System and method for monitoring network traffic
AssigneeAT&T Intellectual Property II, L.P.
InventorsEdward Amoroso, Albert Greenberg, Balachander Krishnamurthy
Life of this patent
Estimating the term…
Abstract
Described is a method of assigning a network address to a trap, the network address being a dark address of a virtual private network. The network traffic destined for the network address is monitored and a classification of the network traffic is determined. After the classification, a predetermined response is executed based on the classification of the traffic.
Claims21
1-20. (canceled)
A network server, comprising:
- a processor;
- and
- a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising:
- monitoring network traffic received within a target virtual private network comprising a plurality of network addresses including an unassigned network address;
- determining a classification of traffic directed to the unassigned network address based on a traffic level of the traffic directed to the unassigned network address;
- gathering data regarding the traffic directed to the unassigned network address including information on exploitation of vulnerabilities of the target virtual private network;
- and
- determining whether to close a connection used by the traffic to access the virtual private network according to the classification of the traffic directed to the unassigned network address.
A method, comprising:
- monitoring, by a network server, network traffic received within a target virtual private network comprising a plurality of network addresses including a dark network address assigned as a trap;
- determining, by the network server, that the traffic directed to the dark network address is unauthorized network traffic based on a traffic level of the traffic directed to the dark network address;
- and
- determining, by the network server, whether to close a connection used by the traffic to access the virtual private network according to the traffic being determined to be unauthorized.
A machine-readable storage medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising:
- monitoring, by a network server, network traffic received within a target virtual private network comprising a plurality of network addresses including an unassigned network address;
- determining, by the network server, a classification of the traffic directed to the unassigned network address, based on a traffic level of the traffic directed to the unassigned network address;
- and
- determining, by the network server, whether to close a connection used by the traffic to access the virtual private network according to the classification of the traffic that is determined.
Dependencies are inferred from the claim text.