Preventive intrusion device and method for mobile devices
AssigneeZimperium, Inc.
InventorsYaniv Karta, Itzhak Avraham
Life of this patent
Estimating the term…
Abstract
A method for providing an intrusion prevention system to prevent hacking into files located on enterprise users' endpoint devices functioning as mobile computing platforms. The method includes filtering low-level network packets for each of a plurality of received network packets, offloading the received packets to an inspecting processing module and marking suspicious packets based on at least one of a header and pattern of each of said received packets. The method also includes taking preventive measures by the system to ensure protection of the device and network, taking active steps by the system to block suspicious traffic and disconnecting the current connection by the system, when it detects suspicious traffic.
Claims24
A computerized system for preventing network attacks on a communication device configured to receive a plurality of network packets in a wireless communication network, the system comprising:
- a non-transitory a computer readable storage medium storing executable modules comprising:
- a secure interface module that identifies deterministic patterns and heuristic patterns of the received network packets;
- a packet filter module that filters the received packets based on the identified deterministic patterns and heuristic patterns of the received packets, and to output filtered packets;
- a pattern detector module that inspects the filtered network packets from the packet filter module and in response to the inspection, to classify the received network packets as suspicious or normal based on stored filtering settings;
- and
- a kernel extension module that receives the filtered packets, to detect patterns of the packets classified as normal and to further examine the packets classified as suspicious, and
- a processor that executes the stored modules.
A method for preventing network attacks on a communication device comprising at least one processor, comprising:
- receiving, at the communication device, a plurality of network packets;
- filtering, by the communication device, the received packets based on identified deterministic patterns and heuristic patterns of the received packets, and to output filtered packets;
- classifying the filtered packets as ‘normal’ or ‘suspicious’ based on stored filtering settings;
- detecting patterns of the packets classified as ‘normal’;
- and further examining packets classified as ‘suspicious’.
A communication device comprising:
- a non-transitory computer-readable storage medium storing executable modules comprising:
- a WiFi firmware module that receives a plurality of network packets;
- a packet filter module that filters the received network packets based on identified deterministic patterns and heuristic patterns of the received network packets, and to output filtered packets;
- a pattern detector module that detects patterns of the received network packets according to stored filtering settings criteria;
- and
- an action module that takes one or more corrective actions in response to the detected patterns being indicative of an attack;
- and
- a processor that executes the stored modules.
A method for providing an intrusion prevention system to prevent attacks on a mobile device which transmit information in a communication network, the method comprising:
- receiving a plurality of network packets;
- filtering, by a processor, the received network packets based on identified patterns of the received network packets;
- providing the filtered network received packets to an inspecting processing module that classifies a subset of the network packets comprising less than a threshold percentage of the filtered network packets;
- classifying, by the inspecting processing module, the subset of the network packets suspicious packets based on at least one of:
- headers associated with the subset of network packets, and patterns of the subset of network packets;
- and
- in response to the detection of an attack based on the classified subset of the network packets, taking one or more preventive measures at the mobile device to mitigate or prevent the attack.
Dependencies are inferred from the claim text.