Scalable monitor of malicious network traffic
AssigneeWisconsin Alumni Research Foundation
InventorsVinod T. Yegneswaran, Paul R. Barford, David J. Plonka
Life of this patent
Estimating the term…
Abstract
A monitor of malicious network traffic attaches to unused addresses and monitors communications with an active responder that has constrained-state awareness to be highly scalable. In a preferred embodiment, the active responder provides a response based only on the previous statement from the malicious source, which in most cases is sufficient to promote additional communication with the malicious source, presenting a complete record of the transaction for analysis and possible signature extraction.
Claims28
A network monitor for malicious network traffic implemented on an electronic circuit executing a stored program, the monitor further comprising:
- a network interface for receiving at a plurality of addresses malicious communications from at least one malicious computer, each malicious communication comprised of a series of statements, the statements conforming at least in part to a communication protocol defined by a series of communication states;
- a constrained-state-awareness responder creating, for each given statement of the malicious communication at the plurality of addresses, a response communicated to the at least one malicious computer to the given statement of the malicious communication based on the given statement and a given number of previous statements of the malicious communication less than that required to determine a position of the given statement of the malicious communication within the series of communication states of the communication protocol;
- wherein the responder creates responses to the malicious computer without accurately determining the communication state of the communication protocol for the given statement of the malicious communication, and wherein the responder cannot fully execute the communication protocol;
- and
- a monitor recording the series of statements of the malicious communication for the plurality of addresses.
A method of monitoring malicious network traffic using an electronic circuit executing a stored program, the method comprising the steps of:
- (a) receiving from malicious computers, malicious communications comprised of a series of statements from a plurality of addresses, the statements conforming at least in part to a communication protocol defined by a series of communication states;
- (b) creating a response communicated to the malicious computers to a given statement of the malicious communication based on the given statement of the malicious communication and a given number of previous statements of the malicious communication less than that required to determine a position of the given statement within the series of communication states of the communication protocol;
- wherein the creation of the response to the malicious computer does not employ accurate determination of a communication state of the communication protocol for the given statement of the malicious communication, and wherein the created response is limited to responses less than required to fully execute the communication protocol;
- and
- (c) recording the series of statement of the malicious communication for the plurality of addresses.
Dependencies are inferred from the claim text.