Method and Apparatus for Network Intrusion Detection
AssigneeHewlett-Packard Development Company, L.P.
InventorRichard H. Porter
Life of this patent
Estimating the term…
Abstract
The current invention discloses a method and apparatus to detect and mitigate network intrusion by collecting a first log of wireless network traffic in the vicinity of an area and a second log of network traffic from a switch port connected to the area; pre-processing the logs; and then detecting the presence of unauthorized access points (APs) by attempting to identify matching patterns in the pre-processed first and second logs.
Claims15
A method to detect network intrusion comprising:
- collecting a first log of wireless network traffic in the vicinity of an area suspected to have one or more unauthorized access points (APs) and a second log of network traffic from a switch port connected to the area, the first and second logs comprise at least one captured packet representing network traffic;
- pre-processing the first and second logs to process at least one captured packet;
- analyzing the pre-processed first log and the pre-processed second log to identify matching patterns wherein sub-sequences of packets in the pre-processed first log are being matched to sub-sequences of packets in the pre-processed second log;
- and
- generating a response based on a set of rules if matching patterns are identified.
A computer-readable medium comprising software, which when executed by a computer system, causes the computer system to perform operations to detect network intrusion, the computer-readable medium comprising:
- one or more instructions to pre-process a first log of wireless network traffic in the vicinity of an area suspected to have one or more unauthorized access points and a second log of network traffic from a switch port connected to the area, the first and second logs comprise at least one captured packet representing network traffic;
- and
- one or more instructions to analyze the pre-processed first log and the pre-processed second log to identify matching patterns wherein sub-sequences of packets in the pre-processed first log are being matched to sub-sequences of packets in the pre-processed second log.
An apparatus to detect network intrusion, comprising:
- a data collector configured to collect a first log of wireless network traffic in the vicinity of an area suspected to have one or more unauthorized access points;
- and
- a computer system further comprising:
- means for receiving the first log of wireless network traffic;
- means for receiving a second log of network traffic from a switch port connected to the area suspected to have one or more unauthorized access points;
- means for pre-processing the first and second logs to process at least one captured packet representing network traffic;
- and
- means for analyzing the pre-processed first log and pre-processed second logs and identifying matching patterns wherein sub-sequences of packets in the pre-processed first log are being matched to sub-sequences of packets in the pre-processed second log.
Dependencies are inferred from the claim text.