Intrusion detection in networks
AssigneeFinisar Corporation
InventorGayle Noble
Life of this patent
Estimating the term…
Abstract
Detecting network intrusions and tracking the network intruder. An attempt to access data without authorization is detected. The response to the unauthorized access is altered on the fly to include data that has been prepared for intruders. If the altered data is stored on an intermediary computer, the altered data may also include a script that notifies the network when the intruder accesses the altered data on the intermediary computer. Alternatively, the intruder can be tracked when the intruder attempts to access the data prepared for the intruder. In both cases the intruder can then be tracked to a more reliable IP address associated with the intruder.
Claims23
A method for tracking an intruder that attempts to access a network without authorization, the method comprising:
- detecting an intrusion by an intruder, wherein the intrusion includes a request for access to requested data;
- altering the requested data to create altered data;
- and
- sending the altered data to be accessed by the intruder.
A network analysis apparatus for detecting intrusion within a network, the network analysis apparatus comprising:
- a data processing device coupled to the network and configured to receive data transmitted in the network, wherein the data processing device includes a computer readable medium having computer-executable instructions for:
- receiving data transmitted in the network;
- detecting an unauthorized request for data by an intruder;
- creating altered data in response to the request;
- and
- sending the altered data to be accessed by the intruder.
A method for tracking an intruder who attempts to obtain unauthorized access to data in a network, comprising:
- at an intermediary computer coupled to a network, performing the following acts:
- receiving a request from a unauthorized intruder for data stored in the network;
- transmitting the request for the data stored in the network to the network;
- receiving altered data from the network, the altered data not representing the requested data;
- receiving a script along with the altered data;
- executing the script;
- and
- tracking the unauthorized intruder when the unauthorized intruder attempts to access the altered data.
Dependencies are inferred from the claim text.