# US 11,310,190 B2 · Network anti-tampering system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,190 B2 - Document ID: US11310190B2 - Status: Granted - Kind: B2 - Application number: 16/212,270 - Filed: 2018-12-06 - Published: 2019-10-10 - Granted: 2022-04-19 - Earliest claimed: 2017-12-07 - Assignees: Ridgeback Network Defense, Inc. - Applicants: Ridgeback Network Defense, Inc. - Inventors: Thomas Sheppard Phillips - Web page: https://patentgrep.com/patent/US11310190B2 ## CPC - H04L 61/103: across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP] - G06F 21/55: Detecting local intrusion or implementing counter-measures - H04L 9/00: {Cryptographic mechanisms or cryptographic} arrangements for secret or secure communications; Network security protocols - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/101: {Access control lists [ACL]} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 2101/622: Layer-2 addresses, e.g. medium access control [MAC] addresses - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method detects or prevents tampering of computer networks by transmitting address messages indicating that unused network addresses are in use. The systems and method handles requests for network resources, such as Address Resolution Protocol (ARP) messages, and provides fabricated information to a potential attacker to disrupt an attack on an information system. ## Claims ### Claim 1 A system to detect and prevent network tampering comprising: an anti-tampering system, a network interface connecting the anti-tampering system to a network, and a software program running on the anti-tampering system, the software program containing instructions that, when executed by the anti-tampering system, cause the anti-tampering system to: monitor communications on the network during normal network communication; receive a plurality of Address Resolution Protocol (ARP) request messages from an information processing system connected to the network; determine whether each of the plurality of ARP request messages are for an Internet Protocol (IP) address that is in use on the network: identify ARP request messages directed to an IP address not in use on the network; for ARP request messages directed to an IP address that is in use on the network, determine whether the information processing system sending the ARP request messages is authorized to access the IP address; and transmit a plurality of ARP reply messages to the information processing system in response to ARP request messages identified as being directed to an IP address not in use on the system or to an IP address the information processing system is not authorized to access, wherein each reply messages comprises the IP address in the ARP request message being replied to and a Media Access Control (MAC) address that does not correspond to a network device using the IP address. ### Claim 2 (depends on 1) The system of claim 1, wherein the information processing system is a general purpose computer. ### Claim 3 (depends on 1) The system of claim 1, wherein the information processing system is a custom programmed FPGA. ### Claim 4 (depends on 1) The system of claim 1, wherein the information processing system is a custom programmed ASIC. ### Claim 5 (depends on 1) The system of claim 1, wherein the information processing system is a virtual machine running under the control of a hypervisor. ### Claim 6 (depends on 1) The system of claim 1, wherein the information processing system is a virtual machine running under the control of a hypervisor and the software program is a network device driver. ### Claim 7 (depends on 1) The system of claim 1, wherein the information processing system is a general purpose computer and the software program is a network device driver. ### Claim 8 (depends on 1) The system of claim 1, wherein the MAC address is the MAC address of the anti-tampering system, a MAC address of a device on the network that is configured to receive unauthorized requests, or a MAC address that does not correspond to any physical device on the network. ### Claim 9 (depends on 1) The system of claim 1, wherein the software program executed by the anti-tampering system is further configured to, in response to determining that the information processing system ARP request messages are directed to an IP address not in use on the network or an IP address the information processing system is not authorized to access: removing the information processing system from the network; disabling the information processing system's ability to communicate with selected other information processing systems on the network; or sending a communication including the IP or MAC address of the information processing system to one or more third parties. ### Claim 10 (depends on 1) The system of claim 1, wherein the software program executed by the anti-tampering system is further configured to flag the IP address of, MAC address of, or network activity of the information processing system as compromised. ### Claim 11 A method to detect and prevent network tampering over a network connected to an anti-tampering system through a network interface comprising: monitoring, with the anti-tampering system, communications on the network during normal network communication; receiving, with the anti-tampering system, an Address Resolution Protocol (ARP) request message from an information processing system connected to the network; determine whether the ARP request message is for an Internet Protocol (IP) address that is in use on the network or that is not in use on the network, and, if the message is directed to an IP address that is in use on the network, further determining whether the information processing system is authorized to access the IP address; transmitting, with the anti-tampering system, an ARP reply message to the information processing system in response to determining that the ARP request message is directed to an IP address not in use on the system or to an IP address the information processing system is not authorized to access, wherein the reply comprises the IP address in the ARP message request being replied to and a Media Access Control (MAC) address that does not correspond to a network device using the IP address. ### Claim 12 (depends on 11) The method of claim 11, wherein the information processing system is a general purpose computer. ### Claim 13 (depends on 11) The method of claim 11, wherein the information processing system is a general purpose computer and the software program is a network device driver. ### Claim 14 (depends on 11) The method of claim 11, wherein the MAC address is the MAC address of the anti-tampering system, a MAC address of a device on the network that is configured to receive unauthorized requests, or a MAC address that does not correspond to any physical device on the network. ### Claim 15 (depends on 11) The method of claim 11, further comprising, in response to determining that the information processing system ARP request message is directed to an IP address not in use on the network or an IP address the information processing system is not authorized to access: removing the information processing system from the network; disabling the information processing system's ability to communicate with selected other information processing systems on the network; or sending a communication including the IP or MAC address of the information processing system to one or more third parties. ### Claim 16 (depends on 11) The method of claim 11, wherein the method further comprises flagging, with the anti-tampering system, the IP address of, MAC address of, or network activity of the information processing system as compromised.