Network intrusion prevention
AssigneeRaytheon Company
InventorsRandall Brooks, Matthew Rixon, Jonathan Goding
Life of this patent
Estimating the term…
Abstract
According to one embodiment of the invention, a system for preventing a network attack is provided. The system includes a computer having a processor and a computer-readable medium. The system also includes a shield program stored in the computer-readable medium. The shield program is operable, when executed by the processor, to transmit an agent to each of one or more nodes in a network in response to an attack directed to the network. The agent is operable to initiate a reduction of the effect of the attack on the node.
Claims38
A method for preventing a network attack, comprising:
- determining, at a management system, that an attack directed to one or more nodes of a network is occurring;
- in response to the determination, transmitting an agent from the management system to each of the nodes;
- in response to receiving the agent at each of the nodes, executing a program at each of the nodes, the program, when executed, operable to reduce the effect of the attack on the node.
A system for preventing a network attack, comprising:
- an intrusion detection device operable to detect an attack directed to a network and transmit a message indicating the detection of the attack;
- a management system coupled to the intrusion detection device, the management system operable to receive the message and transmit one or more agents in response to receiving the message;
- and
- an end host node coupled to the management system, the end host node operable to receive the agent and execute a program in response to receiving the agent, the program operable to reduce the effect of the attack on the end host node.
A system for preventing a network attack, comprising:
- a computer having a processor and a computer-readable medium;
- and
- a shield program stored in the computer-readable medium, the shield program operable, when executed by the processor, to transmit an agent to each of one or more nodes in a network in response to an attack directed to the network, the agent operable to initiate a reduction of the effect of the attack on the node.
A system for preventing a network attack, comprising:
- a plurality of intrusion detection devices logically positioned approximately at a boundary of a network, each intrusion detection device operable to detect an attack directed to the network and transmit a message describing the attack;
- a management system coupled to the intrusion detection devices, the management system operable to receive the message, determine an identity of a source of the attack, and transmit one or more autonomous agents;
- and
- a plurality of end host nodes coupled to the management system, each end host node operable to receive a particular autonomous agent and execute a program in response to receiving the autonomous agent, the program operable to halt the receipt of network traffic from the source of the attack and launch an attack against the source of the attack by transmitting a signal to the source of the attack.
A system for preventing a network attack, comprising:
- a plurality of management systems forming a network, each management system having a processor and a computer-readable medium, each management system operable to:
- detect an attack directed to the network;
- identify a first attacker that initiated the attack;
- generate a first autonomous agent identifying the first attacker;
- and
- transmit the first autonomous agent to one or more other management systems in the network;
- an intrusion shield program stored in the computer-readable medium, the advanced intrusion shield program operable, when executed by the processor, to:
- receive, from another management system, a second autonomous agent identifying a second attacker;
- transmit the second autonomous agent to a plurality of other management systems in the network but not to the another management system from which the second autonomous agent is received;
- and
- initiate an execution of a prevention program by the processor in response to receiving the second autonomous agent, the prevention program stored in the computer-readable medium and operable, when executed, to:
- halt the receipt of network traffic from the second attacker;
- and
- launch a counterattack against the identified second attacker by transmitting at least one signal to the second attacker.
Dependencies are inferred from the claim text.