This notification allows for all of the nodes in a network to monitor for the tracer packet. For example, an identifier, such as a digital signature or other unique identification information in the payload or elsewhere in the packet may be sent to all of the nodes within the network for use in monitoring for the tracer packet. The tracer packet is sent to the node identified in the connection parameters as the source (step 906). Monitoring for a report of the tracer packet is initiated (step 908).
  • Next, a determination is made as to whether a report has been received (step [0048] 910). If a report has been received, the node information from the report is stored (step 912). A determination is made as to whether monitoring is completed (step 914). Monitoring may finish or complete if the source or the entry point of the attack is identified. If monitoring is completed, the process terminates. Otherwise, the process returns to step 908 as described above.
  • Referring again to step [0049] 910, if a report has not been received, a determination is made as to whether a timeout has occurred (step 916). If a timeout has occurred, the process terminates. If a timeout has not occurred, the process returns to step 908 as described above. The reports may be used to generate or identify a route through which the hacker has used to attack the victim. With this information, the location of the hacker or an entry point may be identified with appropriate security measures being taken based on the identification.
  • Thus, the present invention provides an improved method, apparatus, and computer instructions for identifying a source of an intrusion. Specifically, the actual location of the hacker or an entry point into the network may be identified using the mechanism of the present invention. A tracer packet and a monitoring process are used to detect a path within the network along which intrusions have occurred. In this manner, attacks on a network, such as a grid, may be quickly identified and handled. [0050]
  • It is important to note that while the present invention has been described in the context of a fully functioning data processing system, those of ordinary skill in the art will appreciate that the processes of the present invention are capable of being distributed in the form of a computer readable medium of instructions and a variety of forms and that the present invention applies equally regardless of the particular type of signal bearing media actually used to carry out the distribution. Examples of computer readable media include recordable-type media, such as a floppy disk, a hard disk drive, a RAM, CD-ROMs, DVD-ROMs, and transmission-type media, such as digital and analog communications links, wired or wireless communications links using transmission forms, such as, for example, radio frequency and light wave transmissions. The computer readable media may take the form of coded formats that are decoded for actual use in a particular data processing system. [0051]
  • The description of the present invention has been presented for purposes of illustration and description, and is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art. In these examples, the processes of the present invention were described as implemented in a grid. The mechanism of the present invention may be applied to other types of networks including, for example, a LAN or a WAN. Further, the mechanism of the present invention may be applied to any type of connection or protocol used in an intrusion. The embodiment was chosen and described in order to best explain the principles of the invention, the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated. [0052]

Claims (21)

What is claimed is:
1. A method in a data processing system for handling intrusions, the method comprising:
responsive to receiving notification of an intrusion from a particular node in a network data processing system, sending a tracer packet back to an intruder causing the intrusion;
notifying nodes in the network data processing system of the tracer packet; and
responsive to receiving a message from a node indicating receipt of the tracer packet, storing identification of the node for use in tracing a route of the tracer packet through the data processing system.
2. The method of claim 1 further comprising:
determining whether the intruder is a node within the network data processing system using the route; and
responsive to the intruder being a node within the network data processing system, revoking access by the intruder to other nodes within the network data processing system.
3. The method of claim 2 further comprising:
responsive to the intruder being a node outside of the network data processing system, identifying an entry node serving as an entry point into the network data processing system; and
preventing access to the entry node.
4. The method of claim 1, wherein the network data processing system is a grid.
5. A method in a data processing system for handling an intrusion, wherein the data processing system is located within a network data processing system, the method comprising:
detecting an intrusion by a attacking node, wherein a connection is established with the attacking node;
responsive to detecting the intrusion, sending a notification of the intrusion to a security node in the network data processing system;
ceasing communication with the attacking node; and
maintaining the connection with the attacking node.
6. The method of claim 5, wherein the network data processing system is a grid.
7. The method of claim 5, wherein the attacking node is a node within the network data processing system.
8. The method of claim 5, wherein the attacking node is a node outside of the network data processing system.
9. A network data processing system comprising:
a network;
a security node connected to the network; and
a plurality of nodes connected to the network, wherein a victim node within the plurality of nodes sends an intrusion alert to the security node in response to detecting an attack in which the intrusion alert includes information about the intrusion, the security node sends a tracer packet onto the network and notifies the plurality of nodes of the tracer pack when an intrusion alert is received, each of the plurality of nodes looks for the tracer packet and sends a message to the security node when the tracer packet in which the message indicates reception of the tracer node, and the security node stores information about nodes within the plurality of nodes receiving the tracer packet for use in identifying a route of the tracer packet in the network data processing system.
10. A data processing system for handling intrusions, the data processing system comprising:
a bus system;
a communications unit connected to the bus system;
a memory connected to the bus system, wherein the memory includes a set of instructions; and
a processing unit connected to the bus system, wherein the processing unit executes the set of instructions to send a tracer packet back to an intruder causing the intrusion in response to receiving notification of an intrusion from a particular node in a network data processing system; notify nodes in the network data processing system of the tracer packet; and store identification of the node for use in tracing a route of the tracer packet through the data processing system in response to receiving a message from a node indicating receipt of the tracer packet.
11. A data processing system for handling an intrusion, the data processing system comprising:
a bus system;
a communications unit connected to the bus system;
a memory connected to the bus system, wherein the memory includes a set of instructions; and
a processing unit connected to the bus system, wherein the processing unit executes the set of instructions to detect an intrusion by a attacking node in which a connection is established with the attacking node; send a notification of the intrusion to a security node in the network data processing system in response to detecting the intrusion; cease communication with the attacking node; and maintain the connection with the attacking node.
12. A data processing system for handling intrusions, the data processing system comprising:
sending means, responsive to receiving notification of an intrusion from a particular node in a network data processing system, for sending a tracer packet back to an intruder causing the intrusion;
notifying means for notifying nodes in the network data processing system of the tracer packet; and
storing means, responsive to receiving a message from a node indicating receipt of the tracer packet, for storing identification of the node for use in tracing a route of the tracer packet through the data processing system.
13. The data processing system of claim 12 further comprising:
determining means for determining whether the intruder is a node within the network data processing system using the route; and
revoking means, responsive to the intruder being a node within the network data processing system, for revoking access by the intruder to other nodes within the network data processing system.
14. The data processing system of claim 13 further comprising:
identifying means, responsive to the intruder being a node outside of the network data processing system, for identifying an entry node serving as an entry point into the network data processing system; and
preventing means for preventing access to the entry node.
15. The data processing system of claim 12, wherein the network data processing system is a grid.
16. A data processing system for handling an intrusion, wherein the data processing system is located within a network data processing system, the data processing system comprising:
detecting means for detecting an intrusion by a attacking node, wherein a connection is established with the attacking node;
sending means, responsive to detecting the intrusion, for sending a notification of the intrusion to a security node in the network data processing system;
ceasing means for ceasing communication with the attacking node; and
maintaining means for maintaining the connection with the attacking node.
17. The data processing system of claim 16, wherein the network data processing system is a grid.
18. The data processing system of claim 16, wherein the attacking node is a node within the network data processing system.
19. The data processing system of claim 16, wherein the attacking node is a node outside of the network data processing system.
20. A computer program product in a computer readable medium for handling intrusions, the computer program product comprising:
first instructions, responsive to receiving notification of an intrusion from a particular node in a network data processing system, for sending a tracer packet back to an intruder causing the intrusion;
second instructions for notifying nodes in the network data processing system of the tracer packet; and
third instructions, responsive to receiving a message from a node indicating receipt of the tracer packet, for storing identification of the node for use in tracing a route of the tracer packet through the data processing system.
21. A computer program product in a computer readable medium for handling an intrusion in a data processing system located within a network data processing system, the computer program product comprising:
first instructions for detecting an intrusion by a attacking node, wherein a connection is established with the attacking node;
second instructions, responsive to detecting the intrusion, for sending a notification of the intrusion to a security node in the network data processing system;
third instructions for ceasing communication with the attacking node; and
fourth instructions for maintaining the connection with the attacking node.
US10/165,079 2002-06-06 2002-06-06 Method and apparatus for identifying intrusions into a network data processing system Abandoned US20030229703A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US10/165,079 US20030229703A1 (en) 2002-06-06 2002-06-06 Method and apparatus for identifying intrusions into a network data processing system
US12/819,502 US8448189B2 (en) 2002-06-06 2010-06-21 Identifying intrusions into a network data processing system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US10/165,079 US20030229703A1 (en) 2002-06-06 2002-06-06 Method and apparatus for identifying intrusions into a network data processing system

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US12/819,502 Continuation US8448189B2 (en) 2002-06-06 2010-06-21 Identifying intrusions into a network data processing system

Publications (1)

Publication Number Publication Date
US20030229703A1 true US20030229703A1 (en) 2003-12-11

Family

ID=29710347

Family Applications (2)

Application Number Title Priority Date Filing Date
US10/165,079 Abandoned US20030229703A1 (en) 2002-06-06 2002-06-06 Method and apparatus for identifying intrusions into a network data processing system
US12/819,502 Expired - Lifetime US8448189B2 (en) 2002-06-06 2010-06-21 Identifying intrusions into a network data processing system

Family Applications After (1)

Application Number Title Priority Date Filing Date
US12/819,502 Expired - Lifetime US8448189B2 (en) 2002-06-06 2010-06-21 Identifying intrusions into a network data processing system

Country Status (1)

Country Link
US (2) US20030229703A1 (en)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050195753A1 (en) * 2004-02-11 2005-09-08 Airtight Networks, Inc. (F/K/A Wibhu Technologies, Inc.) Method and system for detecting wireless access devices operably coupled to computer local area networks and related methods
US20070025313A1 (en) * 2003-12-08 2007-02-01 Airtight Networks, Inc. (F/K/A Wibhu Technologies, Inc.) Method and System for Monitoring a Selected Region of an Airspace Associated with Local Area Networks of computing Devices
US20070177600A1 (en) * 2006-01-30 2007-08-02 Shinsuke Suzuki Traffic control method, apparatus, and system
US20080109879A1 (en) * 2004-02-11 2008-05-08 Airtight Networks, Inc. Automated sniffer apparatus and method for monitoring computer systems for unauthorized access
US20080134332A1 (en) * 2006-12-04 2008-06-05 Susann Marie Keohane Method and apparatus for reduced redundant security screening
US7710933B1 (en) 2005-12-08 2010-05-04 Airtight Networks, Inc. Method and system for classification of wireless devices in local area computer networks
US7970894B1 (en) 2007-11-15 2011-06-28 Airtight Networks, Inc. Method and system for monitoring of wireless devices in local area computer networks
US8281400B1 (en) * 2002-07-23 2012-10-02 Juniper Networks, Inc. Systems and methods for identifying sources of network attacks
EP3999978A4 (en) * 2019-07-17 2023-08-30 Infiltron Holdings, LLC Systems and methods for securing devices in a computing environment

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8493977B2 (en) * 2010-11-30 2013-07-23 Symbol Technologies, Inc. Detection of an unauthorized access point in a wireless communication network
US9769198B1 (en) * 2014-03-31 2017-09-19 Juniper Networks, Inc. Malware detection using internal and/or external malware detection operations
US10243996B2 (en) 2016-01-05 2019-03-26 International Business Machines Corporation LAN/SAN network security management

Citations (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5892903A (en) * 1996-09-12 1999-04-06 Internet Security Systems, Inc. Method and apparatus for detecting and identifying security vulnerabilities in an open network computer communication system
US5905859A (en) * 1997-01-09 1999-05-18 International Business Machines Corporation Managed network device security method and apparatus
US5991881A (en) * 1996-11-08 1999-11-23 Harris Corporation Network surveillance system
US20020078202A1 (en) * 2000-12-15 2002-06-20 Tadanao Ando IP network system having unauthorized intrusion safeguard function
US6442694B1 (en) * 1998-02-27 2002-08-27 Massachusetts Institute Of Technology Fault isolation for communication networks for isolating the source of faults comprising attacks, failures, and other network propagating errors
US20030167404A1 (en) * 2001-09-05 2003-09-04 Min-Ho Han Security system for networks and the method thereof
US6654882B1 (en) * 2002-05-24 2003-11-25 Rackspace, Ltd Network security system protecting against disclosure of information to unauthorized agents
US6711127B1 (en) * 1998-07-31 2004-03-23 General Dynamics Government Systems Corporation System for intrusion detection and vulnerability analysis in a telecommunications signaling network
US6715083B1 (en) * 1999-10-13 2004-03-30 Ericsson Inc. Method and system of alerting internet service providers that a hacker may be using their system to gain access to a target system
US6721890B1 (en) * 1999-05-04 2004-04-13 Microsoft Corporation Application specific distributed firewall
US6725377B1 (en) * 1999-03-12 2004-04-20 Networks Associates Technology, Inc. Method and system for updating anti-intrusion software
US20040103307A1 (en) * 2001-08-20 2004-05-27 Itran Communications Ltd. Mechanism for detecting intrusion and jamming attempts in a shared media based communications network
US6745333B1 (en) * 2002-01-31 2004-06-01 3Com Corporation Method for detecting unauthorized network access by having a NIC monitor for packets purporting to be from itself
US6792546B1 (en) * 1999-01-15 2004-09-14 Cisco Technology, Inc. Intrusion detection signature analysis using regular expressions and logical operators
US6981158B1 (en) * 2000-06-19 2005-12-27 Bbnt Solutions Llc Method and apparatus for tracing packets

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5864683A (en) * 1994-10-12 1999-01-26 Secure Computing Corporartion System for providing secure internetwork by connecting type enforcing secure computers to external network for limiting access to data based on user and process access rights
US6502135B1 (en) * 1998-10-30 2002-12-31 Science Applications International Corporation Agile network protocol for secure communications with assured system availability

Patent Citations (15)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5892903A (en) * 1996-09-12 1999-04-06 Internet Security Systems, Inc. Method and apparatus for detecting and identifying security vulnerabilities in an open network computer communication system
US5991881A (en) * 1996-11-08 1999-11-23 Harris Corporation Network surveillance system
US5905859A (en) * 1997-01-09 1999-05-18 International Business Machines Corporation Managed network device security method and apparatus
US6442694B1 (en) * 1998-02-27 2002-08-27 Massachusetts Institute Of Technology Fault isolation for communication networks for isolating the source of faults comprising attacks, failures, and other network propagating errors
US6711127B1 (en) * 1998-07-31 2004-03-23 General Dynamics Government Systems Corporation System for intrusion detection and vulnerability analysis in a telecommunications signaling network
US6792546B1 (en) * 1999-01-15 2004-09-14 Cisco Technology, Inc. Intrusion detection signature analysis using regular expressions and logical operators
US6725377B1 (en) * 1999-03-12 2004-04-20 Networks Associates Technology, Inc. Method and system for updating anti-intrusion software
US6721890B1 (en) * 1999-05-04 2004-04-13 Microsoft Corporation Application specific distributed firewall
US6715083B1 (en) * 1999-10-13 2004-03-30 Ericsson Inc. Method and system of alerting internet service providers that a hacker may be using their system to gain access to a target system
US6981158B1 (en) * 2000-06-19 2005-12-27 Bbnt Solutions Llc Method and apparatus for tracing packets
US20020078202A1 (en) * 2000-12-15 2002-06-20 Tadanao Ando IP network system having unauthorized intrusion safeguard function
US20040103307A1 (en) * 2001-08-20 2004-05-27 Itran Communications Ltd. Mechanism for detecting intrusion and jamming attempts in a shared media based communications network
US20030167404A1 (en) * 2001-09-05 2003-09-04 Min-Ho Han Security system for networks and the method thereof
US6745333B1 (en) * 2002-01-31 2004-06-01 3Com Corporation Method for detecting unauthorized network access by having a NIC monitor for packets purporting to be from itself
US6654882B1 (en) * 2002-05-24 2003-11-25 Rackspace, Ltd Network security system protecting against disclosure of information to unauthorized agents

Cited By (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8281400B1 (en) * 2002-07-23 2012-10-02 Juniper Networks, Inc. Systems and methods for identifying sources of network attacks
US7804808B2 (en) 2003-12-08 2010-09-28 Airtight Networks, Inc. Method and system for monitoring a selected region of an airspace associated with local area networks of computing devices
US20070025313A1 (en) * 2003-12-08 2007-02-01 Airtight Networks, Inc. (F/K/A Wibhu Technologies, Inc.) Method and System for Monitoring a Selected Region of an Airspace Associated with Local Area Networks of computing Devices
US20080109879A1 (en) * 2004-02-11 2008-05-08 Airtight Networks, Inc. Automated sniffer apparatus and method for monitoring computer systems for unauthorized access
US7440434B2 (en) 2004-02-11 2008-10-21 Airtight Networks, Inc. Method and system for detecting wireless access devices operably coupled to computer local area networks and related methods
US7536723B1 (en) * 2004-02-11 2009-05-19 Airtight Networks, Inc. Automated method and system for monitoring local area computer networks for unauthorized wireless access
US20050195753A1 (en) * 2004-02-11 2005-09-08 Airtight Networks, Inc. (F/K/A Wibhu Technologies, Inc.) Method and system for detecting wireless access devices operably coupled to computer local area networks and related methods
US7710933B1 (en) 2005-12-08 2010-05-04 Airtight Networks, Inc. Method and system for classification of wireless devices in local area computer networks
US7788721B2 (en) * 2006-01-30 2010-08-31 Alaxala Networks Corporation Traffic control method, apparatus, and system
US20070177600A1 (en) * 2006-01-30 2007-08-02 Shinsuke Suzuki Traffic control method, apparatus, and system
US20080134332A1 (en) * 2006-12-04 2008-06-05 Susann Marie Keohane Method and apparatus for reduced redundant security screening
US7974286B2 (en) 2006-12-04 2011-07-05 International Business Machines Corporation Reduced redundant security screening
US7970894B1 (en) 2007-11-15 2011-06-28 Airtight Networks, Inc. Method and system for monitoring of wireless devices in local area computer networks
EP3999978A4 (en) * 2019-07-17 2023-08-30 Infiltron Holdings, LLC Systems and methods for securing devices in a computing environment

Also Published As

Publication number Publication date
US8448189B2 (en) 2013-05-21
US20100257607A1 (en) 2010-10-07

Similar Documents

Publication Publication Date Title
US8448189B2 (en) Identifying intrusions into a network data processing system
AU2019216687B2 (en) Path scanning for the detection of anomalous subgraphs and use of DNS requests and host agents for anomaly/change detection and network situational awareness
US7734776B2 (en) Automatically detecting malicious computer network reconnaissance by updating state codes in a histogram
US6775657B1 (en) Multilayered intrusion detection system and method
US20060037077A1 (en) Network intrusion detection system having application inspection and anomaly detection characteristics
US8869268B1 (en) Method and apparatus for disrupting the command and control infrastructure of hostile programs
US8910285B2 (en) Methods and systems for reciprocal generation of watch-lists and malware signatures
US8161554B2 (en) System and method for detection and mitigation of network worms
US20150288709A1 (en) Using Trust Profiles for Network Breach Detection
US7725578B2 (en) Providing status information to a device attached to an information infrastructure
CA3017942A1 (en) Multi-host threat tracking
US11303669B1 (en) System and method for tunneling endpoint traffic to the cloud for ransomware lateral movement protection
WO2001084270A2 (en) Method and system for intrusion detection in a computer network
WO2021098313A1 (en) Blockchain-based host security monitoring method and apparatus, medium and electronic device
US20210409446A1 (en) Leveraging network security scanning to obtain enhanced information regarding an attack chain involving a decoy file
CN110798427A (en) Anomaly detection method, device and equipment in network security defense
WO2021225650A1 (en) Detecting malicious activity in a cluster
US20050259657A1 (en) Using address ranges to detect malicious activity
US11190433B2 (en) Systems and methods for identifying infected network nodes based on anomalous behavior model
US20090063684A1 (en) Wpar halted attack introspection stack execution detection
CN113328976B (en) Security threat event identification method, device and equipment
US20210359977A1 (en) Detecting and mitigating zero-day attacks
CN112351044A (en) Network security system based on big data
Ragupathy et al. Detecting Denial of Service Attacks by Analysing Network Traffic in Wireless Networks
US11496494B2 (en) Systems and methods for detecting anomalous behaviors based on temporal profile

Legal Events

Date Code Title Description
AS Assignment

Owner name: INTERNATIONAL BUSINESS MACHINES CORPORATION, NEW Y

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:FALOLA, DOLAPO MARTIN;JAIN, VINIT;MACALPINE, SHANNON MARIE;AND OTHERS;REEL/FRAME:013008/0810;SIGNING DATES FROM 20020531 TO 20020605

STCB Information on status: application discontinuation

Free format text: ABANDONED -- AFTER EXAMINER'S ANSWER OR BOARD OF APPEALS DECISION

AS Assignment

Owner name: AIRBNB, INC., CALIFORNIA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:INTERNATIONAL BUSINESS MACHINES CORPORATION;REEL/FRAME:056427/0193

Effective date: 20210106