US 7,610,624 B1Granted

System and method for detecting and preventing attacks to a target computer system

AssigneeNovell, Inc.

InventorsJason Whitman Keith Brothers, Peter Dennis Bartok

Life of this patent

Estimating the term…

Loading patent…

Abstract

A system and method are provided for monitoring data packets received at a target system. The data packets may be monitored at any layer of the communication protocol to characterize the type of network traffic being sent from a source machine. Upon detection of suspected and/or confirmed attacks on the target system, the monitoring server may block and/or contain data packets associated with the attacking source to prevent continued attacks on the target system. The monitoring server may monitor data packets transparently in approximately in real-time so that users of the system do not experience messaging delays.

Claims44

Dependent claims

A system for protecting a computer network, the system comprising at least one computer device, the at least one computer device having one or more modules, including:

a detection module configured to:
monitor one or more packets received from a source device to determine whether one or more of the received packets include one or more harmful computer code signatures, and to further monitor the received packets to determine whether one or more of the received packets include identifying information that has a history of being included in packets associated with one or more previous attacks directed at a target device coupled to the network;
and
detect an attack directed at the target device if one or more of the monitored packets include one or more of the harmful computer code signatures, and to further detect the attack if one or more of the monitored packets include the identifying information that has the history of being included in packets associated with the previous attacks directed at the target device;
a scanning module configured to determine a severity of the detected attack directed at the target device;
a log creating module configured to create an attack profile based on information associated with the detected attack, wherein the attack profile provides identifying information included in the monitored packets that include the harmful computer code signatures, and wherein the attack profile further provides the identifying information that has the history of being included in packets associated with the previous attacks directed at the target device;
and
a blocking module configured to:
block one or more of the monitored packets from being transmitted to the target device, wherein the blocked packets include the identifying information provided in the attack profile, and wherein the blocking module is further configured to disable a communication channel connecting the source device to the target device to block the packets from being transmitted to the target device;
block one or more subsequently received packets from being transmitted to the target device if the severity of the detected attack exceeds a predetermined threshold, wherein the subsequently blocked packets include packets originating form the source device and packets directed to the target device;
notify a user if the source device originates internally to a defined perimeter of the target device, wherein the user is notified that the communication channel has been disabled and that the attack originated internally to the defined perimeter of the target device;
and
enable the communication channel for at least one system that runs a valid application over the communication channel if the source device originates externally to the defined perimeter of the target device.

10 more elements

A computer device for detecting and preventing attacks directed at a target system, the computer device having one or more modules that cause the computer device to:

receive one or more packets originating from a source system, wherein the received packets are directed to the target system;
monitor the received packets to determine whether one or more of the received packets include one or more harmful computer code signatures, and further monitor the received packets to determine whether one or more of the received packets include identifying information that has a history of being included in packets associated with one or more previous attacks directed at the target system;
detect an attack directed at the target system if one or more of the monitored packets include one or more of the harmful computer code signatures, and further detect the attack if one or more of the monitored packets include the identifying information that has the history of being included in packets associated with the previous attacks directed at the target system;
create an attack profile based on information associated with the detected attack, wherein the attack profile provides identifying information included in the monitored packets that include the harmful computer code signatures, and wherein the attack profile further provides the identifying information that has the history of being included in packets associated with the previous attacks directed at the target system;
block one or more of the monitored packets from being transmitted to the target system, wherein the blocked packets include the identifying information provided in the attack profile, and further to disable a communication channel connecting the source system to the target system to block the packets from being transmitted to the target system;
block one or more subsequently received packets from being transmitted to the target system if a severity of the detected attack exceeds a predetermined threshold, wherein the subsequently blocked packets include packets originating from the source system and packets directed to the target system;
notifying a user if the source system originates internally to a defined perimeter of the target system, wherein the user is notified that the communication channel has been disabled and that the attack originated internally to the defined perimeter of the target system;
and
enable the communication channel for at least one system that runs a valid application over the communication channel if the source system originates externally to the defined perimeter of the target system.

6 more elements

A computer system configured for detecting and preventing attacks directed at terminal devices, comprising:

at least one terminal device;
at least one server coupled to a computer network and to the at least one terminal device, wherein the at least one server is configured to monitor packets directed to the at least one terminal device, the at least one server having one or more modules, including:
a detection module configured to:
monitor one or more packets received from a source device to determine whether one or more of the received packets include one or more harmful computer code signatures, and to further monitor the received packets to determine whether one or more of the received packets include identifying information that has a history of being included in packets associated with one or more previous attacks directed at the at least one terminal device;
and
detect an attack directed at the at least one terminal device if one or more of the monitored packets include one or more of the harmful computer code signatures, and to further detect the attack if one or more of the monitored packets include the identifying information that has the history of being included in packets associated with the previous attacks directed at the at least one terminal device;
a log creating module configured to create an attack profile based on information associated with the detected attack, wherein the attack profile provides identifying information included in one or more of the monitored packets that include the harmful computer code signatures, and wherein the attack profile further provides the identifying information that has the history of being included in packets associated with the previous attacks directed at the at least one terminal device;
a scanning module configured to determine a severity of the detected attack directed at the at least one terminal device;
and
a blocking module configured to:
block one or more of the monitored packets from being transmitted to the at least one terminal device, wherein the blocked packets include the identifying information provided in the attack profile, and wherein the blocking module is further configured to disable a communication channel connecting the source device to the at least one terminal device to block the packets from being transmitted to the at least one terminal device;
block one or more subsequently received packets from being transmitted to the at least one terminal device if the severity of the detected attack exceeds a predetermined threshold, wherein the subsequently blocked packets include packets originating from the source device and packets directed to the at least one terminal device;
notify a user if the source device originates internally to a defined perimeter of the at least one terminal device, wherein the user is notified that the communication channel has been disabled and that the attack originated internally to the defined perimeter of the at least one terminal device;
and
enable the communication channel for at least one system that runs a valid application over the communication channel if the source device originates externally to the defined perimeter of the at least one terminal device.

12 more elements

A method for detecting and preventing attacks directed at a target system, comprising:

receiving one or more packets originating from a source system, wherein the received packets are directed to the target system;
monitoring the received packets to determine whether one or more of the received packets include one or more harmful computer code signatures, and further monitoring the received packets to determine whether one or more of the received packets include identifying information that has a history of being included in packets associated with one or more previous attacks directed at the target system;
detecting an attack directed at the target system if one or more of the monitored packets include one or more of the harmful computer code signatures, and further detecting the attack if one or more of the monitored packets include the identifying information that has the history of being included in packets associated with the previous attacks directed at the target system;
creating an attack profile based on information associated with the detected attack, wherein the attack profile provides identifying information included in the monitored packets that include the harmful computer code signatures, and wherein the attack profile further provides the identifying information that has the history of being included in packets associated with the previous attacks directed at the target system;
blocking one or more of the monitored packets from being transmitted to the target system, wherein the blocked packets include the identifying information provided in the attack profile, and wherein blocking the packets from being transmitted to the target system includes disabling a communication channel connecting the source system to the target system;
blocking one or more subsequently received packets from being transmitted to the target system if a severity of the detected attack exceeds a predetermined threshold, wherein the subsequently blocked packets include packets originating from the source system and packets directed to the target system;
notifying a user if the source system originates internally to a defined perimeter of the target system, wherein the user is notified that the communication channel has been disabled and that the attack originated internally to the defined perimeter of the target system;
and
enabling the communication channel for at least one system that runs a valid application over the communication channel if the source system originates externally to the defined perimeter of the target system.

6 more elements

Dependencies are inferred from the claim text.