Back to results
US 7,814,546 B1Granted
Method and system for integrated computer networking attack attribution
AssigneesVerizon Corporate Services Group Inc., Raytheon BBN Technologies Corp.
InventorsWilliam Timothy Strayer, Christine Elaine Jones, Isidro Marcos Castineyra, Regina Rosales Hain
Life of this patent
Estimating the term…
Abstract
A system and method for determining the point of entry of a malicious packet into a network is disclosed. An intrusion detection system detects entry of the malicious packet into the network (500). A stepping stone detection system identifies stepping stones in extended connections within the network (524). A traceback engine isolates the malicious packet in response to operation of the intrusion detection system (528), wherein the traceback engine utilizes the identified stepping stones to determine the point of entry of the malicious packet.
Claims22
A system for determining the point of entry of a malicious packet into a network, comprising:
- an intrusion detection device configured to detect entry of the malicious packet into the network;
- a stepping stone detection device configured to detect stepping stones in extended connections within the network, identify correlated connection pairs according to the detected stepping stones, and produce a table of connection pairs based upon the identified correlated connection pairs;
- and
- a traceback engine responsive to operation of the intrusion detection device and configured to isolate the malicious packet, the traceback engine configured to:
- generate a query message containing identification information about the malicious packet;
- forward the query message to certain of a plurality of routers operatively connected to the traceback engine, the certain of the plurality of routers being configured to generate a representation of a plurality of packets as the packets are forwarded through the network and determine based on the representation whether the malicious packet has been transmitted through certain of the routers in response to the forwarded query message;
- and
- determine, using the established connection pair table, a previously received representative packet, the representative packet being from an incoming connection correlated with the connection including the malicious packet;
- and
- use the representative packet determined from the detected stepping stones to determine the point of entry of the malicious packet.
7 more elements
In a network carrying a plurality of packets at least one of the packets being a target packet, the network including at least one network component, a detection device and a traceback engine, a method for determining a point of entry of a target packet into the network, the method comprising:
- at the traceback engine, receiving the target packet from the detection device;
- sending a query message identifying the target packet to a first component of the at least one network component;
- receiving a reply containing information about the target packet from the first component;
- processing the reply to extract the information;
- sending a second query message to a second component to identify possible correlated connections according to a table of correlated connection pairs of incoming and outgoing connections;
- receiving a reply containing information about the target packet from the second component, the information including a previously received representative packet from an incoming connection correlated with the outgoing connection of the target packet;
- processing the reply to extract the information;
- and
- determining the point of entry based on the information.
6 more elements
A non-transitory computer-readable medium incorporating instructions for determining a point of entry of a target packet into a network, the network including a network component for generating a representation of an intruding packet as the packet is forwarded through the network, a second network component for identifying correlated connection pairs in the network, a traceback engine, and an intrusion detection device, comprising:
- one or more instructions for generating a query message comprising information about at least a portion of the intruding packet, the query message being created by the traceback engine in response to a triggering event indicating the intruding packet was detected by the intrusion detection device;
- one or more instructions for transmitting the query message to the network component;
- one or more instructions for receiving a reply generated by the network component in response to the query message, the network component matching the representation to the information in the query message and indicating a match there between,
- the match indicating the intruding packet has been encountered and indicating the source and destination addresses of the intruding packet;
- one or more instructions for generating a second query message comprising information about at least outgoing connection information for the intruding packet, the second query message being created by the traceback engine;
- one or more instructions for transmitting the second query message to the second network component;
- and
- one or more instructions for receiving a reply generated by the second network component in response to the second query message, the second network component identifying an incoming connection correlated to the outgoing connection according to a table of identified correlated connection pairs of incoming and outgoing connections, and indicating a previously received representative packet from the incoming connection and a time last seen of the representative packet.
5 more elements
In a network carrying a plurality of packets, the plurality of packets including a target packet having entered the network through an intrusion location, a method for determining the point of entry of a malicious packet into the network, comprising:
- processing a triggering event to extract information about the target packet;
- generating a query for placement onto the network, the query including at least a representation of the information about at least a portion of the target packet;
- sending the query to a network component;
- receiving a reply from the network component, the reply based on at least one packet digest produced as each of the plurality of packets is forwarded through the network and including at least outgoing connection information for identified matching packets;
- processing the reply;
- generating a second query for placement onto the network, the second query including a least the outgoing connection information;
- sending the second query to a second network component;
- receiving a second reply from the second network component, the second reply indicating an incoming connection previously associated with the outgoing connection according to a table of identified correlated connection pairs of incoming and outgoing connections;
- processing the second reply;
- and
- using the second reply to facilitate identification of the intrusion location.
8 more elements
A method, comprising:
- receiving, at a source path isolation engine traceback manager, a determination by an intrusion detection system that an exceptional event has occurred, said determination being in the form of a traceback request, the traceback request comprising a packet, P, a victim, V, and a time of attack, T;
- dispatching, from the traceback manager upon receipt of the traceback request, a query message containing the P, V, and T to a source path isolation engine collection and reduction agent for processing, the reduction agent being responsible for the region of the network including victim V;
- polling, by the reduction agent, each source path isolation engine enhanced router including a data generation agent and associated with the reduction agent;
- receiving, from each data generation agent, a reply indicating whether the target packet P was seen by the data generation agent;
- associating the reply corresponding to the respective enhanced router of the data generation agent as active path data if the packet P was seen;
- building a source path trace of possible paths taken by the target packet P based on the path data;
- forwarding the source path tree to the traceback manager accompanied by a time T′ the packet entered the region for which the enhanced router is responsible and the entering packet itself P′;
- attempting to identifying, by the traceback manager, the ingress point for the packet P′;
- if the traceback manager is unable to determine the ingress point, then process subsequent responses from participating routers located a hop away from the region of the network comprising at least a subset of the victim V, the additional hop requests comprising packet P′, a border router between the two network regions designated as victim V′, and T′ as the time of attack;
- producing, by a stepping stone detection process, a table of connection pairs such that, given an outgoing connection the table indicates an incoming connection relating to the identified ingress point for the packet P′;
- tracing the packet P′ to the router nearest to an ingress point that is a stepping stone host;
- continuing the trace across the stepping stone host by querying the established connection pair table to determine the next connection to trace according to the packet P′;
- receiving corresponding incoming connection information from the connection pair table including a new target packet, a time the new target packet was last seen, and a last router known to have seen the new target packet;
- and
- constructing a new query based on the new target packet and the time the new target packet was last seen and continuing the trace.
12 more elements
Dependencies are inferred from the claim text.