Method and apparatus for identifying intrusions into a network data processing system
AssigneeInternational Business Machines Corporation
InventorsDolapo Martin Falola, Vinit Jain, Shannon Marie MacAlpine, Shawn Patrick Mullen, James Stanley Tesauro
Life of this patent
Estimating the term…
Abstract
A method, apparatus, and computer instructions for handling intrusions. A tracer packet is sent back to an intruder causing the intrusion in response to receiving notification of an intrusion from a particular node in a network data processing system. Nodes in the network data processing system are notified of the tracer packet. Identification of the node is stored for use in tracing a route of the tracer packet through the data processing system in response to receiving a message from a node indicating receipt of the tracer packet.
Claims21
A method in a data processing system for handling intrusions, the method comprising:
- responsive to receiving notification of an intrusion from a particular node in a network data processing system, sending a tracer packet back to an intruder causing the intrusion;
- notifying nodes in the network data processing system of the tracer packet;
- and
- responsive to receiving a message from a node indicating receipt of the tracer packet, storing identification of the node for use in tracing a route of the tracer packet through the data processing system.
A method in a data processing system for handling an intrusion, wherein the data processing system is located within a network data processing system, the method comprising:
- detecting an intrusion by a attacking node, wherein a connection is established with the attacking node;
- responsive to detecting the intrusion, sending a notification of the intrusion to a security node in the network data processing system;
- ceasing communication with the attacking node;
- and
- maintaining the connection with the attacking node.
A network data processing system comprising:
- a network;
- a security node connected to the network;
- and
- a plurality of nodes connected to the network, wherein a victim node within the plurality of nodes sends an intrusion alert to the security node in response to detecting an attack in which the intrusion alert includes information about the intrusion, the security node sends a tracer packet onto the network and notifies the plurality of nodes of the tracer pack when an intrusion alert is received, each of the plurality of nodes looks for the tracer packet and sends a message to the security node when the tracer packet in which the message indicates reception of the tracer node, and the security node stores information about nodes within the plurality of nodes receiving the tracer packet for use in identifying a route of the tracer packet in the network data processing system.
A data processing system for handling intrusions, the data processing system comprising:
- a bus system;
- a communications unit connected to the bus system;
- a memory connected to the bus system, wherein the memory includes a set of instructions;
- and
- a processing unit connected to the bus system, wherein the processing unit executes the set of instructions to send a tracer packet back to an intruder causing the intrusion in response to receiving notification of an intrusion from a particular node in a network data processing system;
- notify nodes in the network data processing system of the tracer packet;
- and store identification of the node for use in tracing a route of the tracer packet through the data processing system in response to receiving a message from a node indicating receipt of the tracer packet.
A data processing system for handling an intrusion, the data processing system comprising:
- a bus system;
- a communications unit connected to the bus system;
- a memory connected to the bus system, wherein the memory includes a set of instructions;
- and
- a processing unit connected to the bus system, wherein the processing unit executes the set of instructions to detect an intrusion by a attacking node in which a connection is established with the attacking node;
- send a notification of the intrusion to a security node in the network data processing system in response to detecting the intrusion;
- cease communication with the attacking node;
- and maintain the connection with the attacking node.
A data processing system for handling intrusions, the data processing system comprising:
- sending means, responsive to receiving notification of an intrusion from a particular node in a network data processing system, for sending a tracer packet back to an intruder causing the intrusion;
- notifying means for notifying nodes in the network data processing system of the tracer packet;
- and
- storing means, responsive to receiving a message from a node indicating receipt of the tracer packet, for storing identification of the node for use in tracing a route of the tracer packet through the data processing system.
A data processing system for handling an intrusion, wherein the data processing system is located within a network data processing system, the data processing system comprising:
- detecting means for detecting an intrusion by a attacking node, wherein a connection is established with the attacking node;
- sending means, responsive to detecting the intrusion, for sending a notification of the intrusion to a security node in the network data processing system;
- ceasing means for ceasing communication with the attacking node;
- and
- maintaining means for maintaining the connection with the attacking node.
A computer program product in a computer readable medium for handling intrusions, the computer program product comprising:
- first instructions, responsive to receiving notification of an intrusion from a particular node in a network data processing system, for sending a tracer packet back to an intruder causing the intrusion;
- second instructions for notifying nodes in the network data processing system of the tracer packet;
- and
- third instructions, responsive to receiving a message from a node indicating receipt of the tracer packet, for storing identification of the node for use in tracing a route of the tracer packet through the data processing system.
A computer program product in a computer readable medium for handling an intrusion in a data processing system located within a network data processing system, the computer program product comprising:
- first instructions for detecting an intrusion by a attacking node, wherein a connection is established with the attacking node;
- second instructions, responsive to detecting the intrusion, for sending a notification of the intrusion to a security node in the network data processing system;
- third instructions for ceasing communication with the attacking node;
- and
- fourth instructions for maintaining the connection with the attacking node.
Dependencies are inferred from the claim text.