# US 8,752,173 B2 · Integrated network intrusion detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,173 B2 - Document ID: US8752173B2 - Status: Granted - Kind: B2 - Application number: 12/649,018 - Filed: 2009-12-29 - Published: 2010-05-13 - Granted: 2014-06-10 - Earliest claimed: 2002-02-01 - Assignees: Intel Corporation - Applicants: Satyendra Yadav - Inventors: Satyendra Yadav - Web page: https://patentgrep.com/patent/US8752173B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Intrusion preludes may be detected (including detection using fabricated responses to blocked network requests), and particular sources of network communications may be singled out for greater scrutiny, by performing intrusion analysis on packets blocked by a firewall. An integrated intrusion detection system uses an end-node firewall that is dynamically controlled using invoked-application information and a network policy. The system may use various alert levels to trigger heightened monitoring states, alerts sent to a security operation center, and/or logging of network activity for later forensic analysis. The system may monitor network traffic to block traffic that violates the network policy, monitor blocked traffic to detect an intrusion prelude, and monitor traffic from a potential intruder when an intrusion prelude is detected. The system also may track behavior of applications using the network policy to identify abnormal application behavior, and monitor traffic from an abnormally behaving application to identify an intrusion. ## Claims ### Claim 1 A method comprising: receiving a request for access to network services from an invoked application; loading an application-specific network policy associated with the invoked application, the application-specific network policy comprising permissive and restrictive rules to designate the received request as authorized or unauthorized, respectively; integrating firewall and intrusion detection to check whether the received request violates the application-specific network policy and to designate the received request as authorized or unauthorized as a function of the application-specific network policy; monitoring network packets for the invoked application based on the designation of the received request; blocking network packets corresponding to the received request in response to the received request being designated as unauthorized; analyzing, on an intrusion detection system component, blocked network packets to detect a network intrusion; determining whether the invoked application is behaving abnormally; loading application-specific monitoring parameters for the invoked application in response to a determination that the invoked application is behaving abnormally; and checking network packets both to and from the invoked application based on the loaded application-specific monitoring parameters. ### Claim 2 (depends on 1) The method of claim 1, further comprising: adding the invoked application to a watch list to initiate analysis of network packets both to and from the invoked application. ### Claim 3 (depends on 1) The method of claim 1, further comprising: generating communications to encourage at least one of further network packets to the invoked application or further network packets from the invoked application. ### Claim 4 (depends on 3) The method of claim 3, wherein the further network packets enable information concerning the system and network of a potential intruder to be obtained. ### Claim 5 (depends on 1) The method of claim 1, wherein analyzing the blocked network packets to detect a network intrusion comprises analyzing the blocked network packets to detect an intrusion prelude. ### Claim 6 (depends on 5) The method of claim 5, wherein the intrusion prelude comprises network packets corresponding to one or more of a system scan, a port scan, and operating system fingerprinting. ### Claim 7 (depends on 1) The method of claim 1, wherein the application-specific monitoring parameters comprise application-specific intrusion signatures for the invoked application. ### Claim 8 (depends on 1) The method of claim 1, further comprising copying the blocked network packets to the intrusion detection system component in response to blocking the network packets corresponding to the received request designated as unauthorized; and wherein analyzing the blocked network packets comprises analyzing, by the intrusion detection system component, the copies of the blocked network packets to detect a network intrusion. ### Claim 9 (depends on 1) The method of claim 1, further comprising loading, into a local repository, an updated application-specific network policy for the invoked application from a remote repository. ### Claim 10 (depends on 1) The method of claim 1, wherein loading application-specific monitoring parameters for the invoked application comprises loading application-specific monitoring parameters from a central security server in response to a determination that the invoked application is behaving abnormally. ### Claim 11 A non-transitory machine-readable medium embodying machine instructions for causing one or more machines to perform operations comprising: receiving a request for access to network services from an invoked application; loading an application-specific network policy associated with the invoked application, the application-specific network policy comprising permissive and restrictive rules to designate the received request as authorized or unauthorized, respectively; integrating firewall and intrusion detection to check whether the received request violates the application-specific network policy and to designate the received request as authorized or unauthorized as a function of the application-specific network policy; monitoring network packets for the invoked application based on the designation of the received request; blocking network packets corresponding to the received request in response to the received request being designated as unauthorized; analyzing the blocked network packets with an intrusion detection system component to detect a network intrusion; determining whether the invoked application is behaving abnormally; loading application-specific monitoring parameters for the invoked application in response to a determination that the invoked application is behaving abnormally; and checking network packets both to and from the invoked application based on the loaded application-specific monitoring parameters. ### Claim 12 (depends on 11) The non-transitory machine-readable medium of claim 11, further comprising: adding the invoked application to a watch list to initiate analysis of network packets both to and from the invoked application. ### Claim 13 (depends on 11) The non-transitory machine-readable medium of claim 11, wherein analyzing the blocked network packets with the intrusion detection system component to detect a network intrusion comprises analyzing the blocked network packets with the intrusion detection system component to detect an intrusion prelude. ### Claim 14 (depends on 13) The non-transitory machine-readable medium of claim 13, wherein the intrusion prelude comprises network packets corresponding to one or more of a system scan, a port scan, and operating system fingerprinting. ### Claim 15 (depends on 11) The non-transitory machine-readable medium of claim 11, wherein the application-specific monitoring parameters comprise application-specific intrusion signatures for the invoked application. ### Claim 16 A system comprising: a processor; a communication interface coupled with the processor; and a tangible machine-readable medium operatively coupled with the processor and embodying machine instructions for causing the processor to perform operations comprising: receiving a request for access to network services from an invoked application; loading an application-specific network policy associated with the invoked application, the application-specific network policy comprising permissive and restrictive rules to designate the received request as authorized or unauthorized, respectively; integrating firewall and intrusion detection to check whether the received request violates the application-specific network policy and to designate the received request as authorized or unauthorized as a function of the application-specific network policy; monitoring network packets for the invoked application based on the designation of the received request; blocking network packets corresponding to the received request in response to the received request being designated as unauthorized; analyzing the blocked network packets with an intrusion detection system component to detect a network intrusion; determining whether the invoked application is behaving abnormally; loading application-specific monitoring parameters for the invoked application in response to a determination that the invoked application is behaving abnormally; and checking network packets both to and from the invoked application based on the loaded application-specific monitoring parameters. ### Claim 17 (depends on 16) The system of claim 16, further comprising instructions for adding the invoked application to a watch list to initiate analysis of network packets both to and from the invoked application. ### Claim 18 (depends on 16) The system of claim 16, wherein analyzing the blocked network packets with the intrusion detection system component to detect a network intrusion comprises analyzing the blocked network packets with the intrusion detection system component to detect an intrusion prelude. ### Claim 19 (depends on 18) The system of claim 18, wherein the intrusion prelude comprises network packets corresponding to one or more of a system scan, a port scan, and operating system fingerprinting. ### Claim 20 (depends on 16) The system of claim 16, wherein the application-specific monitoring parameters comprise application-specific intrusion signatures for the invoked application. ### Claim 21 A machine-implemented method comprising: receiving, from an invoked application, a request for access to network services; loading an application-specific network policy associated with the invoked application, the application-specific network policy comprising permissive and restrictive rules to designate the received request as authorized or unauthorized, respectively; integrating firewall and intrusion detection to check whether the received request violates the application-specific network policy and to designate the received request as authorized or unauthorized as a function of the application-specific network policy; monitoring network packets for the invoked application based on the designation of the received request; blocking network packets corresponding to the received request in response to the received request being designated as unauthorized; analyzing the blocked network packets with an intrusion detection system component invoked with the invoked application to detect a network intrusion; determining whether the invoked application is behaving abnormally; loading application-specific monitoring parameters for the invoked application in response to a determination that the invoked application is behaving abnormally; and checking network packets both to and from the invoked application based on the loaded application-specific monitoring parameters. ### Claim 22 (depends on 21) The machine-implemented method of claim 21, wherein the intrusion detection system component and the invoked application run within a single execution context. ### Claim 23 (depends on 22) The machine-implemented method of claim 22, wherein monitoring the network packets comprises monitoring outbound network packets. ### Claim 24 (depends on 21) The machine-implemented method of claim 21, wherein the application-specific monitoring parameters comprise application-specific intrusion signatures for the invoked application. ### Claim 25 A non-transitory machine-readable medium embodying machine instructions for causing one or more machines to perform operations comprising: receiving a request for access to network services from an invoked application; loading an application-specific network policy associated with the invoked application, the application-specific network policy comprising permissive and restrictive rules to designate the received request as authorized or unauthorized, respectively; determining whether the received request violates the application-specific network policy; designating received request as authorized or unauthorized as a function of the application-specific network policy; opening a communication channel for network packets corresponding to the received request in response to the received request being designated as authorized; dropping network packets corresponding to the received request in response to the received request being designated as unauthorized; analyzing the dropped network packets with an intrusion detection system component invoked with the invoked application to detect a network intrusion; determining whether the invoked application is behaving abnormally; loading application-specific monitoring parameters for the invoked application in response to a determination that the invoked application is behaving abnormally; and checking network packets both to and from the invoked application based on the loaded application-specific monitoring parameters. ### Claim 26 (depends on 25) The non-transitory machine-readable medium of claim 25, wherein the intrusion detection system component and the invoked application run within a single execution context. ### Claim 27 (depends on 25) The non-transitory machine-readable medium of claim 25, wherein the application-specific monitoring parameters comprise application-specific intrusion signatures for the invoked application.