Network attack tainting and tracking
AssigneeInternational Business Machines Corporation
InventorsCheng-ta Lee, Ronald B. Williams
Life of this patent
Estimating the term…
Abstract
A technique for network attack tainting and tracking includes monitoring data packets received from a network for a malicious request. Responsive to detecting a malicious request, a forensic token is created having information pertaining to the malicious request that is configured to be stored by a source of the malicious request and discoverable regarding involvement of the source in the malicious request. The forensic token is injected into a response message, and the response message is then transmitted to the source of the request as a response to the request.
Claims20
A method, comprising:
- monitoring, by a network device, data packets destined for a target to detect a malicious request directed toward the target;
- and
- responsive to detecting a malicious request:
- creating by the network device a forensic token having information pertaining to the malicious request, the forensic token configured to be stored by a source of the malicious request and discoverable regarding involvement of the source in the malicious request;
- injecting the forensic token into a response message;
- and
- transmitting the response message to the source of the request as a response to the request.
A system, comprising:
- a processor and a memory;
- and
- an intrusion prevention system executable by the processor to:
- monitor data packets received from a network for a malicious request;
- and
- responsive to detecting a malicious request:
- create a forensic token having information pertaining to the malicious request, the forensic token configured to be stored by a source of the malicious request and discoverable regarding involvement of the source in the malicious request;
- inject the forensic token into a response message;
- and
- transmit the response message to a source of the request as a response to the request.
A computer program product for network attack tainting and tracking, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:
- monitor data packets received from a network by a network device for a malicious request, the data packets destined for a target;
- and
- responsive to detecting a malicious request:
- create by the network device a forensic token having information pertaining to the malicious request, the forensic token configured to be stored by a source of the malicious request and discoverable regarding involvement of the source in the malicious request;
- inject the forensic token into a response message;
- and
- transmit the response message to a source of the request as a response to the request.
Dependencies are inferred from the claim text.