# US 2010/0169975 A1 · Systems, methods, and devices for detecting security vulnerabilities in ip networks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2010/0169975 A1
- Document ID: US20100169975A1
- Status: Published application
- Kind: A1
- Application number: 12/581,534
- Filed: 2009-10-19
- Published: 2010-07-01
- Earliest claimed: 2008-11-17
- Assignees: DNSStuff, INC.
- Inventors: Charles K. Stefanidakis; Richard Person; Anish Dhanda; Gregory Sabatino; John J. Donovan
- Web page: https://patentgrep.com/patent/US20100169975A1

## CPC

- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1458: {Denial of Service}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

This invention is a system, method, and apparatus for detecting compromise of IP devices that make up an IP-based network. One embodiment is a method for detecting and alerting on the following conditions: (1) Denial of Service Attack; (2) Unauthorized Usage Attack (for an IP camera, unauthorized person seeing a camera image); and (3) Spoofing Attack (for an IP camera, unauthorized person seeing substitute images). A survey of services running on the IP device, historical benchmark data, and traceroute information may be used to detect a possible Denial of Service Attack. A detailed log analysis and a passive DNS compromise system may be used to detect a possible unauthorized usage. Finally, a fingerprint (a hash of device configuration data) may be used as a private key to detect a possible spoofing attack. The present invention may be used to help mitigate intrusions and vulnerabilities in IP networks.

## Claims

### Claim 1

A vulnerability detection and alerting system for detecting compromise of one or more IP devices on an IP network, the system comprising:
a detector adapted to detect one or more primitive vulnerability events in the IP devices; and
an attribute engine adapted to generate attribute data representing information about the importance of the IP devices.

### Claim 2

A method of detecting and alerting on possible IP network compromise, comprising the steps of:
detecting at least one potential denial of service attack as a first set of vulnerability events;
detecting at least one potential unauthorized usage attempt as a second set of vulnerability events;
detecting at least one potential spoofing attack as a third set of vulnerability events;
analyzing the first set of vulnerability event, the second set of vulnerability event, and the third set of vulnerability events; and
sending one or more alerts based on the analysis performed in the analyzing step.

### Claim 3 (depends on 2)

The method of claim 2, wherein the denial of service attack is detected by a service survey.

### Claim 4 (depends on 2)

The method of claim 2, wherein the denial of service attack is detected by a historical benchmark analysis.

### Claim 5 (depends on 2)

The method of claim 2, wherein the denial of service attack is detected by a tracer route.

### Claim 6 (depends on 2)

The method of claim 2, wherein the unauthorized usage is detected by a passive DNS query.

### Claim 7

A system for detecting and alerting on possible compromise of an IP network having one or more IP devices, the system comprising:
a vulnerability detection engine for detecting one or more vulnerabilities in the IP network;
a analysis engine adapted to analyze two or more vulnerabilities weighted by an importance of the IP device; and
an action engine adapted to perform one or more actions based on the correlation performed by the analysis engine.

### Claim 8 (depends on 7)

The system of claim 7, wherein the vulnerability detection engine comprises: means for detecting at least one potential denial of service attack.

### Claim 9 (depends on 7)

The system of claim 7, wherein the denial of service attack is detected by a service survey.

### Claim 10 (depends on 7)

The system of claim 7, wherein the denial of service attack is detected by a historical benchmark analysis.

### Claim 11 (depends on 7)

The system of claim 7, wherein the denial of service attack is detected by a tracer route.

### Claim 12 (depends on 7)

The system of claim 7, wherein the unauthorized usage is detected by a passive DNS query.