Indicating malicious entities based on multicast communication patterns
AssigneeHewlett Packard Enterprise Development LP
InventorsTathagata Nandy, Vijay Kannan, Saheli Ganguly
Life of this patent
Estimating the term…
Abstract
In some examples, a network device includes an interface, and a processor to apply a restriction on multicast communication associated with an entity on the interface. The restriction on multicast communication includes detecting, on the interface, a multicast communication pattern associated with the entity, indicating, based on the multicast communication pattern on the interface violating a threshold, that the entity is malicious, and blocking processing of the multicast communication associated with the entity in response to indicating that the entity is malicious.
Claims20
A network device comprising:
- an interface;
- and
- a processor;
- and
- a storage device storing instructions that when executed by the processor cause the processor to perform a method to apply a restriction on multicast communication associated with an entity, the method comprising:
- in response to determining that a number of multicast groups associated with the interface exceeds a first threshold value, placing the interface in a monitored set of interfaces;
- determining whether a number of multicast communication requests received, by an interface in the monitored set of interfaces, from the entity exceeds a second threshold value;
- indicating that the entity is malicious in response to the number of multicast communication requests exceeding the second threshold value;
- and
- blocking processing of the multicast communication associated with the entity in response to indicating that the entity is malicious.
A non-transitory machine-readable storage medium storing instructions that upon execution cause a network device to:
- place an interface of the network device in a monitored set of interfaces, in response to determining that a number of multicast groups associated with the interface exceeds a first threshold value;
- determine whether a number of multicast communication requests received, by an interface in the monitored set of interfaces, from an entity exceeds a second threshold value;
- indicate that the entity is malicious in response to the number of multicast communication requests exceeding the second threshold value;
- and
- block processing of a multicast communication associated with the entity in response to indicating that the entity is malicious.
A method of a network device comprising a processor, comprising:
- d in response to determining that a number of multicast groups associated with a port of the network device exceeds a first threshold, placing the port in a monitored set of ports;
- determining whether a number of multicast communication requests received, by a port in the monitored set of ports, from an entity exceeds a second threshold;
- indicating that the entity is malicious in response to the number of multicast communication requests exceeding the second threshold;
- and
- blocking processing of multicast communication associated with the entity in response to indicating that the entity is malicious.
Dependencies are inferred from the claim text.