US 2014/0157366 A1 · NETWORK ACCESS CONTROL SYSTEM AND METHOD

Abstract

The present invention relates to a system and method for controlling a network access of a network packet on the basis of a thread which is inserted into a process through code injection. The network access control system according to the present invention comprises: a process inspecting unit for detecting a code injection-based thread included in a process; and a network monitoring unit for performing network filtering so as to detect a network packet having access to a network, and, if a communication subject of the detected network packet is the code injection-based thread, blocking the traffic of the detected network packet.

Claims26

Dependent claims

A network access control system, comprising:

a process inspection unit configured to detect a code injection-based thread included in a process;
and
a network monitoring unit configured to detect a network packet accessing a network by performing network filtering, and to, if an agent of communication of the detected network packet is a code injection-based thread, block traffic of the detected network packet.

A network access control method, comprising:

step 1 of collecting, by a network access control system, information about one or more processes being executed on a computer;
step 2 of detecting, by the network access control system, a code-injected virtual address space area included in the collected processes;
step 3 of detecting, by the network access control system, whether a code injection-based thread is present in the code-injected virtual address space area;
step 4 of collecting, by the network access control system, traffic of at least one network packet by performing network filtering;
and
step 5 of selectively allowing and blocking, by the network access control system, the traffic of the network packet based on the code injection-based thread information.

3 more elements

Dependencies are inferred from the claim text.

Facts

Application

14/127,199Filed 26 Apr 2012

Priority

KR 10-2011-006116223 Jun 2011

Published

5 Jun 2014

Term ends

Not estimatedThe source records don’t support an estimate.

Classification5 codes

H04L 63/1441
For detecting or protecting against malicious traffic: countermeasures against malicious traffic
G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action
H04L 63/0227
For separating internal from external traffic, e.g. firewalls: filtering policies
H04L
Digital communication

Network access control system and method

Life of this patent

Network access control system and method

Life of this patent

Abstract

Claims26