Loading patent…
AssigneesMathew R. Syrowik, Atul Prakash
InventorKevin R. Borders
Estimating the term…
A method, system and computer program product detect attempts to send significant amounts of information out via HTTP tunnels to rogue Web servers from within an otherwise firewalled network. A related goal is to help detect spyware programs. Filters, based on the analysis of HTTP traffic over a training period, help detect anomalies in outbound HTTP traffic using metrics such as request regularity, bandwidth usage, inter-request delay time, and transaction size.
A method of detecting security threats in a computer network, the method comprising:
A system for detecting security threats in a computer network, the system comprising:
A computer program product for detecting security threats in a computer network, the product comprising:
Dependencies are inferred from the claim text.
Drawings are temporarily unavailable. Open the PDF at USPTO
From the US filing history. Foreign family members aren’t listed.
For detecting or protecting against malicious traffic: by monitoring network traffic
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
Protecting data: by securing the transmission between two devices or processes
For separating internal from external traffic, e.g. firewalls: filtering policies
About 2 years of term left · ends 6 Nov 2028 (estimated)
1. Field of the Invention
This invention relates to methods, systems and computer program products for detecting security threats in a computer network.
2. Background Art
FIG. 1 is a schematic diagram illustrating a passive detection mode;
FIG. 2 is a schematic diagram illustrating an active detection mode;
FIGS. 3a-3c are schematic diagrams illustrating passive input sources for the passive detection mode;
One embodiment of a method, system and computer program product of the present invention is referred to as “Web Tap” which detects anomalies in an application-layer data stream. Web Tap takes advantage of legitimate web request patterns to detect covert communication, backdoors, and spyware activity that is tunneled through outbound HTTP connections. Unlike the previous work on securing web servers (e.g., [22]), Web Tap's focus is on analyzing outbound HTTP traffic from protected network machines to outside web servers, rather than guarding web servers against hostile attacks. One goal is to make it more difficult for hackers or malicious users to run Trojan and HTTP tunnel programs within an organization that leak information to the outside. Web Tap is designed for deployment at an organization's HTTP proxy server (either passively or actively) to help detect anomalies in outbound traffic.
With reference to FIG. 1, a passive detection mode 100 includes an application-layer data stream of block 102, a Web Tap detection module of block 104, a suspicious message stream of block 106, an alert output of block 108, and an alert stream of block 111. The Web Tap detection module of block 104 receives the application-layer data stream of block 102. The Web Tap detection module of block 104 provides the suspicious message stream of block 106 to the alert output of block 108 as the Web Tap detection module of block 104 receives the application-layer data stream of block 102. The alert output of block 108 receives the suspicious message stream of block 106 and outputs the alert stream of block 111.
With reference to FIG. 2, an active detection mode 200 includes an application-layer data stream of block 202, a Web Tap active detection module of block 204, a suspicious message stream of block 206, a data stream without suspicious messages of block 208, an alert output of block 210, and the alert stream of block 111. The application-layer data stream of block 202 provides to the Web Tap active detection module of block 204. As the Web Tap active detection module of block 204 receives the application-layer data stream of block 202, the Web Tap active detection module of block 204 outputs the suspicious message stream of block 206 and the data stream without suspicious messages of block 208. As the Web Tap active detection module of block 204 outputs the suspicious message stream of block 206, the alert output of block 210 receives the suspicious message stream of block 206 and outputs the alert stream of block 111.