Back to results
US 10,484,412 B2Granted
Identification of infected devices in broadband environments
AssigneeCenturyLink Intellectual Property LLC
InventorsMichael Glenn, Donald J. Smith, John Butala
Life of this patent
Estimating the term…
Abstract
Novel solutions for detecting and/or treating malware on a subscriber's premise network. Such solutions can include, but are not limited to, tools and techniques that can detect, and/or enable the detection of, malware infections on individual subscriber devices within the subscriber's network. In a particular embodiment, for example, a premise gateway, or other device on the subscriber's premise network, is configured to analyze packets traveling through the premise gateway and, based on that analysis, identify one or more subscriber devices that are infected with malware.
Claims32
A method of identifying a malware infection, the method comprising:
- providing, with a premise gateway, communication between a premise network at a customer premises and an external network outside the customer premises, the premise network comprising a plurality of customer devices;
- receiving, with a malware detection device at the customer premises and from a specified location in a service provider network, an indication that the specified location in the service provider network detected infected network traffic associated with the customer premises;
- activating, at the malware detection device, an analysis function of the malware detection device based on the indication received from the specified location in the service provider network that infected network traffic is associated the customer premises;
- analyzing, with the malware detection device at the customer premises, network traffic between the premise network and the external network;
- identifying, with the malware detection device, one or more infected customer devices that are infected with malware, based on analysis of the network traffic;
- and
- taking, with at least one of the malware detection device or the premise gateway, one or more actions to notify the customer of an identification of the one or more infected customer devices, wherein taking one or more actions to notify the customer comprises blocking, with at least one of the malware detection device located at the customer premises or the premise gateway located at the customer premises, an outbound request for a first webpage from a customer device other than the one or more infected customer devices, in response to blocking the outbound request, returning with at least one of the malware detection device or the premise gateway, a second web page indicating an infected status of the one or more infected customer devices to the customer device other than the one or more infected customer devices, and causing the customer device other than the one or more infected customer devices to display the second web page indicating the infected status of the one or more infected customer devices.
4 more elements
An apparatus, comprising:
- a non-transitory computer readable medium having encoded thereon a set of instructions executable by a malware detection device for programming the malware detection device to:
- provide communication between a premise network at a customer premises and an external network outside the customer premises, the premise network comprising a plurality of customer devices;
- receive, from a specified location in a service provider network, an indication that the specified location in the service provider network detected infected network traffic associated with the customer premises;
- activate an analysis function of the malware detection device based on the indication received from the specified location in the Internet Service provider network that infected network traffic is associated the customer premises;
- analyze network traffic between the premise network and the external network;
- identify one or more infected customer devices that are infected with malware, based on analysis of the network traffic;
- and
- take one or more actions to notify the customer of an identification of the one or more infected customer devices, wherein taking one or more actions to notify the customer comprises blocking an outbound request for a first webpage from a customer device other than the one or more infected customer devices, in response to blocking the outbound request, returning a second web page indicating an infected status of the one or more infected customer devices to the customer device other than the one or more infected customer devices, and causing the customer device other than the one or more infected customer devices to display the second web page indicating the infected status of the one or more infected customer devices.
5 more elements
A malware detection device, comprising:
- a first communication interface in communication with a premise network at a customer premises, the premise network comprising a plurality of customer devices;
- a second communication interface to provide communication with an external network outside the customer premises;
- one or more processors in communication with the first and second communication interfaces;
- and
- a non-transitory computer readable medium in communication with the one or more processors, the computer readable medium having encoded thereon a set of instructions executable by the processor for programming the malware detection device to:
- provide communication between the premise network and the external network;
- receive, from a specified location in a service provider network, an indication that the specified location in the service provider network detected infected network traffic associated with the customer premises;
- activate an analysis function of the malware detection device based on the indication received from the specified location in the Internet Service provider network that infected network traffic is associated the customer premises;
- analyze network traffic between the premise network and the external network;
- identify one or more infected customer devices that are infected with malware, based on analysis of the network traffic;
- and
- take one or more actions to notify the customer of an identification of the one or more infected customer devices, wherein taking one or more actions to notify the customer comprises blocking an outbound request for a first webpage from a customer device other than the one or more infected customer devices, in response to blocking the outbound request, returning a second web page indicating an infected status of the one or more infected customer devices to the customer device other than the one or more infected customer devices, and causing the one or more infected customer devices to display the second web page indicating the infected status of the one or more infected customer devices.
9 more elements
Dependencies are inferred from the claim text.