US20070094722A1 - Detecting networks attacks - Google Patents
Detecting networks attacks Download PDFInfo
- Publication number
- US20070094722A1 US20070094722A1 US10/558,848 US55884803A US2007094722A1 US 20070094722 A1 US20070094722 A1 US 20070094722A1 US 55884803 A US55884803 A US 55884803A US 2007094722 A1 US2007094722 A1 US 2007094722A1
- Authority
- US
- United States
- Prior art keywords
- attack
- data
- address
- network
- disinfection
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F15/00—Digital computers in general; Data processing equipment in general
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F15/00—Digital computers in general; Data processing equipment in general
- G06F15/16—Combinations of two or more digital computers each having at least an arithmetic unit, a program unit and a register, e.g. for a simultaneous processing of several programs
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1458—Denial of Service
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1491—Countermeasures against malicious traffic using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/02—Details
- H04L12/14—Charging, metering or billing arrangements for data wireline or wireless communications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Computing Systems (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Software Systems (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Computer And Data Communications (AREA)
Abstract
Described is a technique for detecting attacks on a data communications network having a plurality of addresses for assignment to data processing systems in the network. The technique involves identifying data traffic on the network originating at any assigned address and addressed to any unassigned address. Any data traffic so identified is inspected for data indicative of an attack. On detection of data indicative of an attack, an alert signal is generated.
Description
- The present invention generally relates to detecting network attacks and particularly relates to methods, apparatus, and computer program elements for detecting attacks on a data communications network
- The Internet is a wide area data communications network formed from a plurality of interconnected data networks. In operation, the Internet facilitates data communications between a range of remotely situated data processing systems. Such data processing systems each typically comprise a central processing unit (CPU), a memory subsystem, and input/output (I/O) subsystem, and computer program code stored in the memory subsystem for execution by the CPU. Typically, end user data processing systems connected to the Internet are referred to as client data processing systems or simply clients. Similarly, data processing systems hosting web sites and services for access by end users via the Internet are referred to as server data processing systems or simply servers. There is a client-server relationship completed via the Internet between the end user data processing systems and the hosting data processing systems.
- The Internet has become an important communications network for facilitating electronically effected commercial interactions between consumers, retailers, and service providers. Access to the Internet is typically provided to such entities via an Internet Service Provider (ISP). Each ISP typically operates an open network to which clients subscribe. Each client is provided with a unique Internet Protocol (IP) address on the network. Similarly, each server on the network is provided with a unique IP address. The network operated by the ISP is connected to the Internet via a dedicated data processing system usually referred to as a router. In operation, the router directs inbound communication traffic from the Internet to specified IP addresses on the network. Similarly, the router directs outbound communication traffic from the network in the direction of specified IP addresses on the Internet.
- A problem faced by many ISPs is the increasing frequency of electronic attacks to the networks they operate. Such attacks include computer virus attacks and so-called “worm” attacks. Attacks of this nature introduce significant performance degradation in networks operated by ISPs. Infected systems connected to the network typically attempt to spread the infection within the network. Many users do not recognize that their systems are infected. It would be desirable to provide technology for triggering disinfection of such systems in the interests of increasing network performance.
- In accordance with the present invention, there is now provided a method for detecting attacks on a data communications network having a plurality of addresses for assignment to data processing systems in the network, the method comprising: identifying data traffic on the network originating at any assigned address and addressed to any unassigned address; inspecting any data traffic so identified for data indicative of an attack; and, on detection of data indicative of an attack, generating an alert signal.
- The term “unassigned” herein is meant as covering an address that is not assigned to a physical device other than an apparatus for detecting an intrusion or generating an attack signature. The apparatus that is designed to execute the method according to the invention will be the device those “unassigned” addresses are actually assigned to in order to make use of the invention. Those addresses are insofar unassigned as they are not assigned to any device that does have another functionality apart from signature generation or intrusion detection. Thereby data traffic that is addressed to such an unassigned address will be received by that apparatus and subjected to the claimed method.
- The inspecting preferably comprises spoofing replies to requests contained in the data traffic identified. A preferred embodiment of the present invention comprises, on generation of the alert signal, rerouting any data traffic originating at the address assigned to the data processing system originating the data indicative of the attack to a disinfection address on the network. On generation of the alert signal, an alert message may be sent to the disinfection address. The alert message may comprise data indicative of the attack detected. On receipt of the alert message, a warning message may be sent from the disinfection address to the address assigned to the data processing system originating the data indicative of the attack. The warning message may include program code for eliminating the attack when executed by the data processing system originating the data indicative of the attack.
- Viewing the present invention from another aspect, there is now provided apparatus for detecting attacks on a data communications network having a plurality of addresses for assignment to data processing systems in the network, the apparatus comprising: an intrusion detection sensor (IDS) for identifying data traffic on the network originating at any assigned address and addressed to any unassigned address, inspecting any data traffic so identified for data indicative of an attack, and, on detection of data indicative of an attack, generating an alert signal.
- The IDS in use preferably inspects the data traffic identified through spoofing replies to requests contained in the data traffic identified. The apparatus may also comprise a router connected to the intrusion detection sensor for rerouting, in response to generation of the alert signal, any data traffic originating at the address assigned to the data processing system originating the data indicative of the attack to a disinfection address on the network. Preferably, the IDS, on generation of the alert signal, sends an alert message to the disinfection address. The alert message preferably comprises data indicative of the attack detected. A preferred embodiment of the present invention further comprises a disinfection server assigned to the disinfection address, the disinfection server sending, on receipt of the alert message, a warning message to the address assigned to the data processing system originating the data indicative of the attack.
- The present invention also extends to a data communications network comprising: a plurality of addresses for assignment to data processing systems in the network; and, apparatus for detecting attacks on the network as herein before described.
- The present invention further extends to a computer program element comprising computer program code means which, when loaded in a processor of a data processing system, configures the processor to perform a method for detecting attacks on a data communications network as herein before described.
- In a preferred embodiment of the present invention, there is provided a data communications network comprising: a router for connecting a plurality of data processing systems to the Internet; an IDS connected to the router; and a disinfection server also connected to the router. In response to the IDS detecting that one of the data processing systems is infected by an attack, the IDS instructs the router to deflect all network traffic from that attack to the disinfection server. The IDS simultaneously supplies disinfection data to the disinfection server. The disinfection data is indicative of: the nature of the infection; how to disinfect the infecting system; and how to resume normal network connectivity.
- There are generally a large number of free IP addresses on a given network. In a particularly preferred embodiment of the present invention, the IDS listens on the network for traffic directed toward the free IP addresses. No such traffic should exist. In the event that a request sent to one of the free IP addresses is detected, the IDS spoofs an answer to the request. The free IP addresses are not in use. Thus, any attempt to contact, for example, a server at such an address is a priori suspicious. The IDS then listens for a reply to the spoofed answer. If the IDS detects a diagnosable attack in the reply, it signals the router to divert all traffic from the infected system to the disinfection server. Because, the IDS is interactively spoofing responses to infected systems, it has an accurate view of each attack. Thus, false positives are minimized.
- Preferred embodiments of the present invention will now be described, by way of example only, with reference to the accompanying drawings, in which:
-
FIG. 1 is a block diagram of a data processing system; -
FIG. 2 is a block diagram of a data processing network embodying the present invention; -
FIG. 3 is a block diagram of an intrusion detection sensor embodying the present invention; and, -
FIG. 4 is a flow diagram associated with the intrusion detection sensor. - Referring first to
FIG. 1 , a data processing system comprises aCPU 10, an I/O subsystem 20, and amemory subsystem 40, all interconnected by abus subsystem 30. Thememory subsystem 40 may comprise random access memory (RAM), read only memory (ROM), and one or more data storage devices such as hard disk drives, optical disk drives, and the like. The I/O subsystem 20 may comprise: a display; a printer; a keyboard; a pointing device such as a mouse, tracker ball, or the like; and one or more network connections permitting communications between the data processing system and one or more similar systems and/or peripheral devices via a data communications network. The combination of such systems and devices interconnected by such a network may itself form a distributed data processing system. Such distributed systems may be themselves interconnected by additional data communications networks. - In the
memory subsystem 40 is storeddata 60 andcomputer program code 50 executable by theCPU 10. Theprogram code 50 includesoperating system software 90 andapplication software 80. Theoperating system software 90, when executed by theCPU 10, provides a platform on which theapplication software 80 can be executed. - Referring now to
FIG. 2 , in a preferred embodiment of the present invention, there is provided a data communications network 100 having a plurality ofaddresses 110 for assignment to data processing systems in the network. In a particularly preferred embodiment of the present invention, the network 100 is in the form of an Internet service installation having a plurality of assignable Internet Protocol (IP) addresses 110. The network 100 is connected to theInternet 120 via arouter 130. Therouter 130 may be implemented in form of a data processing system as herein before described with reference toFIG. 1 dedicated by appropriate programming to the task to route communication traffic in the form of data packets between theInternet 120 and the network 100 based on IP address data specified in the data packets. Afirst group 140 of the IP addresses 110 on the network 100 are assigned tosystems 150 belonging to users of the Internet service. Eachsystem 150 may be a data processing system as herein before described with reference toFIG. 1 . Asecond group 160 of the IP addresses 110 on the network 100 are free. More specifically, thesecond group 160 of IP addresses 110 are not assigned touser systems 150. An intrusion detection sensor (IDS) 170 is also connected to the network 100. TheIDS 170 is also connected to therouter 130. Details of theIDS 170 will be provided further below. Therouter 130 is connected to adisinfection server 180. Thedisinfection server 180 may be implemented by a data processing system as herein before described with reference toFIG. 1 . - With reference to
FIG. 3 , in a particularly preferred embodiment of the present invention, theIDS 170 comprises a data processing system as herein before described with reference toFIG. 1 . Theapplication software 80 of theIDS 170 includesintrusion detection code 200. Thedata 60 stored in thememory subsystem 40 of theIDS 170 includesattack identity data 210 anddisinfection data 220. Thedata 60 also includes a record of which of the IP addresses on the network 100 are free and belong to thesecond group 160, and which of the IP of the IP addresses 110 on the network 100 are assigned todata processing systems 150 and belong to thefirst group 140. The record is updated each time another IP address is allocated or an existing IP address allocation is removed. Theattack identity data 210 contains data indicative of signatures identifying known attacks. Thedisinfection data 220 contains data indicative of: the nature of each attack; how to disinfect a system infected with each attack; and how to resume normal network connectivity. Theattack identity data 210 anddisinfection data 220 are cross referenced. Theintrusion detection code 200, when executed by theCPU 10, configures theIDS 170 to operate in accordance with the flow diagram shown inFIG. 4 . - Referring now to
FIG. 4 , in operation, theIDS 170 identifies data traffic on the network 100 originating at any assignedaddress 140 and addressed to anyunassigned address 160. TheIDS 170 inspects any data traffic so identified for data indicative of an attack. On detection of data indicative of attack, theIDS 170 generates an alert signal. In a preferred embodiment of the present invention, on generation of the alert signal, any data traffic originating at theaddress 140 assigned to thedata processing system 150 originating the data indicative of the attack is rerouted to a disinfection address on the network 100. In a particularly preferred embodiment of the present invention, theIDS 170 listens on the network 100 for traffic directed toward the free IP addresses 160. Specifically, atblock 300, theIDS 170 examines requests sent fromaddresses 140 on the network 100 to determine, atblock 310, if the request specifies one of the free IP addresses 160 as the destination address. If the request does not specify one of the free IP addresses 160, then, atblock 320, theIDS 170 waits for the next request to examine. - The identification may also be realized by assigning the unassigned addresses to the
IDS 170, such that any traffic directed at an unassigned address automatically arrives at theIDS 170. - If, however, the request specifies one of the free IP addresses 160, then, at
block 330, theIDS 170 spoofs an answer to the request. The answer is sent to the source IP address on the network 100. The free IP addresses 160 are not in use. Thus, any attempt to contact, for example, a system at such an address is a priori suspicious. Atblock 340, theIDS 170 listens for a reply to the spoofed answer. TheIDS 170 may time out if no reply is received within a predetermined period, in which case, atblock 320, theIDS 170 waits for the next request to examine. If a reply is however received, then, atblock 350, theIDS 170 compares the suspect request and reply with theattack identity data 210 stored in thememory subsystem 40. If, atblock 350, the comparison fails to identify an attack, then, atblock 320, theIDS 170 waits for the next request to examine. If, however, the comparison atblock 350 detects a diagnosable attack in the reply, then theIDS 170 determines that thesource system 150 is infected. Accordingly, atblock 360, theIDS 170 generates the alert signal. The alert signal is sent to therouter 130. The alert signal instructs therouter 130 to divert all traffic from theinfected system 150 to the disinfection address. Referring back toFIG. 1 , in a particularly preferred embodiment of the present invention, adisinfection server 180 is located at the disinfection address. - In a preferred embodiment of the present invention, on generation of the alert signal, the
IDS 170 sends an alert message to the disinfection address. Preferably, the alert message comprises data indicative of the attack detected. Accordingly, in a particularly preferred embodiment of the present invention, theIDS 170 retrieves thedisinfection data 220 corresponding to the attack detected from thememory subsystem 40. Atblock 370, theIDS 170 sends the alert message containing retrieved disinfection data to the disinfection address at which thedisinfection server 180 resides. Then, atblock 320, theIDS 170 waits for the next request to examine. Each request, answer, and reply may be embodied in one or more packets of data traffic on the network 100. Accordingly, the signature of each attack may span more than one packet. - In a preferred embodiment of the present invention, the
disinfection data 220 sent to thedisinfection server 180 contains data indicative of: the nature of the attack detected; how to disinfect thesystem 150 infected with the attack; and how to resume normal network connectivity. On receipt of thedisinfection data 220 from theIDS 170, thedisinfection server 180 sets about curing theinfected system 150 and restoring the network 100. In another preferred embodiment of the present invention, thedisinfection data 220 contains only data indicative of the nature of the attack. The disinfection server then selects, based the nature of the attack, one of a plurality of pre-stored techniques for disinfecting theinfected system 150 and/or restoring the network 100 and executes the selected technique. The attacks may take many different forms. Accordingly, the corresponding techniques for disinfection and network restoration may vary widely from one attack to the next. - In a preferred embodiment of the present invention, on receipt the disinfection data, the
disinfection server 180 sends a warning message to theinfected system 150. The warning message informs the user of theinfected system 150 that his or hersystem 150 is infected. The message may instruct the user to run anti-virus software pre-stored in theinfected system 150 to eliminate or otherwise isolate the infection. Alternatively, the message may contain disinfection program code for eliminating the attack from theinfected system 150, together with instructions to assist the user in executing the disinfection code on theinfected system 150. In another alternative, the message may direct the user to another web site, at which appropriate disinfection program code is provided. In another preferred embodiment of the present invention, the message contains disinfection program code that, when loaded into the infected system, executes automatically, thus eliminating or otherwise isolating the infection in a manner which is transparent to the user. Other disinfection schemes are possible. - In the embodiments of the present invention herein before described, the
disinfection server 180 is implemented in a single data processing system such as that herein before described with reference toFIG. 1 . However, in other embodiments of the present invention, thedisinfection server 180 may be implemented by multiple interconnected data processing systems. Such data processing may be distributed or located together in a “farm”. Each data processing system in the disinfection server may be dedicated to handling a different attack. TheIDS 170 may also be implemented by multiple integrated data processing systems. Alternatively, theIDS 170 and thedisinfection server 180 may be integrated in a single data processing system. - The traffic on the network 100 sent from the
infected system 150 and deflected by therouter 130 to thedisinfection server 180 may be logged and/or discarded by thedisinfection server 180. In the embodiments of the present invention herein before described, theIDS 170 sends disinfection data to thedisinfection server 220. However, in other embodiments of the present invention, once an infection is detected, theIDS 170 may simply instruct therouter 130 to deflect traffic from theinfected system 150 to thedisinfection server 180 without theIDS 170 additionally supplyingdisinfection data 220 to thedisinfection server 180. Thedisinfection server 180 may then simply act as a repository for traffic originating in theinfected system 150, logging and/or discarding traffic it receives from theinfected system 150. The logging and discarding may be reported by thedisinfection server 180 to an administrator of the network 100. Such reports may be delivered periodically or in real time. The reporting may be performed via, for example, an administration console. However, other reporting techniques, such as printed output for example, are possible. On receipt of such reports, administrators can take actions appropriate for eliminating or otherwise containing the infection of the network 100. - In the embodiments of the present invention herein before described, the
IDS 170,router 130, anddisinfection server 180 are implemented by data processing systems programmed with appropriate program code. However, it will be appreciated that, in other embodiments of the present invention, one or more of the functions described herein as being implemented in software may be implemented at least partially in hardwired logic circuitry. - It will also be appreciated that the attack detection methods described herein may be implemented by the service provider responsible for the network 100, or at least partially by a third party in the form of a service to the service provider. Such a service may differentiate the service offered by the service provider from the services provided by it competitors. Such differentiated services may be optionally supplied to end users of the network service provided in exchange for an additional premium.
- The service of detecting attacks for networks used by an entity other than the service provider, may in a preferred embodiment comprise billing for the service delivered. The charge to be billed may therein be determined in dependence of one or more of a number of factors that typically are indicative of the complexity or workload experienced by the service provider. Such factors indicative of volume and time-consumption of the service provided may include the size of the network, the number of unassigned addresses monitored, the number of assigned addresses monitored, the volume of data traffic inspected, the number of attacks identified, the number of alerts generated, the volume of rerouted data traffic. Factors identifying a level of increased complexity can be the signature of the identified attack, the degree of network security achieved. Also factors identifying the value of the service provided to the serviced entity may be used such as the turnover of said entity, the field of business of said entity, or the like.
- Of course, any combination of the previously mentioned factors is possible, in particular being differently weighed to determine a final charge. The billing can be automated in that the charge is sent together with one of the messages sent in the attack detection process. This advantageously combines the use of the messaging for the attack-handling purpose together with its use for the billing purpose. The double use of a message provides the technical advantage of reducing the traffic flow generated through the attack detection and billing process. At the same time this method can be used to guarantee that the serviced entity is only billed for exactly the service provided.
- Another preferred solution for billing is offering the entity a subscription to the attack detection service that allows the serviced entity to profit from the attack detection process for a predetermined time, volume of traffic, number of systems or the like. The service provider may offer his own disinfection server as a hosting unit to be used in combination with the network used by the serviced entity, but it is also possible that the disinfection server is held, maintained, hosted or leased by the serviced entity.
- In a further preferred embodiment the service provider may utilize a synergistic effect by providing the attack detection service to several entities, and sharing the resources, such as the
router 130,intrusion detection sensor 170 anddisinfection server 180 among the several services. Thereby not only more efficient use of the employed resources can be obtained but also attack-related information between the different networks can be shared and could be utilized to improve the detection quality on the serviced networks. For instance the detection of an attack on one network could lead to a quicker detection on another network since the process of determining an attack signature can be shortened or even eliminated. Also the disinfection mechanism can be shared between the serviced entities thereby reducing their effort and costs related to updating and maintaining the disinfection mechanism. The technical advantage of sharing technical data that is derived from the handling of attacks to the network of one entity to improve the attack handling of another serviced entity will provide an incentive for entities to join a pool of several entities being serviced by the same service provider for intrusion detection. The billing model could in a preferred embodiment be adapted to incent the participation of entities in a group of entities sharing the detection resources and employing the same service provider. - Herein the term “connect” is not limited to physical connections. It is for exapmle intended to also encompass a general link that allows the sending or receiving of information. The connection can therein be indirect.
Claims (24)
1. A method for detecting attacks on a data communications network having a plurality of addresses for assignment to data processing systems in the network, the method comprising: identifying data traffic on the network originating at any assigned address and addressed to any unassigned address, said unassigned address is an address which is free and not assigned to user systems; inspecting any data traffic so identified for data indicative of an attack; and, on detection of data indicative of an attack, generating an alert signal.
2. A method as claimed in claim 1 , wherein the inspecting comprises spoofing replies to requests contained in the data traffic identified.
3. A method as claimed in claim 1 , comprising, on generation of the alert signal, rerouting any data traffic originating at the address assigned to the data processing system originating the data indicative of the attack to a disinfection address on the network.
4. A method as claimed in claim 1 , comprising, on generation of the alert signal, sending an alert message to the disinfection address.
5. A method as claimed in claim 5 , wherein the alert message comprises data indicative of the attack detected.
6. A method as claimed in claim 5 , comprising, on receipt of the alert message, sending a warning message from the disinfection address to the address assigned to the data processing system originating the data indicative of the attack.
7. A method as claimed in claim 6 , comprising including in the warning message program code for eliminating the attack when executed by the data processing system originating the data indicative of the attack.
8. Apparatus for detecting attacks on a data communications network having a plurality of addresses for assignment to data processing systems in the network, the apparatus comprising: an intrusion detection sensor for identifying data traffic on the network originating at any assigned address and addressed to any unassigned address, said unassigned address is an address which is free and not assigned to user systems inspecting any data traffic so identified for data indicative of an attack, and, on detection of data indicative of an attack, generating an alert signal.
9. Apparatus as claimed in claim 8 , wherein the intrusion detection sensor in use inspects the data traffic identified by spoofing replies to requests contained in the data traffic identified.
10. Apparatus as claimed in claim 8 , further comprising a router connected to the intrusion detection sensor for rerouting, in response to generation of the alert signal, any data traffic originating at the address assigned to the data processing system originating the data indicative of the attack to a disinfection address on the network.
11. Apparatus as claimed in claim 8 , wherein the intrusion detection sensor, on generation of the alert signal, sends an alert message to the disinfection address.
12. Apparatus as claimed in claim 11 , wherein the alert message comprises data indicative of the attack detected.
13. Apparatus as claimed in claim 12 , further comprising a disinfection server assigned to the disinfection address, the disinfection server sending, on receipt of the alert message, a warning message to the address assigned to the data processing system originating the data indicative of the attack.
14. Apparatus as claimed in claim 13 , wherein the warning message comprises program code for eliminating the attack when executed by the data processing system originating the data indicative of the attack.
15. A data communications network comprising: a plurality of addresses for assignment to data processing systems in the network; and, apparatus for detecting attacks on the network as claimed in claim 8 .
16. A computer program element comprising computer program code means which, when loaded in a processor of a data processing system, configures the processor to perform a method for detecting attacks on a data communications network as claimed in claim 1 .
17. A method as claimed in claim 1 , further comprising supporting an entity in the handling of the detected attack by one of providing instructions for use of, assistance in executing, and execution of disinfection program code.
18. A method as claimed in claim 1 , further comprising providing a report to said entity containing information related to one of alert, disinfection, rerouting, logging, discarding of data traffic in the context of a detected attack.
19. A method as claimed in claim 1 , further comprising billing said entity for the execution of at least one of the steps contained in claim 1 , the charge being billed preferably being determined in dependence of one of the size of the network, the number of unassigned addresses monitored, the number of assigned addresses monitored, the volume of data traffic inspected, the number of attacks identified, the number of alerts generated, the signature of the identified attack, the volume of rerouted data traffic, the degree of network security achieved, the turnover of said entity.
20. A method as claimed in claim 1 , further comprising providing said method for several entities and using technical data derived from the attack-handling for one of said entities for the attack-handling for another of said entities.
21. A method for deploying an intrusion detection application for an entity, comprising: connecting an intrusion detection sensor to a network used by said entity for identifying data traffic on the network originating at any assigned address and addressed to any unassigned address, said unassigned address is an address which is free and not assigned to user systems, and for inspecting any data traffic so identified for data indicative of an attack and for, on detection of data indicative of an attack, generating an alert signal,
connecting a router to said network for rerouting, in response to generation of the alert signal, any data traffic originating at the address assigned to the data processing system originating the data indicative of the attack to a disinfection address on the network.
22. A method according to claim 21 , further comprising
connecting a disinfection server assigned to the disinfection address, to the network, the disinfection server being adapted for sending, on receipt of the alert message, a warning message to the address assigned to the data processing system originating the data indicative of the attack.
23. A computer program product comprising a computer usable medium having computer readable program code means embodied therein for causing detection of attacks on a data communications network having a plurality of addresses for assignment to data processing systems in the network, the computer readable program code means in said computer program product comprising computer readable program code means for causing a computer to effect the functions of claim 1 .
24. A computer program product comprising a computer usable medium having computer readable program code means embodied therein for causing deployment of an intrusion detection application for an entity, the computer readable program code means in said computer program product comprising computer readable program code means for causing a computer to effect the functions of claim 21.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US12/128,834 US8261346B2 (en) | 2003-05-30 | 2008-05-29 | Detecting attacks on a data communication network |
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP03405393 | 2003-05-30 | ||
EP03405393.4 | 2003-05-30 | ||
PCT/IB2003/005328 WO2004107706A1 (en) | 2003-05-30 | 2003-11-20 | Detecting network attacks |
Publications (1)
Publication Number | Publication Date |
---|---|
US20070094722A1 true US20070094722A1 (en) | 2007-04-26 |
Family
ID=33484075
Family Applications (4)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/558,848 Abandoned US20070094722A1 (en) | 2003-05-30 | 2003-11-20 | Detecting networks attacks |
US10/558,853 Abandoned US20070094728A1 (en) | 2003-05-30 | 2003-11-24 | Attack signature generation |
US12/128,834 Expired - Fee Related US8261346B2 (en) | 2003-05-30 | 2008-05-29 | Detecting attacks on a data communication network |
US12/131,327 Abandoned US20080235799A1 (en) | 2003-05-30 | 2008-06-02 | Network Attack Signature Generation |
Family Applications After (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US10/558,853 Abandoned US20070094728A1 (en) | 2003-05-30 | 2003-11-24 | Attack signature generation |
US12/128,834 Expired - Fee Related US8261346B2 (en) | 2003-05-30 | 2008-05-29 | Detecting attacks on a data communication network |
US12/131,327 Abandoned US20080235799A1 (en) | 2003-05-30 | 2008-06-02 | Network Attack Signature Generation |
Country Status (7)
Country | Link |
---|---|
US (4) | US20070094722A1 (en) |
EP (2) | EP1629651A1 (en) |
KR (2) | KR100877664B1 (en) |
CN (2) | CN1771708A (en) |
AU (2) | AU2003280126A1 (en) |
TW (1) | TWI333613B (en) |
WO (2) | WO2004107706A1 (en) |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20160055334A1 (en) * | 2013-03-29 | 2016-02-25 | British Telecommunications Public Limited Company | Method and apparatus for detecting a multi-stage event |
US9870470B2 (en) | 2013-03-29 | 2018-01-16 | British Telecommunications Plc | Method and apparatus for detecting a multi-stage event |
US20190098051A1 (en) * | 2017-09-27 | 2019-03-28 | Cox Communications, Inc. | Systems and Methods of Virtual Honeypots |
US10735466B2 (en) | 2016-02-23 | 2020-08-04 | nChain Holdings Limited | Reactive and pre-emptive security system for the protection of computer networks and systems |
Families Citing this family (69)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP1629651A1 (en) * | 2003-05-30 | 2006-03-01 | International Business Machines Corporation | Detecting network attacks |
US7406714B1 (en) | 2003-07-01 | 2008-07-29 | Symantec Corporation | Computer code intrusion detection system based on acceptable retrievals |
US7568229B1 (en) | 2003-07-01 | 2009-07-28 | Symantec Corporation | Real-time training for a computer code intrusion detection system |
US8266177B1 (en) | 2004-03-16 | 2012-09-11 | Symantec Corporation | Empirical database access adjustment |
US7966658B2 (en) * | 2004-04-08 | 2011-06-21 | The Regents Of The University Of California | Detecting public network attacks using signatures and fast content analysis |
US7936682B2 (en) * | 2004-11-09 | 2011-05-03 | Cisco Technology, Inc. | Detecting malicious attacks using network behavior and header analysis |
US8010685B2 (en) * | 2004-11-09 | 2011-08-30 | Cisco Technology, Inc. | Method and apparatus for content classification |
KR100622670B1 (en) * | 2004-12-07 | 2006-09-19 | 한국전자통신연구원 | Real-time network attack pattern detection system for unknown network attack and method thereof |
US7765596B2 (en) * | 2005-02-09 | 2010-07-27 | Intrinsic Security, Inc. | Intrusion handling system and method for a packet network with dynamic network address utilization |
US7444331B1 (en) | 2005-03-02 | 2008-10-28 | Symantec Corporation | Detecting code injection attacks against databases |
US8095982B1 (en) | 2005-03-15 | 2012-01-10 | Mu Dynamics, Inc. | Analyzing the security of communication protocols and channels for a pass-through device |
US8095983B2 (en) * | 2005-03-15 | 2012-01-10 | Mu Dynamics, Inc. | Platform for analyzing the security of communication protocols and channels |
DE602006017668D1 (en) | 2005-03-24 | 2010-12-02 | Ibm | DETECTION OF NETWORK ATTACKS |
US8046374B1 (en) | 2005-05-06 | 2011-10-25 | Symantec Corporation | Automatic training of a database intrusion detection system |
US7558796B1 (en) | 2005-05-19 | 2009-07-07 | Symantec Corporation | Determining origins of queries for a database intrusion detection system |
US7774361B1 (en) * | 2005-07-08 | 2010-08-10 | Symantec Corporation | Effective aggregation and presentation of database intrusion incidents |
US7690037B1 (en) | 2005-07-13 | 2010-03-30 | Symantec Corporation | Filtering training data for machine learning |
US8161548B1 (en) | 2005-08-15 | 2012-04-17 | Trend Micro, Inc. | Malware detection using pattern classification |
US8769663B2 (en) | 2005-08-24 | 2014-07-01 | Fortinet, Inc. | Systems and methods for detecting undesirable network traffic content |
US7840958B1 (en) * | 2006-02-17 | 2010-11-23 | Trend Micro, Inc. | Preventing spyware installation |
CN101390369B (en) | 2006-02-28 | 2012-11-14 | 国际商业机器公司 | Detection and control of peer-to-peer communication |
US7540766B2 (en) * | 2006-06-14 | 2009-06-02 | Itron, Inc. | Printed circuit board connector for utility meters |
US7881209B2 (en) * | 2006-07-27 | 2011-02-01 | Cisco Technology, Inc. | Method and system for protecting communication networks from physically compromised communications |
KR100809416B1 (en) * | 2006-07-28 | 2008-03-05 | 한국전자통신연구원 | Appatus and method of automatically generating signatures at network security systems |
US7958230B2 (en) | 2008-09-19 | 2011-06-07 | Mu Dynamics, Inc. | Test driven deployment and monitoring of heterogeneous network systems |
US9172611B2 (en) * | 2006-09-01 | 2015-10-27 | Spirent Communications, Inc. | System and method for discovering assets and functional relationships in a network |
US8316447B2 (en) * | 2006-09-01 | 2012-11-20 | Mu Dynamics, Inc. | Reconfigurable message-delivery preconditions for delivering attacks to analyze the security of networked systems |
US7954161B1 (en) | 2007-06-08 | 2011-05-31 | Mu Dynamics, Inc. | Mechanism for characterizing soft failures in systems under attack |
US8510834B2 (en) * | 2006-10-09 | 2013-08-13 | Radware, Ltd. | Automatic signature propagation network |
US8065729B2 (en) | 2006-12-01 | 2011-11-22 | Electronics And Telecommunications Research Institute | Method and apparatus for generating network attack signature |
US8006078B2 (en) | 2007-04-13 | 2011-08-23 | Samsung Electronics Co., Ltd. | Central processing unit having branch instruction verification unit for secure program execution |
US20080274725A1 (en) * | 2007-05-02 | 2008-11-06 | Ury George Tkachenko | Wireless multifunction network device |
CN101384079A (en) | 2007-09-03 | 2009-03-11 | 华为技术有限公司 | Method, system and apparatus for preventing degraded attack when terminal moving |
US7774637B1 (en) | 2007-09-05 | 2010-08-10 | Mu Dynamics, Inc. | Meta-instrumentation for security analysis |
US8250658B2 (en) * | 2007-09-20 | 2012-08-21 | Mu Dynamics, Inc. | Syntax-based security analysis using dynamically generated test cases |
CN101222513B (en) * | 2008-01-28 | 2012-06-20 | 杭州华三通信技术有限公司 | Method and network appliance for preventing repeated address detection attack |
US8732296B1 (en) * | 2009-05-06 | 2014-05-20 | Mcafee, Inc. | System, method, and computer program product for redirecting IRC traffic identified utilizing a port-independent algorithm and controlling IRC based malware |
US8547974B1 (en) | 2010-05-05 | 2013-10-01 | Mu Dynamics | Generating communication protocol test cases based on network traffic |
US8463860B1 (en) | 2010-05-05 | 2013-06-11 | Spirent Communications, Inc. | Scenario based scale testing |
US9106514B1 (en) | 2010-12-30 | 2015-08-11 | Spirent Communications, Inc. | Hybrid network software provision |
US8464219B1 (en) | 2011-04-27 | 2013-06-11 | Spirent Communications, Inc. | Scalable control system for test execution and monitoring utilizing multiple processors |
US8621278B2 (en) | 2011-06-28 | 2013-12-31 | Kaspersky Lab, Zao | System and method for automated solution of functionality problems in computer systems |
NL2007180C2 (en) | 2011-07-26 | 2013-01-29 | Security Matters B V | Method and system for classifying a protocol message in a data communication network. |
US8776241B2 (en) | 2011-08-29 | 2014-07-08 | Kaspersky Lab Zao | Automatic analysis of security related incidents in computer networks |
US8972543B1 (en) | 2012-04-11 | 2015-03-03 | Spirent Communications, Inc. | Managing clients utilizing reverse transactions |
US9641542B2 (en) | 2014-07-21 | 2017-05-02 | Cisco Technology, Inc. | Dynamic tuning of attack detector performance |
US10356109B2 (en) * | 2014-07-21 | 2019-07-16 | Entit Software Llc | Security indicator linkage determination |
US9450972B2 (en) | 2014-07-23 | 2016-09-20 | Cisco Technology, Inc. | Network attack detection using combined probabilities |
US9407646B2 (en) | 2014-07-23 | 2016-08-02 | Cisco Technology, Inc. | Applying a mitigation specific attack detector using machine learning |
US20160164886A1 (en) | 2014-10-17 | 2016-06-09 | Computer Sciences Corporation | Systems and methods for threat analysis of computer data |
KR101631242B1 (en) * | 2015-01-27 | 2016-06-16 | 한국전자통신연구원 | Method and apparatus for automated identification of sifnature of malicious traffic signature using latent dirichlet allocation |
US9531750B2 (en) * | 2015-05-19 | 2016-12-27 | Ford Global Technologies, Llc | Spoofing detection |
US10609053B2 (en) | 2015-11-24 | 2020-03-31 | Intel Corporation | Suspicious network traffic identification method and apparatus |
KR20170060280A (en) * | 2015-11-24 | 2017-06-01 | 한국전자통신연구원 | Apparatus and method for automatically generating rules for malware detection |
US10432652B1 (en) | 2016-09-20 | 2019-10-01 | F5 Networks, Inc. | Methods for detecting and mitigating malicious network behavior and devices thereof |
US11611570B2 (en) * | 2016-12-30 | 2023-03-21 | British Telecommunications Public Limited Company | Attack signature generation |
EP3563543B1 (en) | 2016-12-30 | 2022-04-06 | British Telecommunications public limited company | Data breach detection |
WO2018122050A1 (en) * | 2016-12-30 | 2018-07-05 | British Telecommunications Public Limited Company | Historic data breach detection |
CN108076038A (en) * | 2017-06-16 | 2018-05-25 | 哈尔滨安天科技股份有限公司 | A kind of C&C servers determination methods and system based on Service-Port |
WO2019028293A1 (en) * | 2017-08-02 | 2019-02-07 | CipherTooth, Inc. | Detecting man in the middle attacks on a local area network |
US10812509B2 (en) * | 2017-10-30 | 2020-10-20 | Micro Focus Llc | Detecting anomolous network activity based on scheduled dark network addresses |
US10855701B2 (en) * | 2017-11-03 | 2020-12-01 | F5 Networks, Inc. | Methods and devices for automatically detecting attack signatures and generating attack signature identifications |
CN110557355B (en) * | 2018-05-31 | 2021-07-27 | 上海连尚网络科技有限公司 | Method and equipment for detecting man-in-the-middle attack through user equipment |
US11005868B2 (en) * | 2018-09-21 | 2021-05-11 | Mcafee, Llc | Methods, systems, and media for detecting anomalous network activity |
TWI707565B (en) * | 2019-04-19 | 2020-10-11 | 國立中央大學 | Network attacker identifying method and network system |
US11444961B2 (en) * | 2019-12-20 | 2022-09-13 | Intel Corporation | Active attack detection in autonomous vehicle networks |
US11483318B2 (en) | 2020-01-07 | 2022-10-25 | International Business Machines Corporation | Providing network security through autonomous simulated environments |
CN111507262B (en) * | 2020-04-17 | 2023-12-08 | 北京百度网讯科技有限公司 | Method and apparatus for detecting living body |
US11876834B1 (en) * | 2021-08-11 | 2024-01-16 | Rapid7, Inc. | Secure verification of detection rules on test sensors |
Citations (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5388229A (en) * | 1990-04-23 | 1995-02-07 | Matsushita Electric Industrial Co., Ltd. | Data transmission system which prefetches data to be transferred |
US20020086724A1 (en) * | 2000-11-15 | 2002-07-04 | Kazuhito Miyaki | Method of branching flow of game |
US20020105910A1 (en) * | 2000-08-29 | 2002-08-08 | Maher Robert Daniel | Content processor |
US20020156898A1 (en) * | 2001-04-11 | 2002-10-24 | Poirier Daniel Earl | Methods, systems and computer program products for communicating with unconfigured network devices on remote networks |
US6473405B2 (en) * | 1999-06-18 | 2002-10-29 | Digital Island, Inc. | On-demand overlay routing for computer-based communication networks |
US20040148521A1 (en) * | 2002-05-13 | 2004-07-29 | Sandia National Laboratories | Method and apparatus for invisible network responder |
US20050021740A1 (en) * | 2001-08-14 | 2005-01-27 | Bar Anat Bremler | Detecting and protecting against worm traffic on a network |
US7290283B2 (en) * | 2001-01-31 | 2007-10-30 | Lancope, Inc. | Network port profiling |
Family Cites Families (19)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5440723A (en) * | 1993-01-19 | 1995-08-08 | International Business Machines Corporation | Automatic immune system for computers and computer networks |
KR100331219B1 (en) * | 2000-02-10 | 2002-04-06 | 이상원 | Internet billing method and system |
GB2362076B (en) * | 2000-05-03 | 2002-08-14 | 3Com Corp | Detection of an attack such as a pre-attack on a computer network |
AU2001266174A1 (en) * | 2000-06-30 | 2002-01-14 | British Telecommunications Public Limited Company | Packet data communications |
US20020162017A1 (en) * | 2000-07-14 | 2002-10-31 | Stephen Sorkin | System and method for analyzing logfiles |
AU2001281150A1 (en) * | 2000-08-07 | 2002-02-18 | Xacct Technologies Limited | System, method and computer program product for processing network accounting information |
GB0022485D0 (en) * | 2000-09-13 | 2000-11-01 | Apl Financial Services Oversea | Monitoring network activity |
WO2003050644A2 (en) * | 2001-08-14 | 2003-06-19 | Riverhead Networks Inc. | Protecting against malicious traffic |
KR100351306B1 (en) * | 2001-01-19 | 2002-09-05 | 주식회사 정보보호기술 | Intrusion Detection System using the Multi-Intrusion Detection Model and Method thereof |
WO2002061510A2 (en) * | 2001-01-31 | 2002-08-08 | Lancope, Inc. | Network port profiling |
US20020116639A1 (en) * | 2001-02-21 | 2002-08-22 | International Business Machines Corporation | Method and apparatus for providing a business service for the detection, notification, and elimination of computer viruses |
WO2002071227A1 (en) * | 2001-03-01 | 2002-09-12 | Cyber Operations, Llc | System and method for anti-network terrorism |
US20020143963A1 (en) * | 2001-03-15 | 2002-10-03 | International Business Machines Corporation | Web server intrusion detection method and apparatus |
US7210168B2 (en) * | 2001-10-15 | 2007-04-24 | Mcafee, Inc. | Updating malware definition data for mobile data processing devices |
US7743415B2 (en) * | 2002-01-31 | 2010-06-22 | Riverbed Technology, Inc. | Denial of service attacks characterization |
US20040162994A1 (en) * | 2002-05-13 | 2004-08-19 | Sandia National Laboratories | Method and apparatus for configurable communication network defenses |
KR20020075319A (en) * | 2002-07-19 | 2002-10-04 | 주식회사 싸이버텍홀딩스 | Intelligent Security Engine and Intelligent and Integrated Security System Employing the Same |
US7017186B2 (en) * | 2002-07-30 | 2006-03-21 | Steelcloud, Inc. | Intrusion detection system using self-organizing clusters |
EP1629651A1 (en) * | 2003-05-30 | 2006-03-01 | International Business Machines Corporation | Detecting network attacks |
-
2003
- 2003-11-20 EP EP03772503A patent/EP1629651A1/en not_active Withdrawn
- 2003-11-20 CN CNA2003801103005A patent/CN1771708A/en active Pending
- 2003-11-20 AU AU2003280126A patent/AU2003280126A1/en not_active Abandoned
- 2003-11-20 KR KR1020057018428A patent/KR100877664B1/en not_active IP Right Cessation
- 2003-11-20 US US10/558,848 patent/US20070094722A1/en not_active Abandoned
- 2003-11-20 WO PCT/IB2003/005328 patent/WO2004107706A1/en active Application Filing
- 2003-11-24 US US10/558,853 patent/US20070094728A1/en not_active Abandoned
- 2003-11-24 EP EP03772560A patent/EP1629652A1/en not_active Withdrawn
- 2003-11-24 AU AU2003280190A patent/AU2003280190A1/en not_active Abandoned
- 2003-11-24 KR KR1020057018304A patent/KR100800370B1/en not_active IP Right Cessation
- 2003-11-24 WO PCT/IB2003/005453 patent/WO2004107707A1/en active Application Filing
- 2003-11-24 CN CN200380110301XA patent/CN1771709B/en not_active Expired - Fee Related
-
2004
- 2004-05-03 TW TW093112419A patent/TWI333613B/en not_active IP Right Cessation
-
2008
- 2008-05-29 US US12/128,834 patent/US8261346B2/en not_active Expired - Fee Related
- 2008-06-02 US US12/131,327 patent/US20080235799A1/en not_active Abandoned
Patent Citations (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5388229A (en) * | 1990-04-23 | 1995-02-07 | Matsushita Electric Industrial Co., Ltd. | Data transmission system which prefetches data to be transferred |
US6473405B2 (en) * | 1999-06-18 | 2002-10-29 | Digital Island, Inc. | On-demand overlay routing for computer-based communication networks |
US20020105910A1 (en) * | 2000-08-29 | 2002-08-08 | Maher Robert Daniel | Content processor |
US20020086724A1 (en) * | 2000-11-15 | 2002-07-04 | Kazuhito Miyaki | Method of branching flow of game |
US7290283B2 (en) * | 2001-01-31 | 2007-10-30 | Lancope, Inc. | Network port profiling |
US20020156898A1 (en) * | 2001-04-11 | 2002-10-24 | Poirier Daniel Earl | Methods, systems and computer program products for communicating with unconfigured network devices on remote networks |
US20050021740A1 (en) * | 2001-08-14 | 2005-01-27 | Bar Anat Bremler | Detecting and protecting against worm traffic on a network |
US20040148521A1 (en) * | 2002-05-13 | 2004-07-29 | Sandia National Laboratories | Method and apparatus for invisible network responder |
Cited By (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20160055334A1 (en) * | 2013-03-29 | 2016-02-25 | British Telecommunications Public Limited Company | Method and apparatus for detecting a multi-stage event |
US9836600B2 (en) * | 2013-03-29 | 2017-12-05 | British Telecommunications Plc | Method and apparatus for detecting a multi-stage event |
US9870470B2 (en) | 2013-03-29 | 2018-01-16 | British Telecommunications Plc | Method and apparatus for detecting a multi-stage event |
US10735466B2 (en) | 2016-02-23 | 2020-08-04 | nChain Holdings Limited | Reactive and pre-emptive security system for the protection of computer networks and systems |
US20190098051A1 (en) * | 2017-09-27 | 2019-03-28 | Cox Communications, Inc. | Systems and Methods of Virtual Honeypots |
Also Published As
Publication number | Publication date |
---|---|
WO2004107706A1 (en) | 2004-12-09 |
KR100877664B1 (en) | 2009-01-12 |
WO2004107707A1 (en) | 2004-12-09 |
US8261346B2 (en) | 2012-09-04 |
CN1771709B (en) | 2010-04-07 |
EP1629651A1 (en) | 2006-03-01 |
TW200428203A (en) | 2004-12-16 |
EP1629652A1 (en) | 2006-03-01 |
US20080235799A1 (en) | 2008-09-25 |
CN1771709A (en) | 2006-05-10 |
KR20060023952A (en) | 2006-03-15 |
US20090070870A1 (en) | 2009-03-12 |
US20070094728A1 (en) | 2007-04-26 |
TWI333613B (en) | 2010-11-21 |
AU2003280190A1 (en) | 2005-01-21 |
AU2003280126A1 (en) | 2005-01-21 |
KR100800370B1 (en) | 2008-02-04 |
CN1771708A (en) | 2006-05-10 |
KR20060013491A (en) | 2006-02-10 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US8261346B2 (en) | Detecting attacks on a data communication network | |
US9356947B2 (en) | Methods and systems for analyzing data related to possible online fraud | |
US7373666B2 (en) | Distributed threat management | |
US7870608B2 (en) | Early detection and monitoring of online fraud | |
US7992204B2 (en) | Enhanced responses to online fraud | |
US9203648B2 (en) | Online fraud solution | |
US7913302B2 (en) | Advanced responses to online fraud | |
US20070107053A1 (en) | Enhanced responses to online fraud | |
US20070299915A1 (en) | Customer-based detection of online fraud | |
JP4753264B2 (en) | Method, apparatus, and computer program for detecting network attacks (network attack detection) |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: INTERNATIONAL BUSINESS MACHINES CORPORATION, NEW Y Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:RIORDAN, JAMES F.;REEL/FRAME:018335/0690 Effective date: 20060113 |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |