Back to results
US 11,451,584 B2Granted
Detecting a remote exploitation attack
AssigneeWithsecure Corporation
InventorMikko Suominen
Life of this patent
Estimating the term…
Abstract
A method of protecting a computer system against remote exploitation attacks performed over a network to which the computer system is connected. The method includes: a) identifying a network connection that is not associated with a successful authentication and which carries a traffic level in excess of a predefined threshold; b) reporting the identified network connection as a real or potential remote exploitation attack; and c) taking an action or actions to mitigate against the real or potential remote exploitation attack.
Claims15
A method, comprising:
- protecting a computer system against remote exploitation attacks performed over a network to which the computer system is connected, comprising:
- a) identifying a network connection which carries a traffic level in excess of a predefined threshold depending on a network transport protocol associated with the network connection that is not associated with a preceding authentication allowed for the network connection originating from an end point of the network, wherein the identifying is based at least on a time the network connection was commenced or terminated not matching an authentication data timestamp identifying the network connection;
- b) in response to determining that the network connection is associated with a previous successful authentication with the authentication data timestamp or did not carry an amount of traffic greater than the predefined threshold, reporting the identified network connection as a non-malicious connection;
- c) in response to determining that the network connection is not associated with a previous successful authentication with the authentication data timestamp or resulted an error code and carries the traffic level in excess of the predefined threshold, reporting the identified network connection as a real or potential remote exploitation attack;
- and
- d) taking at least one action comprising at least one of terminating or modifying the identified network connection to mitigate against the real or potential remote exploitation attack.
3 more elements
A computer program embodied on a non-transitory memory, the computer program executed by at least one processor to perform operations, comprising:
- protecting a computer system against remote exploitation attacks performed over a network to which the computer system is connected, comprising:
- a) identifying a network connection which carries a traffic level in excess of a predefined threshold depending on a network transport protocol associated with the network connection that is not associated with a preceding authentication allowed for the network connection originating from an end point of the network, wherein the identifying is based at least on a time the network connection was commenced or terminated not matching an authentication data timestamp identifying the network connection;
- b) in response to determining that the network connection is associated with a previous successful authentication with the authentication data timestamp or did not carry an amount of traffic greater than the predefined threshold, reporting the identified network connection as a non-malicious connection;
- c) in response to determining that the network connection is not associated with a previous successful authentication with the authentication data timestamp or resulted an error code and carries the traffic level in excess of the predefined threshold, reporting the identified network connection as a real or potential remote exploitation attack;
- and
- d) taking at least one action comprising at least one of terminating or modifying the identified network connection to mitigate against the real or potential remote exploitation attack.
3 more elements
An apparatus, comprising:
- at least one processor;
- at least one memory including program code, wherein the at least one memory including the program code is configured with the at least one processor to cause the apparatus to:
- protect a computer system against remote exploitation attacks performed over a network to which the computer system is connected, comprising:
- a) identifying a network connection which carries a traffic level in excess of a predefined threshold depending on a network transport protocol associated with the network connection that is not associated with a preceding authentication allowed for the network connection originating from an end point of the network, wherein the identifying is based at least on a time the network connection was commenced or terminated not matching an authentication data timestamp identifying the network connection;
- b) in response to determining that the network connection is associated with a previous successful authentication with the authentication data timestamp or did not carry an amount of traffic greater than the predefined threshold, reporting the identified network connection as a non-malicious connection;
- c) in response to determining that the network connection is not associated with a previous successful authentication with the authentication data timestamp or resulted an error code and carries the traffic level in excess of the predefined threshold, reporting the identified network connection as a real or potential remote exploitation attack;
- and
- d) taking at least one action comprising at least one of terminating or modifying the identified network connection to mitigate against the real or potential remote exploitation attack.
5 more elements
Dependencies are inferred from the claim text.