Systems and methods of preventing infection or data leakage from contact with a malicious host system
AssigneeSnoopwall LLC
InventorsGary S. Miliefsky, Ken Lichtenberger
Life of this patent
Estimating the term…
Abstract
Methods and systems are described for the detection of malicious host systems in real time using techniques that are computationally efficient, and that minimize delays or interruptions to the flow of network transmissions. The methods and systems include using a Bloom filter to efficiently determine that a host name requested by a user device is not on a list of known malicious hosts. However, because the Bloom filter may also ambiguously determine that the requested host name may be on the list of host names for which communication is prohibited, an SQL table storing the list of prohibited host names is referenced to resolve any ambiguous determinations of the Bloom filter.
Claims20
A method comprising:
- monitoring a plurality of transmissions within an internal network;
- identifying, within a transmission of the plurality of transmissions, a request from a device to communicate with a third party host, the request including an identifier of the third party host;
- generating a hash value based on the identifier;
- determining whether the hash value is stored within a Bloom filter generated from hash values of identifiers of malicious hosts;
- responsive to determining that the hash value is stored within the Bloom filter, determining whether the identifier is stored within a list of the identifiers of the malicious hosts;
- and
- responsive to determining that the identifier is stored within the list, disrupting subsequent transmissions between the device and the third party host.
A network monitor system comprising:
- memory;
- a network interface;
- and
- at least one processor coupled to the memory and the network interface and configured to:
- monitor a plurality of transmissions within an internal network via the network interface;
- identify, within a transmission of the plurality of transmissions, a request from a device to communicate with a third party host, the request including an identifier of the third party host;
- generate a hash value based on the identifier;
- determine whether the hash value is stored within a Bloom filter generated from hash values of identifiers of malicious hosts;
- responsive to the determination that the hash value is stored within the Bloom filter, determine whether the identifier is stored within a list of the identifiers of the malicious hosts;
- and
- responsive to the determination that the identifier is stored within the list, disrupt subsequent transmissions between the device and the third party host;
- and
- a pre-cognition detection engine in communication with the at least one processor, the pre-cognition detection engine comprising a Bloom Filter and an SQL table,
- wherein at least one of the Bloom Filter and the SQL table is used to determine whether a requested third party host name is associated with a known malicious host.
Dependencies are inferred from the claim text.