US 11,388,188 B2 · Systems and methods for automated intrusion detection

Abstract

Implementations provide automated intrusion alert-based blacklisting with minimal false positives that ignores regular business operations, scalable to accommodate the volume of IDS alerts received by high-traffic internet-accessible networked systems. Implementations identify and block hostile infrastructure IP addresses during the reconnaissance phase based on IDS alert(s). Each IDS alert is automatically reviewed in historical context and triggers IP blocking as necessary. Some implementations maintain TCP/IP handshake records, preventing blocking an IP used to conduct regular business operations on the network that a malicious party has spoofed to avoid identification. Based on the historical context of each IP address within the local network environment, specifically regular business operations traffic versus malicious traffic, the IP address is blocked only if the majority of connections therefrom are malicious. This approach provides substantial cost-savings; frees up resources and personnel otherwise necessary for manual processes; and increases overall network security through automated network defense.

Claims20

Dependent claims

A device for automated intrusion alert-based blacklisting comprising:

a communication interface configured to receive a network threat report indicating a detected threat to a network;
and
a processor configured to:
determine an Internet Protocol (IP) address related to the detected threat to the network;
access a database of contextual information to determine historical contextual information for the IP address relating to communication with the network;
compare the historical contextual information to one or more blocking thresholds;
based at least on the comparing, determine that the device has previously established a TCP/IP connection with the IP address;
based at least on determining that the device has previously established a TCP/IP connection with the IP address, indicate the IP address is a valid IP address and is not spoofed;
and
output the valid IP address to an indicator management system if the historical contextual information for the IP address exceeds the one or more blocking thresholds;
whereby the indicator management system maintains a blocklist for a perimeter system of the network and adds the IP address to the blocklist.

8 more elements

A method for automated intrusion alert-based blacklisting comprising:

receiving, using a communication interface, a network threat report indicating a detected threat to a network;
determining, using a processor, an Internet Protocol (IP) address related to the detected threat to the network;
accessing a database of contextual information to determine historical contextual information for the IP address relating to communication with the network;
comparing the historical contextual information to one or more blocking thresholds;
based at least on the comparing, determine that the device has previously established a TCP/IP connection with the IP address;
based at least on determining that the device has previously established a TCP/IP connection with the IP address, indicating the IP address is a valid IP address and is not spoofed;
and
outputting the valid IP address to an indicator management system if the historical contextual information for the IP address exceeds the one or more blocking thresholds;
whereby the indicator management system maintains a blocklist for a perimeter system of the network and adds the IP address to the blocklist.

6 more elements

Dependencies are inferred from the claim text.

Systems and methods for automated intrusion detection

Life of this patent

Systems and methods for automated intrusion detection

Life of this patent

Abstract

Claims20