System and method for detecting an infective element in a network environment

#This invention relates in general to intrusion detection, and more particularly to a system and method for detecting an infective element in a network environment.

#Network and information security are two areas that have grown increasingly important in communication environments. The threat of external agents such as viruses, worms, Trojans and other damaging elements pose a serious risk to computer system architectures and end users alike. If not contained properly, these damaging elements may wreak havoc on network systems by disrupting communication flows, violating privacy, compromising the integrity of information within the system, or corrupting data residing on the network architecture.

#Several strategies have been employed to combat the negative effects of these harmful external agents; however, some of these strategies are limited in that they only address certain types of attacks, which must be generated from specific locations. In addition, many of these strategies suffer from providing only minimal protection at limited areas within the network system. Moreover, many of these strategies are slow in identifying and containing harmful elements that may have entered the network. Also, many of these strategies are generally ineffective because of their predictability in how their corresponding security tactics and protocols are implemented. The predictable nature of these approaches allows hackers to easily pinpoint areas of vulnerability within an associated system and attack those areas such that damaging elements can penetrate a network undetected by the existing security elements.

#Reference is made to the following description taken in conjunction with the accompanying drawings in which:

#FIG. 1 is a simplified block diagram of a communication system for detecting an infective element in a network environment in accordance with one embodiment of the present invention;

#FIG. 2A is a block diagram of an example implementation of a network management controller included within the communication system of FIG. 1 in accordance with one embodiment of the present invention;

#Example embodiments of the invention are best understood by referring to FIGS. 1 through 3 of the drawings in which like numerals refer to like parts.

#FIG. 1 is a block diagram of a communication system 10 for detecting an infective element 12 in a network environment in accordance with one embodiment of the present invention. Communication system 10 includes a network management controller 14, multiple computers 16a-16d, an infected computer 18, an external network 22, and an internal network 24. Additionally, communication system 10 includes an external website 28, a remediator website 30, an authentication server 34, and a policies node 38.

#In accordance with the teachings of the present invention, communication system 10 provides an architecture for identifying infective element 12 after it has been introduced into the architecture of communication system 10. Communication system 10 also provides the ability to pinpoint or otherwise recognize the location of infective element 12 as within infected computer 18. In implementing a communications protocol, computers 16a, 16b, and 16c offer a peer monitoring feature that detects damaging elements, such as infective element 12, as they enter communication system 10. Accordingly, a cooperative signaling approach is provided for computers 16a, 16b, and 16c, whereby infected computer 18 is targeted as a rogue, i.e., inclusive of some malicious file, corrupt data segment, or non-compliant operation, which may cause harm to components within communication system 10.