Identifying malware-infected network devices through traffic monitoring
OwnerDavid Paul Heiliginventor
Life of this patent
Estimating the term…
Abstract
The present invention generally relates to detecting malicious network activity coming from network devices such as routers and firewalls. Specifically, embodiments of the present invention provide for detecting stealth malware on a network device by comparing inbound and outbound network traffic to discover packets originating from the network device and packets that violate configuration rules. When combined with a network traffic monitor server configured to monitor actual network traffic reports and to receive known network traffic reports from host computers, the system can detect stealth network traffic originating from both network devices and host computer systems.
Claims19
A system for detecting malware in a network device, the system comprising:
- a correlation server configured to:
- receive network traffic comprising an entering or exiting Local Area Network (LAN) side packet, or an entering or exiting Wide Area Network (WAN) side packet, wherein the packet is addressed to a final destination that is different from the network device;
- the correlation server being configured to:
- record and analyze data from the packet as first recorded packet data,
- direct the packet to proceed to the network device, wherein the packet traverses the network device and returns to the correlation server,
- again record and analyze the packet data at the correlation server as second recorded packet data, and compare the first recorded packet data to the second recorded packet data;
- determine whether there is a violation or mismatch between the first recorded packet data and second recorded packet data,
- block, modify, or re-route the packet away from the final destination when a violation or mismatch is detected,
- direct the packet to proceed to the final destination when no violation or mismatch is detected;
- and
- wherein said correlation server is further configured to:
- receive a configuration profile corresponding to the network device,
- detect an exiting packet which violates one or more rules in said configuration profile.
A method for detecting malware in network devices comprising the steps of:
- receiving network traffic in the form of a data packet at a correlation server, wherein the packet is addressed to a final destination that is different from the network device;
- recording and analyzing data from the packet as first recorded packet data;
- directing the packet to a network device, wherein the packet traverses the network device;
- directing the packet back to the correlation server after it traverses the network device;
- again recording and analyzing data from the packet as second recorded packet data;
- comparing the first recorded packet data with the second recorded packet data;
- determining whether there is a violation or mismatch between the first recorded packet data and the second recorded packet data;
- modifying, blocking, or rerouting the packet away from the final destination when a violation or mismatch is detected;
- directing the packet to the final destination when no violation or mismatch is detected;
- and
- wherein said correlation server is further configured for:
- receiving a configuration profile corresponding to the network device,
- detecting an exiting packet which violates one or more rules in said configuration profile.
Dependencies are inferred from the claim text.