System and method for detecting transmission of a covert payload of data
AssigneeRankin Labs, LLC
InventorJohn Rankin
Life of this patent
Estimating the term…
Abstract
Systems and methods for detecting transmission of covert payloads of data are provided. A datagram is received at a host within a network. A determination is made that processing the datagram creates an error condition. A determination is made that that the datagram contains a payload intended for covert transmission where at least one suspicious condition is present. The suspicious conditions include an encrypted payload, a destination not matching any known address for hosts within the network, a time to live value matching the number of gateways traversed by the datagram within the network, and a particular type of error condition.
Claims14
A method for detecting transmission of covert payloads of data, said method comprising the steps of:
- receiving a datagram at a host within a network;
- determining that processing of the datagram creates an error condition;
- determining that the datagram comprises at least each of the following suspicious conditions:
- an encrypted payload;
- a destination not matching any known address for hosts within the network;
- a time to live value matching a number of gateways traversed by said datagram within said network;
- and
- the error condition being of a particular type;
- and
- subsequently, determining that the datagram contains a payload intended for covert transmission.
A system for detecting transmission of covert payloads of data comprising:
- a network comprising a number of hosts, wherein each of said hosts comprises an address;
- and
- software instructions, located at each of said hosts, which when executed configures each of the hosts to:
- receive a number of datagrams;
- process each of said datagrams in accordance with preprogrammed protocols;
- identify received datagrams creating an error condition when processed according to said preprogrammed protocols;
- determine if suspicious conditions exist in the identified datagrams, said suspicious conditions comprising:
- an encrypted payload, a destination address comprising a valid address not matching any of said addresses for said hosts, a time to live value matching a number of gateways traversed by said datagram within said network, and the error condition being of a particular type;
- subsequently, determine that the datagram contains a payload intended for covert transmission where at least one or more of said suspicious conditions are present;
- and
- generate an alert message regarding the payload intended for covert transmission.
A method for detecting transmission of covert payloads of data comprising the steps of:
- receiving datagrams at a host within an IP network comprising a number of blind hosts, each associated with an address and configured to generate error messages upon receipt of datagrams meeting certain error conditions in accordance with preprogrammed protocols;
- determining that processing of at least one of the datagram creates an error condition under said preprogrammed protocols;
- determining that the at least one datagram comprises each of the following suspicious conditions:
- an encrypted payload;
- a destination of a valid address not matching any of said addresses for said hosts within the network;
- a time to live value matching a number of gateways traversed within said network;
- the error condition is statistically uncommon relative to a sample pool of datagrams;
- and
- the error condition is at least one of:
- related to fragmentation, related to formation of the datagram, and unrelated to activity expected on the network;
- subsequently, determining that the at least one the datagram contains a payload intended for covert transmission;
- isolating the at least one datagram;
- generating an alert message regarding the at least one datagram;
- and
- eliminating the at least one datagram.
Dependencies are inferred from the claim text.