Detection of network sniffing activity
AssigneePaypal, Inc.
InventorShlomi Boutnaru
Life of this patent
Estimating the term…
Abstract
Methods and systems for detecting passive malicious network-mapping software on a computer network are disclosed. An expected location within a computer system for storing a received data packet may be determined. An actual storage location of the received data packet may be identified and compared to the expected storage location. In the event that the expected location does not match the actual storage location of the received data packet on the computer system, the presence of passive malicious network-mapping software such as a sniffer may be detected.
Claims17
A computer system, comprising:
- a network interface card (NIC);
- at least one processor;
- and
- a non-transitory, computer-readable medium having instructions stored thereon that are executable by the at least one processor to cause the computer system to perform operations, the operations comprising:
- receiving first data via the NIC;
- determining, based on a type of the first data, an expected storage location, of the computer system, for storing the first data, wherein the first data includes at least one of the following types of data:
- address resolution protocol (ARP) data;
- domain name system (DNS) data;
- host name data;
- or
- web resource data;
- identifying an actual storage location, of the computer system, in which the first data is stored;
- comparing the expected storage location for the first data to the actual storage location for the first data;
- based on the comparing, determining that the actual storage location for the first data does not match the expected storage location for the first data;
- and
- in response to the determining that the actual storage location does not match the expected storage location, generating a notification indicating a security risk.
A method, comprising:
- receiving, by a computer system, first data;
- determining, by the computer system based on a type of the first data, an expected storage location for storing the first data, wherein the first data includes at least one of the following types of data:
- ARP data;
- DNS data;
- host name data;
- or
- web resource data;
- identifying, by the computer system, an actual storage location in which the first data is stored;
- comparing, by the computer system, the expected storage location for the first data to the actual storage location for the first data;
- based on the comparing, determining, by the computer system, that the actual storage location for the first data does not match the expected storage location for the first data;
- and
- in response to the determining that the actual storage location does not match the expected storage location, generating, by the computer system, a notification indicating a security risk.
A non-transitory, computer-readable medium having instructions stored thereon that are executable by a computer system to perform operations comprising:
- receiving first data via a NIC;
- determining, based on a type of the first data, an expected storage location, of the computer system, for storing the first data, wherein the first data includes at least one of the following types of data:
- ARP data;
- DNS data;
- host name data;
- or
- web resource data;
- identifying an actual storage location, of the computer system, in which the first data is stored;
- comparing the expected storage location for the first data to the actual storage location for the first data;
- based on the comparing, determining that the actual storage location for the first data does not match the expected storage location for the first data;
- and
- in response to the determining that the actual storage location does not match the expected storage location, generating a notification indicating a security risk.
Dependencies are inferred from the claim text.