Method and apparatus for network intrusion detection
AssigneeHewlett-Packard Development Company, L.P.
InventorRichard H. Porter
Life of this patent
Estimating the term…
Abstract
The current invention discloses a method and apparatus to detect and mitigate network intrusion by collecting a first log of wireless network traffic in the vicinity of an area and a second log of network traffic from a switch port connected to the area; pre-processing the logs; and then detecting the presence of unauthorized access points (APs) by attempting to identify matching patterns in the pre-processed first and second logs.
Claims16
A method to detect network intrusion comprising:
- collecting a first log of packets in wireless network traffic in the vicinity of an area suspected to have one or more unauthorized access points (APs) and a second log of packets in network traffic from a switch port connected to the area, the first and second logs comprise at least one captured packet representing network traffic;
- pre-processing the first and second logs, including removing protocol overhead from the at least one captured packet in the first log and the at least one captured packet in the second log to obtain payload contents of the captured packets in the first and second logs;
- analyzing the payload contents of the captured packets in the pre-processed first log and the pre-processed second log to identify matching patterns, wherein sub-sequences of the at least one captured packet in the pre-processed first log are matched to sub-sequences of the captured at least one packet in the pre-processed second log;
- and
- generating a response based on a set of rules in response to an identification of matching patterns in the sub-sequences.
A non-transitory computer-readable medium storing computer-readable instructions, which when executed by a computer system, cause the computer system to perform operations to detect network intrusion, the computer-readable instructions comprising code to:
- pre-process a first log of packets in wireless network traffic in the vicinity of an area suspected to have one or more unauthorized access points and a second log of packets in network traffic from a switch port connected to the area, wherein each of the first and second logs comprises at least one captured packet representing network traffic, wherein to pre-process the first log and the second log, the code is to remove protocol overhead from the packets in the first and second logs, to obtain payload contents of the captured packets in the first and second logs;
- and
- analyze the payload contents of the captured packets in the pre-processed first log and the pre-processed second log to identify matching patterns, wherein sub-sequences of the at least one captured packet in the pre-processed first log are matched to sub-sequences of the at least one captured packet in the pre-processed second log.
An apparatus to detect network intrusion, comprising:
- a memory on which is stored machine readable instructions to:
- receive a first log of packets in wireless network traffic from a data collector that is to collect the first log of wireless network traffic in the vicinity of an area suspected to have one or more unauthorized access points;
- receive a second log of packets in network traffic from a switch port connected to the area suspected to have one or more unauthorized access points;
- pre-process the first and second logs, wherein each of the first and second logs comprises at least one captured packet representing network traffic, wherein to pre-process the first and second logs, the machine readable instructions are to remove protocol overhead from the packets in the first and second logs, to obtain payload contents of the captured packets in the first and second logs;
- and
- analyze the payload contents of the captured packets in the pre-processed first log and pre-processed second log to identify matching patterns, wherein sub-sequences of the at least one captured packet in the pre-processed first log are matched to sub-sequences of the at least one captured packet in the pre-processed second log;
- and
- a processor to implement the machine readable instructions.
Dependencies are inferred from the claim text.