US20090320132A1 - Systems and methods for distributed network protection - Google Patents
Systems and methods for distributed network protection Download PDFInfo
- Publication number
- US20090320132A1 US20090320132A1 US12/538,951 US53895109A US2009320132A1 US 20090320132 A1 US20090320132 A1 US 20090320132A1 US 53895109 A US53895109 A US 53895109A US 2009320132 A1 US2009320132 A1 US 2009320132A1
- Authority
- US
- United States
- Prior art keywords
- communications network
- level monitoring
- monitoring centers
- hacker
- protected communications
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/30—Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2101—Auditing as a secondary aspect
Definitions
- the systems and methods of this invention relate to protecting distributed networks.
- the systems and methods of this invention relate to protecting distributed networks through a hierarchical analysis and action determination topology.
- the nation's information infrastructure based in large part on the Internet, has become an integral part of normal business and is becoming critical to the national security of many countries.
- the intrusion into public and private networks by unauthorized individuals is a major problem for many nations.
- Foreign powers, and a variety of hackers, i.e., individuals or entities who attempt to obtain unauthorized access to one or more networks or information continue to develop systems and methods that interrupt communications, damage files, damage computer and network systems, and gain access to private information.
- Many tools, such as firewalls, passwords and network security schemes have been developed in an attempt to provide protection to various aspects of distributed networks.
- an exemplary embodiment of the systems and methods of this invention allow the collection of information on incidents of hacker attacks, analysis and summarization of such information, identification of the source of these attacks, and appropriate law enforcement or retaliatory acts in response to these unauthorized attacks.
- a distributed network protection system There are two basic approaches to the development of a distributed network protection system.
- one or more monitoring centers act independently of any attacked targets.
- This exemplary system could place sensors at various locations within a distributed network to examine all traffic, or a sampling thereof, for possible unauthorized access attempts. For example, origination addresses could be compared to destination addresses to determine if the user is an authorized user, information could be scanned for profiles of particular executable code, or the like.
- a second exemplary approach would be to place unauthorized access attempt detection systems at specific locations within a distributed network.
- the unauthorized access attempt detection system could be collocated with a firewall of a particular entity on a distributed network, such as the Internet.
- the unauthorized access attempt detection system could be similar to that used in U.S.
- the unauthorized access attempt is detected by these localized monitoring centers thereby restricting a need to analyze all traffic on the distributed network.
- an unauthorized access attempt can be detected in real-time, and pertinent information regarding the attempt forwarded to a monitoring system for verification and determination of an appropriate response and/or action.
- aspects of the present invention relate to a protection system for a portion of a distributed network.
- an exemplary embodiment of the invention provides systems and methods for analyzing unauthorized access attempts.
- a further aspect of the invention relates to determining an appropriate response and/or action in response to an unauthorized access attempt.
- An additional aspect of the invention relates to establishing a hierarchical monitoring scheme that monitors one or more of information traffic and unauthorized access attempt alarms within a distributed network.
- An additional aspect of the invention relates to distributing monitoring centers such that the burden of analyzing distributed network traffic and unauthorized access attempt alarms can be performed in real-time or near real-time.
- FIG. 1 illustrates an exemplary embodiment of the distributed network protection system according to this invention
- FIG. 2 illustrates an exemplary embodiment of a monitoring center according to this invention
- FIG. 3 illustrates an exemplary method of protecting a distributed network according to this invention.
- FIG. 4 is a flowchart outlining a second exemplary method for protecting a distributed network according to this invention.
- the distributed network protection system could be developed as a separate infrastructure containing both centralized and distributed databases of hacker information such as, profiles, signatures, attack attempt profiles, or the like.
- hacker information such as, profiles, signatures, attack attempt profiles, or the like.
- any information that may be of assistance in determining one or more of the verification of an unauthorized access attempt and/or the identity of the hacker(s) can be stored in the databases.
- This information can be, for example, generated in response to alarms received from one or more targets or, for example, amassed through an analysis of all or a portion of the traffic within a portion of a distributed network, such as a local area network, the Internet, a private network, a wide area network, or the like.
- the multi-layered distributed network protection system utilizes, for example, real-time unauthorized access attempt alarms from one or more secured sites.
- the secure sites would report unauthorized access attempts to the distributed network protection system that could, for example, maintain databases of known attackers and their methods, and could be capable of analysis of multiple ongoing attacks on different secured sites, tracking origins of these attacks, documenting the attacks for possible future prosecution, and supporting retaliatory measures if warranted.
- a Level 1 monitoring center could monitor a predetermined geographical area serving, for example, a wide variety of commercial and public sites, or an organizational structure serving, for example, such institutions as law enforcement, Department of Defense, Armed Forces, the government, commercial organizations, e-commerce or the like.
- An exemplary Level 1 monitoring system could focus monitoring on attacks within defined cyber boundaries.
- These monitoring centers could receive information on an attack in progress and optionally a referral feature enabling the monitoring center to pose as the attacked site to the attacker for the purposes of, for example, positive identification of the attacker.
- the Level 1 monitoring center can refer the unauthorized access attempt to an appropriate Level 2 center for possible retaliatory and/or legal action.
- Level 2 centers could receive, for example, referrals from Level 1 monitoring centers and make a decision on possible retaliatory action and/or other action if warranted, for example, by the nature of the attack. These Level 2 centers could also receive and analyze cumulative information on unauthorized access attempts from underlying Level 1 monitoring centers within, for example, predefined geographic, organizational, cyber boundary, or the like.
- Level 3 monitoring centers could collect and analyze information from Level 2 monitoring centers to, for example, monitor the overall security condition of a distributed network, such as the national cyberspace of one or more countries.
- monitoring center levels can be varied depending on, for example, the specific implementation of the distributed network protection system, or the like.
- Unauthorized access attempt attack alerts can be generated in at least two different ways. First, for example, all traffic through a given portion of a distributed network is monitored for unauthorized access attempts. Secondly, portions of a distributed network can be monitored with unauthorized access attempt detection systems that can forward an alarm to, for example, one or more Level 1 type monitoring centers and the unauthorized access attempt “handed-off” to a higher level monitoring center when an escalation parameter(s) is satisfied to, for example, perform further action, or the like.
- the hand-off could include, for example, information such as the destination address of the attacked target, the source address for the last clearing hop of the hacker, a copy of the pertinent part of the attacking packet, or any other information relevant to the unauthorized access attempt.
- unauthorized access attempt protection systems such as systems embedded in a firewall or operating system based protection present at the target site could gather other information about the unauthorized access in real-time or near realtime and provide this information to one or more of the monitoring centers. Additionally, such localized intrusion attempt detection systems could provide, for example, information regarding a suspected attack, or the like.
- An exemplary embodiment of the distributed network protection system could also include one or more distributed and/or centralized databases.
- a centralized database could be located at a Level 3 monitoring center, whereas both Level 1 and Level 2 monitoring centers could maintain their own distributed databases linked to the central database at the Level 3 monitoring center.
- These databases can obviously include various protection schemes to shield unauthorized access to users and to conduit host data, detailed hacker data, sanitized attacker data, and law-enforcement data and links, or the like.
- the origin of an unauthorized access attempt can be most effectively traced in real-time, i.e., during the course of the attack. While attackers often use various methods to disguise the real origin of the attack, there is at least one fundamental requirement for any hacking attack to succeed that can be used for tracking its origin. Indeed, except for a denial of service attack, hacking by its nature requires a target system's response to attacking packets be received by the attacker directly or indirectly. This means that no matter how sophisticated a disguise mechanism is, the attacking system makes itself available to receive such a response. This vulnerability can be utilized effectively for tracking an unauthorized access attempt.
- unauthorized access attempt tracking can be done autonomously, by, for example, a monitoring center, without necessarily implementing a surveillance scheme.
- a concealed program can be embedded in the response to the attacker.
- the attacking station e.g., one or more computers operated by a hacker
- the concealed program could act like a worm within the attacking station(s). This worm can determine if, for example, the attacking station has a hostile intent, and, if the intent is confirmed, secretly forward the identification, such as an IP address, to the target station or monitoring center.
- the page in the case of an HTML page being sent as a response to a hacking attack, the page can contain a worm, such as an embedded portion of executable code, Java® script, cookie, or the like, which could be invisible to a viewer and, for example, probe the hackers computer for specific information.
- a disguised request that could confirm hostile intent could be included in a HTML page.
- the target system does not employ a particular feature, a fake request for such a feature could be made.
- the attacker confirms that they are not familiar with the target system and they are trying to enter the system in an unauthorized manner.
- the concealed program, or worm could then be triggered if an attacker enters any response.
- This concealed program could then instruct the attacker's browser, or other comparable device, to secretly send the attacker's true identity to a predetermined destination, such as a specific IP address.
- a predetermined destination such as a specific IP address.
- This IP address could, for example, be passed along to a predetermined monitoring center along with any other pertinent information gathered about the hacker.
- autonomous method such as the one described above, may not produce the desired result.
- a more complex method involving cooperative reporting systems could be utilized. This would require, for example, full cooperation between one or more distributed network protection systems, and, for example, private and government information technology communities.
- a target having confirmed a hacking attack, could include a flag concealed into its response.
- participating nodes and conduit hosts could be supplied and updated with this hacker related validated information so that the participating entities can detect passage of the flag and, for example, record information related to the flag and associated data.
- the two systems, used in conjunction, can cover a broad spectrum of attacks.
- the long-range attacks with many hops are vulnerable to flag detection at intermediate nodes, while closer range attacks are more vulnerable to direct detection.
- These techniques avoid the need for general surveillance of individual packets flowing through internet nodes in an effort to track hackers attempting to break into a protected network. It also allows for the protection of the integrity of private information, since all of the information regarding the hacker can be relayed voluntarily to, for example, law enforcement personnel, from, for example, the host detecting the hacker and/or one or more monitoring centers.
- a retaliatory cyber attack i.e., counter attack
- An attacker is most vulnerable to a counter attack during their own attack, since the attacker generally has to substantially remove their system's defensive mechanism.
- an exemplary embodiment of this invention takes advantage of the hacker's weaknesses and allows the performing of counter attacks in near real-time. Specifically, when a decision on retaliation has been made, for example, by law enforcement personnel, and after confirmation of the attacker's origin, a retaliatory action can be launched.
- a concealed program could be embedded into a response to the attacker such as embedded in an HTML page.
- the program could contain code similar to those found in destructive viruses.
- the triggering mechanism could be, for example, embedded with additional levels of verification to ensure the hostile intent, identity, or the like, of the attacker. For example, a false request for a password could be made while the target system does not employ password-based security features. By entering any password, or otherwise responding to the request, the attacker could confirm that the attacker is in fact not familiar with the protocols of the target system, and therefore, is an unauthorized user. At the same time, entering any response to, for example, the password could trigger the concealed destructive program that can, for example, destroy files and/or the operating system of the attacker's computer.
- the targeted system could act as a conduit to relay response information, such as packets, returned to the hacker from one or more of the monitoring centers to retain the original targeted addresses.
- response packets may contain flags or retaliation codes as described above, depending on the analysis and the decision made by one or more of the monitoring centers.
- the restricted tunnel may be implemented using a commercial VPN, a dedicated link with or without encryption, or the like.
- FIG. 1 illustrates an exemplary distributed network protection system 100 .
- the distributed network protection system 100 comprises one or more monitoring centers 200 , one or more targets 300 , and an hacker 400 being connected by links 5 and one or more distributed networks 10 .
- the distributed network protection system 100 can also be connected to one or more other distributed network protection systems and is scalable depending on the particular implementation.
- the hacker 400 is illustrated as a single entity, it should be appreciated that the hacker 400 can be one or more devices, computers or entities, and can be located at one or more geographic or cyber locations.
- FIG. 1 shows the distributed network protection system 100 and associated components collocated
- the various components of the distributed network protection system can be located at distant portions of a distributed network, such as a local area network, a wide area network, an intranet, and/or the Internet, or within a dedicated distributed network protection system.
- the components of the distributed network protection system can be combined into one device or collocated on a particular node of a distributed network.
- the various functional components of the distributed network protection system have been divided as illustrated in FIG. 1 .
- any of the functional components illustrated in FIG. 1 can be combined without affecting the operation of the system.
- the components of the distributed network protection system can be arranged in any location within a distributed network without affecting the operation of the system.
- the links 5 can be a wired or wireless link or any other known or later developed element(s) that is capable of supplying and communicating electronic data to and from the connected elements.
- the distributed network protection system can comprise one or more input devices (not shown) that can include, for example, a keyboard, a mouse, a speech text converter, a stylus, or the like.
- the input device can be any device capable of communicating information to the distributed network protection system 100 .
- the distributed network protection system 100 can comprise one or more display devices (not shown) such as a computer monitor, a display on a PDA, or any other device capable of displaying information to one or more users.
- the monitoring centers 200 monitor one or more of traffic and/or alarms received from one or more targets 300 .
- the targets 300 can be a particular node on a distributed network, such as a single entity, or could be scalable, such that the target could be defined based on, for example, a geographic location having a plurality of entities, a country, a portion of an IP address, or the like.
- the targets 300 can be any device, entity or portion of a distributed network, for which protection is desired.
- alarms received from the one or more targets 300 can be localized and/or distributed based on the particular implementation specifics.
- the target 300 forwards alarm information 30 to one or more monitoring systems 200 .
- the monitoring system 200 optionally commences logging a portion of the transactions with the target 300 , and hence, the hacker 400 .
- the monitoring center 200 then identifies the source of the attack and verifies the intrusion attempt as discussed above. For example, using various techniques, the monitoring center 200 can initiate various communications with the hacker 400 in an attempt to verify the authenticity of the unauthorized access attempt.
- monitoring system 200 determines that the communications with the target are an unauthorized access attempt, the monitoring system 200 can enter an analysis mode where all or a portion of the communications from the hacker 400 are analyzed to, for example, determine the identity of the hacker, the source of attack, hacking patterns, characteristics of the hack attempt, or the like. Upon determining, for example, the identity and/or location of the hacker, the monitoring system 200 can determine any necessary responsive action that may be appropriate. Depending on the nature of the responsive action, the monitoring center 200 can escalate the unauthorized access attempt to another monitoring center higher in the chain. As previously discussed, the Level 2 monitoring center could, for example, make any decisions regarding possible retaliatory action, compare the referral from the Level 1 monitoring center to other unauthorized access attempts from other Level 1 centers, carry out retaliatory action, or the like.
- FIG. 2 illustrates an exemplary monitoring center 200 .
- the monitoring center 200 comprises an I/O interface 210 , a controller 220 , a memory 230 , a database 240 , a response system 250 , an intrusion analysis system 260 , an intrusion reaction system 270 , and an escalation determination system 280 , all interconnected by link 5 . Additionally, the monitoring center 200 can be connected to one or more other monitoring centers and/or targets 300 via network 10 and the links 5 .
- the monitoring center 200 Upon receiving an alarm from one or more targets, the monitoring center 200 , in cooperation with the I/O interface 210 , the controller 220 , the memory 230 , and the intrusion analysis system 260 , determines the accuracy of the alarm.
- the intrusion analysis system 260 in cooperation with database 240 , analyzes the intrusion attempt and compares it to, for example, historical profiles and/or other previous attempts, or communicates with other monitoring centers to determine whether other targets are being attacked with the same or similar unauthorized access requests.
- the intrusion analysis system 260 Upon verification of the attack, the intrusion analysis system 260 , in cooperation with intrusion interaction system 270 , the I/O interface 210 , the controller 220 and the memory 230 , can engage the one or more hackers 400 in an attempt to determine the source of the attack. Then, for example, depending on the scale and success of the attack, the identity of the attacker, and the number of previous attack attempts, the escalation determination system 280 can determine whether, for example, retaliatory action, law enforcement procedures, or the like, should be taken. If it is determined that further action need be taken, the monitoring center 200 can escalate the alarm, and any related alarm information, to another monitoring center higher, for example a Level 2 monitoring center, in the hierarchy.
- the monitoring center 200 which received the alarm in cooperation with the response system 250 , the I/O interface 210 , the controller 220 and memory 230 can, for example, forward various notification messages to the one or more affected or unaffected targets, notifications to one or more other monitoring centers at various levels in the hierarchy, or the like.
- FIG. 3 illustrates an exemplary embodiment of protecting a distributed network according to this invention.
- control begins in step S 100 and continues to step S 110 .
- step S 110 an alarm signal is received from one or more targets.
- step S 120 logging of all or a portion of the information to and/or from the attacked target is commenced.
- the logging can be performed in a controlled manner where, for example, repetitive events are not logged and thresholds set governing the extent of the logging.
- Control then continues to step S 130 .
- step S 130 a determination is made whether the alarm information is being forwarded from another monitoring center. If the alarm information is being forwarded from another monitoring center, such as from a Level 1 monitoring center to a Level 2 monitoring center, control jumps to step S 180 . Otherwise, control continues to step S 140 .
- step S 140 the source of the attack is identified.
- step S 150 the communications with the target are verified as an unauthorized access attempt.
- step S 160 if the communications with the target are determined to be an unauthorized access attempt, control jumps to step S 180 . Otherwise, control optionally continues to step S 170 where, for example, a message is forwarded to the target indicating, for example, there has been a false alarm.
- step S 180 the unauthorized access attempt is analyzed.
- step S 190 any responsive action is determined. Control then continues to step S 200 , where the control sequence ends.
- FIG. 4 illustrates a second exemplary embodiment for protecting a distributed network according to this invention.
- one or more monitoring centers are responsible for detecting unauthorized access attempts.
- control begins in step S 400 and continues to step S 410 .
- step S 410 network traffic on a portion of a distributed network is analyzed.
- step S 420 a determination is made whether an unauthorized access attempt has been detected. If no unauthorized access attempt has been detected, control continues to step S 430 . Otherwise, control jumps back to step S 410 .
- step S 430 logging of, for example, all communications from a particular origin to a particular destination are recorded.
- step S 440 a determination is made whether information regarding the unauthorized access attempt has been forwarded or received by another monitoring center. If the alarm information has been escalated from another monitoring center, control jumps to step S 480 , where, for example, the gathered information can be compared, analyzed, or the like. Otherwise, control continues to step S 450 .
- step S 450 the source of the attack is identified.
- step S 460 the intrusion attempt is verified.
- step S 470 an optional message can be sent to the target indicating an intrusion attempt is underway. Control then continues to step S 480 .
- step S 480 the unauthorized access attempt can be analyzed, and compared to, for example, other unauthorized access attempts, or the like.
- step S 490 responsive action to the unauthorized access attempt is determined. Control then continues to step S 500 where the control sequence ends.
- the distributed network protection system can be implemented either on a single programmed general purpose computer or a separate programmed general purpose computer.
- the distributed network protection system can also be implemented on a special purpose computer, microprocessor or microcontroller and peripheral integrated circuit element, an ASIC or other integrated circuit, a digital signal processor, a hardwired electronic or logic circuit, such as a discrete element circuit, a programmable logic device such as a PLD, PLA, FPGA, PAL, or the like.
- any device capable of implementing a finite state machine that is in turn capable of implementing the flowcharts in FIGS. 3-4 can be used to implement the distributed network protection system according to this invention.
- the disclosed method may be readily implemented in software using object or object-oriented software development environments that provide portable source code that can be used on a variety of computer or workstation hardware platforms.
- the disclosed distributed network protection system may be implemented partially or fully in hardware using standard logic circuits or VLSI design. Whether hardware or software is used to implement the systems and methods in accordance with this invention is dependent on the speed and/or efficiency requirements of the system, the particular function, and the particular software and/or hardware systems or microprocessor or microcomputer systems being utilized.
- the distributed network protection system illustrated herein can be readily implemented in hardware and/or software using any known or later-developed systems or structures, devices and/or software by those of ordinary skill in the applicable art from the functional description provided herein and with a general basic knowledge of the computer arts.
- the disclosed methods may be readily implemented as software executed on a programmed general purpose computer, a special purpose computer, a microprocessor or the like.
- the methods and systems of this invention can be implemented as a program embedded in a personal computer, a piece of executable code, or the like, such as a Java® or CGI script, as an cookie, as a resource residing on a server or graphics workstation, as a routine embedded in a dedicated distributed network protection system, or the like.
- the distributed network protection system can also be implemented by physically incorporating the systems and methods into a hardware and/or software system, such as the hardware and software systems of a computer or dedicated distributed network protection system.
- the devices and subsystems of the exemplary embodiments of FIGS. 1-4 can include computer readable medium or memories for holding instructions programmed according to the teachings of the present invention and for holding data structures, tables, records, and/or other data described herein.
- Computer readable medium can include any suitable medium that participates in providing instructions to a processor for execution. Such a medium can take many forms, including but not limited to, non-volatile media, volatile media, etc.
- Non-volatile media can include, for example, optical or magnetic disks, magneto-optical disks, and the like.
- Volatile media can include dynamic memories, and the like.
- Transmission media can include coaxial cables, copper wire, fiber optics, and the like.
- Computer-readable media can include, for example, a floppy disk, a flexible disk, hard disk, magnetic tape, any other suitable magnetic medium, a CD-ROM, CDRW, DVD, any other suitable optical medium, a RAM, a PROM, an EPROM, a FLASH-EPROM, any other suitable memory chip or cartridge, or any other suitable medium from which a computer can read.
Abstract
By distributing various information and monitoring centers that monitor distributed networks and unauthorized access attempts, it is possible to, for example, more quickly defend against an unauthorized access attempts. For example, a Level 1 monitoring center could monitor a predetermined geographical area serving, for example, a wide variety of commercial and public sites, an organizational structure, or the like, for alarms. Upon analyzing an alarm for various characteristics, the Level 1 monitoring center can refer the unauthorized access attempt to an appropriate Level 2 center for, for example, possible retaliatory and/or legal action. Then, a Level 3 monitoring center can record and maintain an overall picture of the security of one or more networks, the plurality of monitoring centers and information about one or more hacking attempts.
Description
- The present invention is a continuation of U.S. patent application Ser. No. 11/723,793, filed Mar. 22, 2007, now allowed, which is a continuation of U.S. patent application Ser. No. 11/490,046, filed Jul. 21, 2006, now U.S. Pat. No. 7,197,563, which is a divisional of U.S. patent application Ser. No. 09/867,442, filed May 31, 2001, now U.S. Pat. No. 7,089,303, which claims benefit of priority to U.S. Provisional Patent Application Ser. No. 60/208,056, filed May 31, 2000, the entire disclosures of all of which are hereby incorporated by reference herein.
- 1. Field of the Invention
- In general, the systems and methods of this invention relate to protecting distributed networks. In particular, the systems and methods of this invention relate to protecting distributed networks through a hierarchical analysis and action determination topology.
- 2. Description of Related Art
- The nation's information infrastructure, based in large part on the Internet, has become an integral part of normal business and is becoming critical to the national security of many countries. The intrusion into public and private networks by unauthorized individuals is a major problem for many nations. Foreign powers, and a variety of hackers, i.e., individuals or entities who attempt to obtain unauthorized access to one or more networks or information, continue to develop systems and methods that interrupt communications, damage files, damage computer and network systems, and gain access to private information. Many tools, such as firewalls, passwords and network security schemes have been developed in an attempt to provide protection to various aspects of distributed networks.
- However, in light of the magnitude of the problem, a coordinated effort could greatly assist in countering the potentially devastating effects of unauthorized access into private or restricted areas of cyberspace. Furthermore, by coordinating efforts, an exemplary embodiment of the systems and methods of this invention allow the collection of information on incidents of hacker attacks, analysis and summarization of such information, identification of the source of these attacks, and appropriate law enforcement or retaliatory acts in response to these unauthorized attacks.
- There are two basic approaches to the development of a distributed network protection system. In a first exemplary approach, one or more monitoring centers act independently of any attacked targets. This exemplary system could place sensors at various locations within a distributed network to examine all traffic, or a sampling thereof, for possible unauthorized access attempts. For example, origination addresses could be compared to destination addresses to determine if the user is an authorized user, information could be scanned for profiles of particular executable code, or the like. A second exemplary approach would be to place unauthorized access attempt detection systems at specific locations within a distributed network. For example, the unauthorized access attempt detection system could be collocated with a firewall of a particular entity on a distributed network, such as the Internet. Alternatively, the unauthorized access attempt detection system could be similar to that used in U.S. Provisional patent application No. 60/226,088, entitled “Cyber Hacking Attack Tracing and Retaliation Methods and Systems,” incorporated herein by reference in its entirety. In this exemplary embodiment, the unauthorized access attempt is detected by these localized monitoring centers thereby restricting a need to analyze all traffic on the distributed network. With these localized systems, an unauthorized access attempt can be detected in real-time, and pertinent information regarding the attempt forwarded to a monitoring system for verification and determination of an appropriate response and/or action.
- Accordingly, aspects of the present invention relate to a protection system for a portion of a distributed network. In particular, an exemplary embodiment of the invention provides systems and methods for analyzing unauthorized access attempts.
- A further aspect of the invention relates to determining an appropriate response and/or action in response to an unauthorized access attempt.
- An additional aspect of the invention relates to establishing a hierarchical monitoring scheme that monitors one or more of information traffic and unauthorized access attempt alarms within a distributed network.
- An additional aspect of the invention relates to distributing monitoring centers such that the burden of analyzing distributed network traffic and unauthorized access attempt alarms can be performed in real-time or near real-time.
- These and other features and advantages of this invention are described in or are apparent from the following detailed description of the embodiments.
- The embodiments of the invention will be described in detail, with reference to the following figures wherein:
-
FIG. 1 illustrates an exemplary embodiment of the distributed network protection system according to this invention; -
FIG. 2 illustrates an exemplary embodiment of a monitoring center according to this invention; -
FIG. 3 illustrates an exemplary method of protecting a distributed network according to this invention; and -
FIG. 4 is a flowchart outlining a second exemplary method for protecting a distributed network according to this invention. - In an exemplary embodiment of this invention, the distributed network protection system could be developed as a separate infrastructure containing both centralized and distributed databases of hacker information such as, profiles, signatures, attack attempt profiles, or the like. In general, any information that may be of assistance in determining one or more of the verification of an unauthorized access attempt and/or the identity of the hacker(s) can be stored in the databases. This information can be, for example, generated in response to alarms received from one or more targets or, for example, amassed through an analysis of all or a portion of the traffic within a portion of a distributed network, such as a local area network, the Internet, a private network, a wide area network, or the like. In this exemplary embodiment, the multi-layered distributed network protection system utilizes, for example, real-time unauthorized access attempt alarms from one or more secured sites. The secure sites would report unauthorized access attempts to the distributed network protection system that could, for example, maintain databases of known attackers and their methods, and could be capable of analysis of multiple ongoing attacks on different secured sites, tracking origins of these attacks, documenting the attacks for possible future prosecution, and supporting retaliatory measures if warranted.
- By distributing various information pertaining to the distributed network and unauthorized access attempts, it is possible to, for example, more quickly defend against an unauthorized access attempt by instituting a series of distributed monitoring centers dedicated to specific portions of the distributed network. For example, a Level 1 monitoring center could monitor a predetermined geographical area serving, for example, a wide variety of commercial and public sites, or an organizational structure serving, for example, such institutions as law enforcement, Department of Defense, Armed Forces, the government, commercial organizations, e-commerce or the like. An exemplary Level 1 monitoring system could focus monitoring on attacks within defined cyber boundaries. These monitoring centers could receive information on an attack in progress and optionally a referral feature enabling the monitoring center to pose as the attacked site to the attacker for the purposes of, for example, positive identification of the attacker. Upon a triggering event, such as a predetermined number of received alarms, a predetermined number of positive hacked identifications, or any other threshold, the Level 1 monitoring center can refer the unauthorized access attempt to an appropriate Level 2 center for possible retaliatory and/or legal action.
- Level 2 centers could receive, for example, referrals from Level 1 monitoring centers and make a decision on possible retaliatory action and/or other action if warranted, for example, by the nature of the attack. These Level 2 centers could also receive and analyze cumulative information on unauthorized access attempts from underlying Level 1 monitoring centers within, for example, predefined geographic, organizational, cyber boundary, or the like.
- Level 3 monitoring centers could collect and analyze information from Level 2 monitoring centers to, for example, monitor the overall security condition of a distributed network, such as the national cyberspace of one or more countries.
- However, while the above example illustrates a three tiered monitoring center scheme, the number of monitoring center levels and the tasks assigned to those levels can be varied depending on, for example, the specific implementation of the distributed network protection system, or the like.
- Unauthorized access attempt attack alerts can be generated in at least two different ways. First, for example, all traffic through a given portion of a distributed network is monitored for unauthorized access attempts. Secondly, portions of a distributed network can be monitored with unauthorized access attempt detection systems that can forward an alarm to, for example, one or more Level 1 type monitoring centers and the unauthorized access attempt “handed-off” to a higher level monitoring center when an escalation parameter(s) is satisfied to, for example, perform further action, or the like. The hand-off could include, for example, information such as the destination address of the attacked target, the source address for the last clearing hop of the hacker, a copy of the pertinent part of the attacking packet, or any other information relevant to the unauthorized access attempt. Furthermore, other unauthorized access attempt protection systems, such as systems embedded in a firewall or operating system based protection present at the target site could gather other information about the unauthorized access in real-time or near realtime and provide this information to one or more of the monitoring centers. Additionally, such localized intrusion attempt detection systems could provide, for example, information regarding a suspected attack, or the like.
- An exemplary embodiment of the distributed network protection system could also include one or more distributed and/or centralized databases. For example, a centralized database could be located at a Level 3 monitoring center, whereas both Level 1 and Level 2 monitoring centers could maintain their own distributed databases linked to the central database at the Level 3 monitoring center. These databases can obviously include various protection schemes to shield unauthorized access to users and to conduit host data, detailed hacker data, sanitized attacker data, and law-enforcement data and links, or the like. By distributing the functionality and the resources of the monitoring centers in this way, there is a greater chance of being able to verify that the unauthorized access attempt is real and react to the unauthorized access attempt in real-time thereby, for example, providing greater security to a portion of the protected distributed network.
- Current cyber-protection systems employ difficult and labor-intensive investigative techniques. Furthermore, current cyber-protection systems do not operate in real-time, therefore increasing the difficulty of tracing the origin of the attack becomes more difficult given the increasing sophistication of the attackers who employ various techniques to cover their tracks. This is further complicated by the fact that hackers usually do not use direct attempts to penetrate a target. Typically, a hacker will route the attack information through several hosts using each host as a conduit through which one or more attacks are launched.
- The origin of an unauthorized access attempt can be most effectively traced in real-time, i.e., during the course of the attack. While attackers often use various methods to disguise the real origin of the attack, there is at least one fundamental requirement for any hacking attack to succeed that can be used for tracking its origin. Indeed, except for a denial of service attack, hacking by its nature requires a target system's response to attacking packets be received by the attacker directly or indirectly. This means that no matter how sophisticated a disguise mechanism is, the attacking system makes itself available to receive such a response. This vulnerability can be utilized effectively for tracking an unauthorized access attempt.
- Specifically, unauthorized access attempt tracking can be done autonomously, by, for example, a monitoring center, without necessarily implementing a surveillance scheme. In this exemplary embodiment, when a hacking attack is detected and confirmed as a hostile act, a concealed program can be embedded in the response to the attacker. When the attacking station, e.g., one or more computers operated by a hacker, receives the target station's response, the concealed program could act like a worm within the attacking station(s). This worm can determine if, for example, the attacking station has a hostile intent, and, if the intent is confirmed, secretly forward the identification, such as an IP address, to the target station or monitoring center.
- In other words, in the case of an HTML page being sent as a response to a hacking attack, the page can contain a worm, such as an embedded portion of executable code, Java® script, cookie, or the like, which could be invisible to a viewer and, for example, probe the hackers computer for specific information. Alternatively, a disguised request that could confirm hostile intent could be included in a HTML page. For example, if the target system does not employ a particular feature, a fake request for such a feature could be made. By the act of attempting to enter or respond to this feature, the attacker confirms that they are not familiar with the target system and they are trying to enter the system in an unauthorized manner. The concealed program, or worm, could then be triggered if an attacker enters any response. This concealed program could then instruct the attacker's browser, or other comparable device, to secretly send the attacker's true identity to a predetermined destination, such as a specific IP address. This IP address could, for example, be passed along to a predetermined monitoring center along with any other pertinent information gathered about the hacker.
- For certain attacks, then autonomous method, such as the one described above, may not produce the desired result. In such instances, a more complex method involving cooperative reporting systems could be utilized. This would require, for example, full cooperation between one or more distributed network protection systems, and, for example, private and government information technology communities. Using this exemplary method, a target, having confirmed a hacking attack, could include a flag concealed into its response. Then, participating nodes and conduit hosts could be supplied and updated with this hacker related validated information so that the participating entities can detect passage of the flag and, for example, record information related to the flag and associated data. In this way, even though an attacker may have removed the information relating to the true origin of the attack by using several intermediary computer systems, the attacker would still need to eventually receive the information about the target either directly or indirectly. In other words, no matter how many intermediate steps the attacker uses, or what method of communication is used, the flagged, or otherwise identified, packet would still reach the attacking station and would trigger, for example, reporting, showing the path to the attacker. In actuality, the more steps the attacker takes to disguise their origin actually increases the chance of detection given the exposure in multiple nodes between the additional intermediary computing devices.
- The two systems, used in conjunction, can cover a broad spectrum of attacks. The long-range attacks with many hops are vulnerable to flag detection at intermediate nodes, while closer range attacks are more vulnerable to direct detection. These techniques avoid the need for general surveillance of individual packets flowing through internet nodes in an effort to track hackers attempting to break into a protected network. It also allows for the protection of the integrity of private information, since all of the information regarding the hacker can be relayed voluntarily to, for example, law enforcement personnel, from, for example, the host detecting the hacker and/or one or more monitoring centers.
- In addition to the monitoring systems according to exemplary embodiments of this invention, a retaliatory cyber attack, i.e., counter attack, can be launched at any time after commencement of the unauthorized access attempt. An attacker is most vulnerable to a counter attack during their own attack, since the attacker generally has to substantially remove their system's defensive mechanism. Accordingly, an exemplary embodiment of this invention takes advantage of the hacker's weaknesses and allows the performing of counter attacks in near real-time. Specifically, when a decision on retaliation has been made, for example, by law enforcement personnel, and after confirmation of the attacker's origin, a retaliatory action can be launched. In particular, for example, a concealed program could be embedded into a response to the attacker such as embedded in an HTML page. The program could contain code similar to those found in destructive viruses. The triggering mechanism could be, for example, embedded with additional levels of verification to ensure the hostile intent, identity, or the like, of the attacker. For example, a false request for a password could be made while the target system does not employ password-based security features. By entering any password, or otherwise responding to the request, the attacker could confirm that the attacker is in fact not familiar with the protocols of the target system, and therefore, is an unauthorized user. At the same time, entering any response to, for example, the password could trigger the concealed destructive program that can, for example, destroy files and/or the operating system of the attacker's computer.
- Additionally, in an exemplary embodiment of this invention, the targeted system could act as a conduit to relay response information, such as packets, returned to the hacker from one or more of the monitoring centers to retain the original targeted addresses. These response packets may contain flags or retaliation codes as described above, depending on the analysis and the decision made by one or more of the monitoring centers. The restricted tunnel may be implemented using a commercial VPN, a dedicated link with or without encryption, or the like.
-
FIG. 1 illustrates an exemplary distributednetwork protection system 100. The distributednetwork protection system 100 comprises one ormore monitoring centers 200, one ormore targets 300, and anhacker 400 being connected bylinks 5 and one or more distributednetworks 10. The distributednetwork protection system 100 can also be connected to one or more other distributed network protection systems and is scalable depending on the particular implementation. Additionally, while thehacker 400 is illustrated as a single entity, it should be appreciated that thehacker 400 can be one or more devices, computers or entities, and can be located at one or more geographic or cyber locations. - While the exemplary embodiment illustrated in
FIG. 1 shows the distributednetwork protection system 100 and associated components collocated, it is to be appreciated that the various components of the distributed network protection system can be located at distant portions of a distributed network, such as a local area network, a wide area network, an intranet, and/or the Internet, or within a dedicated distributed network protection system. Thus, it should be appreciated that the components of the distributed network protection system can be combined into one device or collocated on a particular node of a distributed network. Furthermore, it should be appreciated that for ease of illustration, the various functional components of the distributed network protection system have been divided as illustrated inFIG. 1 . However, any of the functional components illustrated inFIG. 1 can be combined without affecting the operation of the system. As will be appreciated from the following description, and for reasons of computational efficiency, the components of the distributed network protection system can be arranged in any location within a distributed network without affecting the operation of the system. - Furthermore, the
links 5 can be a wired or wireless link or any other known or later developed element(s) that is capable of supplying and communicating electronic data to and from the connected elements. Additionally, the distributed network protection system can comprise one or more input devices (not shown) that can include, for example, a keyboard, a mouse, a speech text converter, a stylus, or the like. In general, the input device can be any device capable of communicating information to the distributednetwork protection system 100. Furthermore, the distributednetwork protection system 100 can comprise one or more display devices (not shown) such as a computer monitor, a display on a PDA, or any other device capable of displaying information to one or more users. - The monitoring centers 200 monitor one or more of traffic and/or alarms received from one or
more targets 300. Thetargets 300 can be a particular node on a distributed network, such as a single entity, or could be scalable, such that the target could be defined based on, for example, a geographic location having a plurality of entities, a country, a portion of an IP address, or the like. In general, thetargets 300 can be any device, entity or portion of a distributed network, for which protection is desired. Furthermore, alarms received from the one ormore targets 300 can be localized and/or distributed based on the particular implementation specifics. - In operation, for a first exemplary embodiment, in which the
individual targets 300 perform an initial unauthorizedaccess attempt detection 20, thetarget 300forwards alarm information 30 to one ormore monitoring systems 200. Themonitoring system 200 optionally commences logging a portion of the transactions with thetarget 300, and hence, thehacker 400. Themonitoring center 200 then identifies the source of the attack and verifies the intrusion attempt as discussed above. For example, using various techniques, themonitoring center 200 can initiate various communications with thehacker 400 in an attempt to verify the authenticity of the unauthorized access attempt. Ifmonitoring system 200 determines that the communications with the target are an unauthorized access attempt, themonitoring system 200 can enter an analysis mode where all or a portion of the communications from thehacker 400 are analyzed to, for example, determine the identity of the hacker, the source of attack, hacking patterns, characteristics of the hack attempt, or the like. Upon determining, for example, the identity and/or location of the hacker, themonitoring system 200 can determine any necessary responsive action that may be appropriate. Depending on the nature of the responsive action, themonitoring center 200 can escalate the unauthorized access attempt to another monitoring center higher in the chain. As previously discussed, the Level 2 monitoring center could, for example, make any decisions regarding possible retaliatory action, compare the referral from the Level 1 monitoring center to other unauthorized access attempts from other Level 1 centers, carry out retaliatory action, or the like. -
FIG. 2 illustrates anexemplary monitoring center 200. Themonitoring center 200 comprises an I/O interface 210, acontroller 220, amemory 230, adatabase 240, aresponse system 250, anintrusion analysis system 260, anintrusion reaction system 270, and anescalation determination system 280, all interconnected bylink 5. Additionally, themonitoring center 200 can be connected to one or more other monitoring centers and/ortargets 300 vianetwork 10 and thelinks 5. - Upon receiving an alarm from one or more targets, the
monitoring center 200, in cooperation with the I/O interface 210, thecontroller 220, thememory 230, and theintrusion analysis system 260, determines the accuracy of the alarm. In particular, theintrusion analysis system 260, in cooperation withdatabase 240, analyzes the intrusion attempt and compares it to, for example, historical profiles and/or other previous attempts, or communicates with other monitoring centers to determine whether other targets are being attacked with the same or similar unauthorized access requests. Upon verification of the attack, theintrusion analysis system 260, in cooperation withintrusion interaction system 270, the I/O interface 210, thecontroller 220 and thememory 230, can engage the one ormore hackers 400 in an attempt to determine the source of the attack. Then, for example, depending on the scale and success of the attack, the identity of the attacker, and the number of previous attack attempts, theescalation determination system 280 can determine whether, for example, retaliatory action, law enforcement procedures, or the like, should be taken. If it is determined that further action need be taken, themonitoring center 200 can escalate the alarm, and any related alarm information, to another monitoring center higher, for example a Level 2 monitoring center, in the hierarchy. Alternatively, themonitoring center 200 which received the alarm, in cooperation with theresponse system 250, the I/O interface 210, thecontroller 220 andmemory 230 can, for example, forward various notification messages to the one or more affected or unaffected targets, notifications to one or more other monitoring centers at various levels in the hierarchy, or the like. -
FIG. 3 illustrates an exemplary embodiment of protecting a distributed network according to this invention. In particular, control begins in step S100 and continues to step S110. In step S110, an alarm signal is received from one or more targets. Next in step S120, logging of all or a portion of the information to and/or from the attacked target is commenced. However, it is to be understood that the logging can be performed in a controlled manner where, for example, repetitive events are not logged and thresholds set governing the extent of the logging. Control then continues to step S130. - In step S130, a determination is made whether the alarm information is being forwarded from another monitoring center. If the alarm information is being forwarded from another monitoring center, such as from a Level 1 monitoring center to a Level 2 monitoring center, control jumps to step S180. Otherwise, control continues to step S140.
- In step S140, the source of the attack is identified. Next, in step S150, the communications with the target are verified as an unauthorized access attempt. Then, in step S160, if the communications with the target are determined to be an unauthorized access attempt, control jumps to step S180. Otherwise, control optionally continues to step S170 where, for example, a message is forwarded to the target indicating, for example, there has been a false alarm.
- In step S180, the unauthorized access attempt is analyzed. Next, in step S190, any responsive action is determined. Control then continues to step S200, where the control sequence ends.
-
FIG. 4 illustrates a second exemplary embodiment for protecting a distributed network according to this invention. In particular, in this exemplary embodiment, one or more monitoring centers are responsible for detecting unauthorized access attempts. Specifically, control begins in step S400 and continues to step S410. In step S410, network traffic on a portion of a distributed network is analyzed. Next, in step S420, a determination is made whether an unauthorized access attempt has been detected. If no unauthorized access attempt has been detected, control continues to step S430. Otherwise, control jumps back to step S410. - In step S430, logging of, for example, all communications from a particular origin to a particular destination are recorded. Next, in step S440, a determination is made whether information regarding the unauthorized access attempt has been forwarded or received by another monitoring center. If the alarm information has been escalated from another monitoring center, control jumps to step S480, where, for example, the gathered information can be compared, analyzed, or the like. Otherwise, control continues to step S450. In step S450, the source of the attack is identified. Next, in step S460, the intrusion attempt is verified. Then, in step S470, an optional message can be sent to the target indicating an intrusion attempt is underway. Control then continues to step S480.
- In step S480, the unauthorized access attempt can be analyzed, and compared to, for example, other unauthorized access attempts, or the like. Next, in step S490, responsive action to the unauthorized access attempt is determined. Control then continues to step S500 where the control sequence ends.
- As illustrated in
FIGS. 1-2 , the distributed network protection system can be implemented either on a single programmed general purpose computer or a separate programmed general purpose computer. However, the distributed network protection system can also be implemented on a special purpose computer, microprocessor or microcontroller and peripheral integrated circuit element, an ASIC or other integrated circuit, a digital signal processor, a hardwired electronic or logic circuit, such as a discrete element circuit, a programmable logic device such as a PLD, PLA, FPGA, PAL, or the like. In general, any device capable of implementing a finite state machine that is in turn capable of implementing the flowcharts inFIGS. 3-4 can be used to implement the distributed network protection system according to this invention. - Furthermore, the disclosed method may be readily implemented in software using object or object-oriented software development environments that provide portable source code that can be used on a variety of computer or workstation hardware platforms. Alternatively, the disclosed distributed network protection system may be implemented partially or fully in hardware using standard logic circuits or VLSI design. Whether hardware or software is used to implement the systems and methods in accordance with this invention is dependent on the speed and/or efficiency requirements of the system, the particular function, and the particular software and/or hardware systems or microprocessor or microcomputer systems being utilized. The distributed network protection system illustrated herein, however, can be readily implemented in hardware and/or software using any known or later-developed systems or structures, devices and/or software by those of ordinary skill in the applicable art from the functional description provided herein and with a general basic knowledge of the computer arts.
- Moreover, the disclosed methods may be readily implemented as software executed on a programmed general purpose computer, a special purpose computer, a microprocessor or the like. In these instances, the methods and systems of this invention can be implemented as a program embedded in a personal computer, a piece of executable code, or the like, such as a Java® or CGI script, as an cookie, as a resource residing on a server or graphics workstation, as a routine embedded in a dedicated distributed network protection system, or the like. The distributed network protection system can also be implemented by physically incorporating the systems and methods into a hardware and/or software system, such as the hardware and software systems of a computer or dedicated distributed network protection system.
- The devices and subsystems of the exemplary embodiments of
FIGS. 1-4 can include computer readable medium or memories for holding instructions programmed according to the teachings of the present invention and for holding data structures, tables, records, and/or other data described herein. Computer readable medium can include any suitable medium that participates in providing instructions to a processor for execution. Such a medium can take many forms, including but not limited to, non-volatile media, volatile media, etc. Non-volatile media can include, for example, optical or magnetic disks, magneto-optical disks, and the like. Volatile media can include dynamic memories, and the like. Transmission media can include coaxial cables, copper wire, fiber optics, and the like. Common forms of computer-readable media can include, for example, a floppy disk, a flexible disk, hard disk, magnetic tape, any other suitable magnetic medium, a CD-ROM, CDRW, DVD, any other suitable optical medium, a RAM, a PROM, an EPROM, a FLASH-EPROM, any other suitable memory chip or cartridge, or any other suitable medium from which a computer can read. - It is, therefore, apparent that there has been provided, in accordance with the present invention, systems and methods for protecting distributed networks. While this invention has been described in conjunction with a number of embodiments, it is evident that many alternatives, modifications and variations would be or are apparent to those of ordinary skill in the applicable art. Accordingly, applicants intend to embrace all such alternatives, modifications and variations that are within the spirit and scope of this invention.
Claims (30)
1. A communications network protection system, the system comprising:
one or more computers or devices of a protected communications network that serve as a target of a hacker attack over a communications network;
first through third level monitoring centers for receiving information regarding hacker attacks in a geographical area or an organizational structure corresponding to the protected communications network, and for determining appropriate retaliatory or legal action against the hacker attacks; and
one or more distributed databases linked to a centralized databases and located within respective of the first and second level monitoring centers for maintaining respective information regarding monitored hacker attacks in the geographical area or the organizational structure corresponding to the protected communications network, and the determined appropriate retaliatory or legal action against the hacker attacks.
2. The system of claim 1 , wherein the hacker attacks are determined by the first level monitoring centers based on real-time unauthorized access attempt alarms received from the protected communications network.
3. The system of claim 1 , wherein the geographical area includes commercial and public sites corresponding to the protected communications network.
4. The system of claim 1 , wherein the organizational structure includes law enforcement, Department of Defense, Armed Forces, government, commercial organizations, or e-commerce sites corresponding to the protected communications network.
5. The system of claim 1 , wherein, based on a referral from a site of the protected communications network that is attacked, one of the first through third level monitoring centers poses as the attacked site to an attacker for positive identification of the attacker, and once the hacker attack is confirmed, the attacked site or one of the first level monitoring centers sends a response to the attacker and including a concealed flag in the response for detection of the response via the flag, as the response passes through the protected communications network, for identifying the origin of the hacker attack and locations of previous attacks related to the hacker attack.
6. The system of claim 1 , wherein the second level monitoring centers receive referrals from the first level monitoring centers and make a decision on possible retaliatory action or other action if warranted based on a nature of an attack.
7. The system of claim 1 , wherein the third level monitoring centers collect and analyze information received from the second level monitoring centers to monitor the overall security condition of the protected communications network, including a national cyberspace of one or more countries.
8. The system of claim 1 , wherein the protected communications network includes one or more unauthorized access attempt detection systems for determining the hacker attacks and reporting the hacker attacks to the first level monitoring centers.
9. The system of claim 8 , wherein the unauthorized access attempt detection systems are embedded in a firewall or operating system of the protected communications network to gather information about an unauthorized access in real-time or near real-time and provide the gathered information to the first level monitoring centers.
10. The system of claim 1 , wherein the centralized and distributed databases include mechanisms to shield from unauthorized access, to host data, to store detailed data regarding a hacker or attacker, and to store data regarding law enforcement and links to law enforcement agencies.
11. A communications network protection method, the method comprising:
providing one or more computers or devices of a protected communications network that serve as a target of a hacker attack over a communications network;
receiving, via first through third level monitoring centers, information regarding hacker attacks in a geographical area or an organizational structure corresponding to the protected communications network;
determining, via the first through third level monitoring centers, appropriate retaliatory or legal action against the hacker attacks; and
maintaining via one or more distributed databases linked to a centralized databases and located within respective of the first and second level monitoring centers, respective information regarding monitored hacker attacks in the geographical area or the organizational structure corresponding to the protected communications network, and the determined appropriate retaliatory or legal action against the hacker attacks.
12. The method of claim 11 , wherein the hacker attacks are determined by the first level monitoring centers based on real-time unauthorized access attempt alarms received from the protected communications network.
13. The method of claim 11 , wherein the geographical area includes commercial and public sites corresponding to the protected communications network.
14. The method of claim 11 , wherein the organizational structure includes law enforcement, Department of Defense, Armed Forces, government, commercial organizations, or e-commerce sites corresponding to the protected communications network.
15. The method of claim 11 , wherein, based on a referral from a site of the protected communications network that is attacked, one of the first through third level monitoring centers poses as the attacked site to an attacker for positive identification of the attacker, and once the hacker attack is confirmed, the attacked site or one of the first level monitoring centers sends a response to the attacker and including a concealed flag in the response for detection of the response via the flag, as the response passes through the protected communications network, for identifying the origin of the hacker attack and locations of previous attacks related to the hacker attack.
16. The method of claim 11 , wherein the second level monitoring centers receive referrals from the first level monitoring centers and make a decision on possible retaliatory action or other action if warranted based on a nature of an attack.
17. The method of claim 11 , wherein the third level monitoring centers collect and analyze information received from the second level monitoring centers to monitor the overall security condition of the protected communications network, including a national cyberspace of one or more countries.
18. The method of claim 11 , wherein the protected communications network includes one or more unauthorized access attempt detection systems for determining the hacker attacks and reporting the hacker attacks to the first level monitoring centers.
19. The method of claim 18 , wherein the unauthorized access attempt detection systems are embedded in a firewall or operating system of the protected communications network to gather information about an unauthorized access in real-time or near real-time and provide the gathered information to the first level monitoring centers.
20. The method of claim 11 , wherein the centralized and distributed databases include mechanisms to shield from unauthorized access, to host data, to store detailed data regarding a hacker or attacker, and to store data regarding law enforcement and links to law enforcement agencies.
21. A computer program product for communications network protection, including one or more computer readable instructions stored on a computer readable medium and configured to cause one or more computer processors to perform the steps of:
providing one or more computers or devices of a protected communications network that serve as a target of a hacker attack over a communications network;
receiving, via first through third level monitoring centers, information regarding hacker attacks in a geographical area or an organizational structure corresponding to the protected communications network;
determining, via the first through third level monitoring centers, appropriate retaliatory or legal action against the hacker attacks; and
maintaining via one or more distributed databases linked to a centralized databases and located within respective of the first and second level monitoring centers, respective information regarding monitored hacker attacks in the geographical area or the organizational structure corresponding to the protected communications network, and the determined appropriate retaliatory or legal action against the hacker attacks.
22. The computer program product of claim 21 , wherein the hacker attacks are determined by the first level monitoring centers based on real-time unauthorized access attempt alarms received from the protected communications network.
23. The computer program product of claim 21 , wherein the geographical area includes commercial and public sites corresponding to the protected communications network.
24. The computer program product of claim 21 , wherein the organizational structure includes law enforcement, Department of Defense, Armed Forces, government, commercial organizations, or e-commerce sites corresponding to the protected communications network.
25. The computer program product of claim 21 , wherein, based on a referral from a site of the protected communications network that is attacked, one of the first through third level monitoring centers poses as the attacked site to an attacker for positive identification of the attacker, and once the hacker attack is confirmed, the attacked site or one of the first level monitoring centers sends a response to the attacker and including a concealed flag in the response for detection of the response via the flag, as the response passes through the protected communications network, for identifying the origin of the hacker attack and locations of previous attacks related to the hacker attack.
26. The computer program product of claim 21 , wherein the second level monitoring centers receive referrals from the first level monitoring centers and make a decision on possible retaliatory action or other action if warranted based on a nature of an attack.
27. The computer program product of claim 21 , wherein the third level monitoring centers collect and analyze information received from the second level monitoring centers to monitor the overall security condition of the protected communications network, including a national cyberspace of one or more countries.
28. The computer program product of claim 21 , wherein the protected communications network includes one or more unauthorized access attempt detection systems for determining the hacker attacks and reporting the hacker attacks to the first level monitoring centers.
29. The computer program product of claim 28 , wherein the unauthorized access attempt detection systems are embedded in a firewall or operating system of the protected communications network to gather information about an unauthorized access in real-time or near real-time and provide the gathered information to the first level monitoring centers.
30. The computer program product of claim 21 , wherein the centralized and distributed databases include mechanisms to shield from unauthorized access, to host data, to store detailed data regarding a hacker or attacker, and to store data regarding law enforcement and links to law enforcement agencies.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US12/538,951 US20090320132A1 (en) | 2000-05-31 | 2009-08-11 | Systems and methods for distributed network protection |
Applications Claiming Priority (5)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US20805600P | 2000-05-31 | 2000-05-31 | |
US09/867,442 US7089303B2 (en) | 2000-05-31 | 2001-05-31 | Systems and methods for distributed network protection |
US11/490,046 US7197563B2 (en) | 2001-05-31 | 2006-07-21 | Systems and methods for distributed network protection |
US11/723,793 US7698444B2 (en) | 2000-05-31 | 2007-03-22 | Systems and methods for distributed network protection |
US12/538,951 US20090320132A1 (en) | 2000-05-31 | 2009-08-11 | Systems and methods for distributed network protection |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/723,793 Continuation US7698444B2 (en) | 2000-05-31 | 2007-03-22 | Systems and methods for distributed network protection |
Publications (1)
Publication Number | Publication Date |
---|---|
US20090320132A1 true US20090320132A1 (en) | 2009-12-24 |
Family
ID=37420710
Family Applications (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/490,046 Expired - Fee Related US7197563B2 (en) | 2000-05-31 | 2006-07-21 | Systems and methods for distributed network protection |
US11/723,793 Expired - Fee Related US7698444B2 (en) | 2000-05-31 | 2007-03-22 | Systems and methods for distributed network protection |
US12/538,951 Abandoned US20090320132A1 (en) | 2000-05-31 | 2009-08-11 | Systems and methods for distributed network protection |
Family Applications Before (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/490,046 Expired - Fee Related US7197563B2 (en) | 2000-05-31 | 2006-07-21 | Systems and methods for distributed network protection |
US11/723,793 Expired - Fee Related US7698444B2 (en) | 2000-05-31 | 2007-03-22 | Systems and methods for distributed network protection |
Country Status (1)
Country | Link |
---|---|
US (3) | US7197563B2 (en) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20080295171A1 (en) * | 2007-05-23 | 2008-11-27 | Honeywell International Inc. | Intrusion Detection System For Wireless Networks |
US20080291017A1 (en) * | 2007-05-23 | 2008-11-27 | Honeywell International Inc. | Apparatus and method for deploying a wireless network intrusion detection system to resource-constrained devices |
Families Citing this family (22)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10511573B2 (en) | 1998-10-30 | 2019-12-17 | Virnetx, Inc. | Agile network protocol for secure communications using secure domain names |
US6839759B2 (en) | 1998-10-30 | 2005-01-04 | Science Applications International Corp. | Method for establishing secure communication link between computers of virtual private network without user entering any cryptographic information |
ES2760905T3 (en) * | 1998-10-30 | 2020-05-18 | Virnetx Inc | An agile network protocol for secure communications with assured system availability |
US6502135B1 (en) * | 1998-10-30 | 2002-12-31 | Science Applications International Corporation | Agile network protocol for secure communications with assured system availability |
US7418504B2 (en) | 1998-10-30 | 2008-08-26 | Virnetx, Inc. | Agile network protocol for secure communications using secure domain names |
US8352582B2 (en) | 2001-06-28 | 2013-01-08 | Koninklijke Philips Electronics N.V. | Temporal proximity to verify physical proximity |
US9503470B2 (en) * | 2002-12-24 | 2016-11-22 | Fred Herz Patents, LLC | Distributed agent based model for security monitoring and response |
US8839419B2 (en) * | 2008-04-05 | 2014-09-16 | Microsoft Corporation | Distributive security investigation |
US8339959B1 (en) | 2008-05-20 | 2012-12-25 | Juniper Networks, Inc. | Streamlined packet forwarding using dynamic filters for routing and security in a shared forwarding plane |
US8955107B2 (en) * | 2008-09-12 | 2015-02-10 | Juniper Networks, Inc. | Hierarchical application of security services within a computer network |
US8040808B1 (en) | 2008-10-20 | 2011-10-18 | Juniper Networks, Inc. | Service aware path selection with a network acceleration device |
US9135460B2 (en) * | 2011-12-22 | 2015-09-15 | Microsoft Technology Licensing, Llc | Techniques to store secret information for global data centers |
US9251535B1 (en) | 2012-01-05 | 2016-02-02 | Juniper Networks, Inc. | Offload of data transfer statistics from a mobile access gateway |
US9648029B2 (en) * | 2012-07-30 | 2017-05-09 | Newegg Inc. | System and method of active remediation and passive protection against cyber attacks |
JP5987627B2 (en) * | 2012-10-22 | 2016-09-07 | 富士通株式会社 | Unauthorized access detection method, network monitoring device and program |
WO2014144857A2 (en) * | 2013-03-15 | 2014-09-18 | Power Fingerprinting Inc. | Systems, methods, and apparatus to enhance the integrity assessment when using power fingerprinting systems for computer-based systems |
US9591022B2 (en) | 2014-12-17 | 2017-03-07 | The Boeing Company | Computer defenses and counterattacks |
US9268938B1 (en) | 2015-05-22 | 2016-02-23 | Power Fingerprinting Inc. | Systems, methods, and apparatuses for intrusion detection and analytics using power characteristics such as side-channel information collection |
US10187321B2 (en) * | 2015-08-19 | 2019-01-22 | Cisco Technology, Inc. | Dynamic VPN policy model with encryption and traffic engineering resolution |
US20170085577A1 (en) * | 2015-09-22 | 2017-03-23 | Lorraine Wise | Computer method for maintaining a hack trap |
US10200400B2 (en) * | 2016-08-11 | 2019-02-05 | Netsec Concepts LLC | Method for avoiding attribution while tracking criminals |
EP3528163A1 (en) * | 2018-02-19 | 2019-08-21 | Argus Cyber Security Ltd | Cryptic vehicle shield |
Citations (25)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5239294A (en) * | 1989-07-12 | 1993-08-24 | Motorola, Inc. | Method and apparatus for authenication and protection of subscribers in telecommunication systems |
US5550551A (en) * | 1994-07-25 | 1996-08-27 | At&T Corp. | Position monitoring system and method |
US5694335A (en) * | 1996-03-12 | 1997-12-02 | Hollenberg; Dennis D. | Secure personal applications network |
US5796952A (en) * | 1997-03-21 | 1998-08-18 | Dot Com Development, Inc. | Method and apparatus for tracking client interaction with a network resource and creating client profiles and resource database |
US5825283A (en) * | 1996-07-03 | 1998-10-20 | Camhi; Elie | System for the security and auditing of persons and property |
US5864683A (en) * | 1994-10-12 | 1999-01-26 | Secure Computing Corporartion | System for providing secure internetwork by connecting type enforcing secure computers to external network for limiting access to data based on user and process access rights |
US5867495A (en) * | 1996-11-18 | 1999-02-02 | Mci Communications Corporations | System, method and article of manufacture for communications utilizing calling, plans in a hybrid network |
US5969433A (en) * | 1997-04-23 | 1999-10-19 | Maggiora; David Raymond | Theft preventing and deterring system and method using a remote station |
US6049272A (en) * | 1997-01-22 | 2000-04-11 | Boyd B. Moore et al. | Automated data transmission link to law enforcement and security personnel |
US6154844A (en) * | 1996-11-08 | 2000-11-28 | Finjan Software, Ltd. | System and method for attaching a downloadable security profile to a downloadable |
US6256773B1 (en) * | 1999-08-31 | 2001-07-03 | Accenture Llp | System, method and article of manufacture for configuration management in a development architecture framework |
US6275942B1 (en) * | 1998-05-20 | 2001-08-14 | Network Associates, Inc. | System, method and computer program product for automatic response to computer system misuse using active response modules |
US20020003571A1 (en) * | 2000-03-02 | 2002-01-10 | Kenneth Schofield | Video mirror systems incorporating an accessory module |
US20020023227A1 (en) * | 2000-08-18 | 2002-02-21 | Sheymov Victor I. | Systems and methods for distributed network protection |
US6363489B1 (en) * | 1999-11-29 | 2002-03-26 | Forescout Technologies Inc. | Method for automatic intrusion detection and deflection in a network |
US6370573B1 (en) * | 1999-08-31 | 2002-04-09 | Accenture Llp | System, method and article of manufacture for managing an environment of a development architecture framework |
US6405318B1 (en) * | 1999-03-12 | 2002-06-11 | Psionic Software, Inc. | Intrusion detection system |
US6519703B1 (en) * | 2000-04-14 | 2003-02-11 | James B. Joyce | Methods and apparatus for heuristic firewall |
US6735702B1 (en) * | 1999-08-31 | 2004-05-11 | Intel Corporation | Method and system for diagnosing network intrusion |
US6738909B1 (en) * | 1999-09-02 | 2004-05-18 | International Business Machines Corporation | Method and apparatus for automatic configuration for internet protocol security tunnels in a distributed data processing system |
US6748540B1 (en) * | 1999-06-17 | 2004-06-08 | International Business Machines Corporation | Method and apparatus for detection and notification of unauthorized access attempts in a distributed data processing system |
US6886102B1 (en) * | 1999-07-14 | 2005-04-26 | Symantec Corporation | System and method for protecting a computer network against denial of service attacks |
US6975220B1 (en) * | 2000-04-10 | 2005-12-13 | Radia Technologies Corporation | Internet based security, fire and emergency identification and communication system |
US6981146B1 (en) * | 1999-05-17 | 2005-12-27 | Invicta Networks, Inc. | Method of communications and communication network intrusion protection methods and intrusion attempt detection system |
US7089303B2 (en) * | 2000-05-31 | 2006-08-08 | Invicta Networks, Inc. | Systems and methods for distributed network protection |
Family Cites Families (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
DE69937464T2 (en) | 1999-01-14 | 2008-08-21 | Nokia Corp. | METHOD AND DEVICE FOR HEARING |
US7574740B1 (en) | 2000-04-28 | 2009-08-11 | International Business Machines Corporation | Method and system for intrusion detection in a computer network |
NL1015389C2 (en) | 2000-06-07 | 2001-12-10 | Koninkl Kpn Nv | Method and system for securing a data system. |
-
2006
- 2006-07-21 US US11/490,046 patent/US7197563B2/en not_active Expired - Fee Related
-
2007
- 2007-03-22 US US11/723,793 patent/US7698444B2/en not_active Expired - Fee Related
-
2009
- 2009-08-11 US US12/538,951 patent/US20090320132A1/en not_active Abandoned
Patent Citations (26)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5239294A (en) * | 1989-07-12 | 1993-08-24 | Motorola, Inc. | Method and apparatus for authenication and protection of subscribers in telecommunication systems |
US5550551A (en) * | 1994-07-25 | 1996-08-27 | At&T Corp. | Position monitoring system and method |
US5864683A (en) * | 1994-10-12 | 1999-01-26 | Secure Computing Corporartion | System for providing secure internetwork by connecting type enforcing secure computers to external network for limiting access to data based on user and process access rights |
US5694335A (en) * | 1996-03-12 | 1997-12-02 | Hollenberg; Dennis D. | Secure personal applications network |
US5825283A (en) * | 1996-07-03 | 1998-10-20 | Camhi; Elie | System for the security and auditing of persons and property |
US6154844A (en) * | 1996-11-08 | 2000-11-28 | Finjan Software, Ltd. | System and method for attaching a downloadable security profile to a downloadable |
US5867495A (en) * | 1996-11-18 | 1999-02-02 | Mci Communications Corporations | System, method and article of manufacture for communications utilizing calling, plans in a hybrid network |
US6049272A (en) * | 1997-01-22 | 2000-04-11 | Boyd B. Moore et al. | Automated data transmission link to law enforcement and security personnel |
US5796952A (en) * | 1997-03-21 | 1998-08-18 | Dot Com Development, Inc. | Method and apparatus for tracking client interaction with a network resource and creating client profiles and resource database |
US5969433A (en) * | 1997-04-23 | 1999-10-19 | Maggiora; David Raymond | Theft preventing and deterring system and method using a remote station |
US6275942B1 (en) * | 1998-05-20 | 2001-08-14 | Network Associates, Inc. | System, method and computer program product for automatic response to computer system misuse using active response modules |
US6405318B1 (en) * | 1999-03-12 | 2002-06-11 | Psionic Software, Inc. | Intrusion detection system |
US6981146B1 (en) * | 1999-05-17 | 2005-12-27 | Invicta Networks, Inc. | Method of communications and communication network intrusion protection methods and intrusion attempt detection system |
US6748540B1 (en) * | 1999-06-17 | 2004-06-08 | International Business Machines Corporation | Method and apparatus for detection and notification of unauthorized access attempts in a distributed data processing system |
US6886102B1 (en) * | 1999-07-14 | 2005-04-26 | Symantec Corporation | System and method for protecting a computer network against denial of service attacks |
US6735702B1 (en) * | 1999-08-31 | 2004-05-11 | Intel Corporation | Method and system for diagnosing network intrusion |
US6370573B1 (en) * | 1999-08-31 | 2002-04-09 | Accenture Llp | System, method and article of manufacture for managing an environment of a development architecture framework |
US6256773B1 (en) * | 1999-08-31 | 2001-07-03 | Accenture Llp | System, method and article of manufacture for configuration management in a development architecture framework |
US6738909B1 (en) * | 1999-09-02 | 2004-05-18 | International Business Machines Corporation | Method and apparatus for automatic configuration for internet protocol security tunnels in a distributed data processing system |
US6363489B1 (en) * | 1999-11-29 | 2002-03-26 | Forescout Technologies Inc. | Method for automatic intrusion detection and deflection in a network |
US20020003571A1 (en) * | 2000-03-02 | 2002-01-10 | Kenneth Schofield | Video mirror systems incorporating an accessory module |
US6975220B1 (en) * | 2000-04-10 | 2005-12-13 | Radia Technologies Corporation | Internet based security, fire and emergency identification and communication system |
US6519703B1 (en) * | 2000-04-14 | 2003-02-11 | James B. Joyce | Methods and apparatus for heuristic firewall |
US7089303B2 (en) * | 2000-05-31 | 2006-08-08 | Invicta Networks, Inc. | Systems and methods for distributed network protection |
US20020023227A1 (en) * | 2000-08-18 | 2002-02-21 | Sheymov Victor I. | Systems and methods for distributed network protection |
US7406713B2 (en) * | 2000-08-18 | 2008-07-29 | Invicta Networks, Inc. | Systems and methods for distributed network protection |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20080295171A1 (en) * | 2007-05-23 | 2008-11-27 | Honeywell International Inc. | Intrusion Detection System For Wireless Networks |
US20080291017A1 (en) * | 2007-05-23 | 2008-11-27 | Honeywell International Inc. | Apparatus and method for deploying a wireless network intrusion detection system to resource-constrained devices |
US7966660B2 (en) | 2007-05-23 | 2011-06-21 | Honeywell International Inc. | Apparatus and method for deploying a wireless network intrusion detection system to resource-constrained devices |
Also Published As
Publication number | Publication date |
---|---|
US20070168532A1 (en) | 2007-07-19 |
US7197563B2 (en) | 2007-03-27 |
US20060259970A1 (en) | 2006-11-16 |
US7698444B2 (en) | 2010-04-13 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7698444B2 (en) | Systems and methods for distributed network protection | |
US7089303B2 (en) | Systems and methods for distributed network protection | |
Wheeler et al. | Techniques for cyber attack attribution | |
US7406713B2 (en) | Systems and methods for distributed network protection | |
US6405318B1 (en) | Intrusion detection system | |
US7681234B2 (en) | Preventing phishing attacks | |
US6775657B1 (en) | Multilayered intrusion detection system and method | |
US8549640B2 (en) | System and method for computer security | |
JP4911018B2 (en) | Filtering apparatus, filtering method, and program causing computer to execute the method | |
US20030188190A1 (en) | System and method of intrusion detection employing broad-scope monitoring | |
US7039950B2 (en) | System and method for network quality of service protection on security breach detection | |
JP3967550B2 (en) | Method and system for protecting communication devices from intrusion | |
US20060190993A1 (en) | Intrusion detection in networks | |
JP2002342279A (en) | Filtering device, filtering method and program for making computer execute the method | |
CN116132090B (en) | Spoofing defending system for Web security protection | |
US20210051176A1 (en) | Systems and methods for protection from phishing attacks | |
CN113411295A (en) | Role-based access control situation awareness defense method and system | |
WO2001093531A2 (en) | Systems and methods for distributed network protection | |
Gupta et al. | Cybersecurity: a self-teaching introduction | |
Basholli et al. | Possibility of protection against unauthorized interference in telecommunication systems | |
CN113206852A (en) | Safety protection method, device, equipment and storage medium | |
Jamar et al. | E-shield: Detection and prevention of website attacks | |
Alexander | Using linear regression analysis and defense in depth to protect networks during the global corona pandemic | |
Gomathi et al. | Identification of Network Intrusion in Network Security by Enabling Antidote Selection | |
Aloffi | Real time network security intrusions and risk management: a survey |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: INVICTA NETWORKS INC., VIRGINIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SHEYMOV, VICTOR I.;TURNER, ROGER B.;REEL/FRAME:023076/0722;SIGNING DATES FROM 20010504 TO 20010531 |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |