Blocking intrusion attacks at an offending host

#The present invention relates to the field of computer security, and more particularly to the prevention of unauthorized intrusion into computer networks and systems.

#As information technology has become popularized with the assistance of the rapid development of information and communication technology combined with computers, network environments, and the Internet, so too has malicious network access, such as intrusions into server systems and the transmission of harmful traffic. A number of conventional security solutions are available to block malicious network accesses. These systems traditionally include the use of firewalls or dedicated network intrusion detection systems on a protected network.

#Intrusion detection, in general, can be performed manually or automatically. Manual intrusion detection typically incorporates examining a log file system record or other evidence for signs of intrusions, including the amount of network traffic to or from a system or network. Systems that perform automatic intrusion detection are typically referred to as Intrusion Detection Systems (IDS). An IDS can be either host-based, if it monitors system calls or logs, or network-based if it monitors the flow of network packets. Conventional IDS's are generally a combination of these two approaches. When a probable intrusion is discovered by a conventional IDS, typical actions to perform include logging relevant information to a file or database, generating an email alert, or generating a message to a pager or mobile phone.

#The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and, together with a general description of the invention given above, and the detailed description given below, serve to explain the principles of the invention.

#FIG. 1 is a flowchart showing the actions of a computer under an intrusion attack in connection with intrusion protection consistent with embodiments of the invention.

#FIG. 2 is a flowchart showing the actions at an offending host computer after being notified by the computer in FIG. 1.

#Embodiments of the invention provide methods of protecting a network from intrusion attacks by notifying an offending host of the attack and taking action at the offending host based on an intrusion protection policy. An intrusion of an offending packet is detected on a computer or other network component coupled to a protected network. After detection, a blocking instruction is returned to the offending host to initiate an intrusion protection operation on the offending host. The intrusion protection operation inhibits further transmission of offending packets by the offending host. Using this approach in combination with contemporary prevention techniques may provide a more robust solution to intrusion and extrusion attacks.

#FIG. 1 illustrates the actions taken at a computer or network component on a protected network. The network component may be incorporated in contemporary intrusion protection, which may be a router or a firewall in some embodiments. A packet is received on the protected network from an offending host in block 10. This packet may be of the type associated with an intrusion (or extrusion) attack. As discussed above, both intrusions and extrusions are to be detected and potentially blocked at the offending host. For purposes of this application, both intrusions and extrusions will be referred to as intrusions. The computer or network component then checks the packet to see if it is an offending packet, such as a malformed packet, a denial of service (DoS) or a distributed denial of service (DDoS) packet, for example. If the packet is detected to be an offending packet (“yes” branch of decision block 12), then a blocking instruction is returned to the offending host in block 14. If the packet is not of the type associated with an intrusion (“no” branch of decision block 12), then the network component or computer continues to receive packets. In other embodiments incorporating contemporary intrusion protection operations, other actions may be taken as discussed above with IDS and IPS implementations.

#A single offending host can send offending packets to many computers on many networks. This in turn can generate excessive network traffic as each of the computers transmits data back to the offending host. To assist in reducing the amount of network traffic, blocking instructions in some embodiments may be implemented on a computer in a protected network to be periodically sent to the offending host, rather than sent at a time an offending packet is received. The transmission of blocking instructions may be set so that the transmissions are sent at intervals but no more than a predetermined number of times. If an offending host is receiving more than a certain number of blocking instructions, the multiple receipts may indicate that there is an actual problem at the offending host which should be addressed.