System and method for network intrusion prevention

[0001] 1. Field of the Invention

[0002] The present invention generally relates to computer networks. More specifically, the present invention relates to systems and methods for preventing unauthorized intrusions into computer networks.

[0003] 2. Description of the Prior Art

[0004] When a hacker, virus, or Internet worm is attempting to attack an Internet-connected network, the most common method that is used to gather data and identify potential targets is by scanning or sequentially connecting to Internet Protocol (IP) addresses to find weak systems to exploit. These attackers generally use automated scanning tools or probes to quickly survey thousands of Internet addresses without human intervention. Once they detect a vulnerable system that is not properly secured, it can then be penetrated and compromised, creating a slave machine available for the use of the hacker, worm, or virus. Recent global attacks by worms such as Nimda and Code Red have caused considerable damage to corporate networks, and raised awareness of this vulnerable area of the Internet.

[0005] There are several different methods and systems in the prior art that generally deal with computer network security. Several previously issued United States Patents generally dealing with computer network security are discussed here.

[0006] U.S. Pat. No. 5,944,823 issued to Jade discloses a firewall that allows an inside user or object to originate connection to an outside object or network, but does not allow for connections to be generated in the reverse direction. The disclosed invention provides a special tunneling mechanism, operating on both side of the firewall, for establishing such outside in connections when they are requested by certain trusted individuals or objects or applications outside the firewall. This previously issued United States patent discloses a firewall for protecting a computer network that allows trusted users to gain access to the computer network, but does not disclose a method or system that identifies unauthorized attempts to infiltrate a computer network and perform proactive counter measures against the unauthorized users attempting to infiltrate the computer network.

[0007] U.S. Pat. No. 6,088,796 issued to Cianfrocca discloses a secure access query system incorporating a messenger system. The system includes a communication server for receiving queries from a user and transmitting replies to the user, an application server for providing replies to queries, a network firewall for preventing unauthorized access to the application server and a messenger system, coupled to the communication server for receiving queries from the communication server, transmitting the query across the network firewall along a secure pathway established by the application server between the messenger system means and the application server, receiving replies from the application server along the secure pathway and transmitting the replies to the communication server. This previously issued United States patent discloses a firewall for protecting a computer network that allows communication across the firewall, but does not disclose a method or system that identifies unauthorized attempts to infiltrate a computer network and perform proactive counter measures against the unauthorized users attempting to infiltrate the computer network.

[0008] U.S. Pat. No. 6,205,551 issued to Grosse discloses a technique for determining whether particular clients within a computer network are universally configured in accordance with the desired network security features of the computer network. A probe is randomly inserted within incoming files at a firewall in the computer network. The probe is configured as a function of a particular execution task such as a virus. If the client is properly configured, the probe will not execute and the firewall does not detect a security breach. However, if the client is not properly configured, the probe will execute and trigger an alarm in the firewall indicating that the client is vulnerable to a security breach. This previously issued United States Patent discloses identifying communications that do not match the computer network's security parameters, but does not disclose how to proactively prevent further unauthorized communications from infiltrating the computer network.

[0009] U.S. Pat. No. 6,363,489 issued to Comay et al. discloses a method and system for providing security to a network by at least identifying an unauthorized user who is attempting to gain access to a node on the network, and preferably by then actively blocking that unauthorized user form further activities. Preferably, further access to the network is then blocked by diverting traffic from the unauthorized user to a secure zone, where the activities of the unauthorized user can be contained without damage to the network. This previously issued United States patent discloses a method and system for identifying and dealing with unauthorized users, but does not disclose how to proactively counter act unauthorized attempts to infiltrate a computer network.

[0010] U.S. Patent Application Publication US2002/0013910A1 discloses a protection system and methods providing protection for personal computers and/or other network accessible devices from undesirable or otherwise malicious operations. A protection engine embodiment provides, within a server, firewall or other suitable recommunicator, for monitoring information received by the communicator, determining whether received information does or is likely to include executable code, and if so, causes mobile protection code (MPC) to be transferred to and rendered operable within a destination device of the received information, more suitably by forming a protection agent including the MPC, protection policies and a detected-Downloadable. An MPC embodiment further provides, within a Downloadable destination, for initiating the Downloadable, enabling malicious Downloadable operation attempts to be received by the MPC, and causing corresponding operations to be executed in response to the attempts, more suitably in conjunction with protection policies. This previously issued United States patent discloses a method of identifying malicious attempts at infiltrating a network and responding to the attempts, but does not disclose proactive counter acts to slow or prevent further infiltration attempts.

[0011] The random nature of automated scanning probes creates an inherent weakness that allows them to be detected and trapped. It is estimated that most corporate Internet connections use only 25% of the IP addresses assigned to their physical Internet connection, so there is a significant probability that at some point a probe will attempt to access an unused IP address on a given network. Since there is no legitimate reason for a corporate user, web surfer, or business partner to be connecting to such an address, that access attempt can immediately be defined as hostile. Therefore, there is a need for a method and system for monitoring computer networks for scanning probes attempting to connect to unused IP addresses within the network and performing counter measures to present proactive obstacles to further scanning activities by an unauthorized user.

[0012] To fulfill the need for a method and system that monitors computer networks for scanning probes attempting to connect to unused IP addresses of a computer network while performing proactive counter measures to present obstacles to further scanning activities by unauthorized users, a method and system for network intrusion prevention is provided.

[0013] It is an object of the claimed invention to provide a method of monitoring address resolution protocol packet communications between computers on a local network, and network border routers to identify address resolution protocol packet communications addressed to unused IP addresses within the computer system.

[0014] It is a further object of the claimed invention to provide a method and system that creates virtual machines associated with unused IP addresses within a network to provoke further communications from an automated scanning probe.

[0015] It is an even further object of the claimed invention to provide a method and system that records IP addresses of entities attempting to infiltrate a computer network by monitoring communication attempts with unused IP addresses within a computer network.

[0016] It is a yet a further object of the claimed invention to provide a method and system that proactively presents obstacles to automated scanning probes to hinder further scanning of other local IP addresses.

[0017] The method of preventing unauthorized intrusions into a local computer network comprises monitoring local network computer responses to address resolution protocol requests initiated by communication from other Internet protocol addresses, either through a border router or local to the network. If a local computer sends an address resolution protocol acknowledgement in response to an address resolution protocol request, the Internet protocol address queried has its status recorded as being an occupied local Internet protocol address. If a local Internet protocol address does not send an address resolution protocol acknowledgement, the method virtually occupies an unused Internet protocol address after a predetermined number of address resolution protocol requests go unanswered. The method then records the status of the unused Internet protocol address queried as containing a virtually occupied Internet protocol address.

[0018] An address resolution protocol acknowledgement is created and sent by the method in response to the address resolution protocol request when an occupied Internet protocol address does not respond. This address resolution protocol acknowledgement creates the illusion that the Internet protocol address queried is occupied. The Internet protocol address sending the address resolution protocol request then forwards or sends the communications that initiated the address resolution protocol exchange. The Internet protocol address listed as the source of the communication is then recorded as a local violator.

[0019] Internet protocol communications are monitored to determine whether the communications are addressed to an occupied local Internet protocol address or a virtually occupied unused local Internet protocol address. Internet protocol addresses are checked against the local violator list. If the Internet protocol address is not recorded as a local violator, communications between that Internet protocol address and occupied local Internet protocol addresses are allowed. Further communications sent to virtually occupied unused local Internet protocol addresses or from a local violator initiates counter measures against the Internet protocol address sending the communication.

[0020] The method and system is capable of initiating three types of counter measures. A first counter measure simply breaks the connection between an Internet protocol address attempting to connect to the network by sending a first reset packet to the communication's destination Internet protocol address and a second reset packet to the source Internet protocol address. A second counter measure comprises completing the establishment of a connection between a violator Internet protocol address and a virtually occupied unused local Internet protocol address and then ignoring all further communications sent from the violator Internet protocol address thus slowing down automated scanning by a probe. A third counter measure comprises completing the establishment of a connection between a violator Internet protocol address and the virtually occupied unused local Internet protocol address, forcing the connection into a persist state by setting the Transmission Control Protocol receive window size to zero bytes, and intermittently acknowledging the receipt of Transmission Control Protocol receive window probes from the violator Internet protocol address thus capturing the probe until it is manually disconnected at the source of the violator Internet protocol address.

[0021] The method may further comprise encrypting the sequence number within an initial Internet protocol packet request to create the initial sequence number of the virtually occupied unused local Internet protocol address thus eliminating the need to locally track information on connections to virtually occupied unused Internet protocol addresses while maintaining verification of connections.

[0022] The claimed invention also provides a system for protecting a computer network against unauthorized users probing the network for unused Internet protocol addresses to exploit. The system generally comprises a monitoring means, recording means, and a communication means. The parameters of the protection system are accessed from a central location via a secured Internet website.

[0023] The monitoring means of the system monitors address resolution protocol packets sent locally in response to communications from Internet protocol addresses to local Internet protocol addresses.

[0024] The system has recording means that records Internet protocol addresses attempting to send communications to unused local Internet protocol addresses when the monitoring means monitors a predetermined number of unanswered address resolution protocol packets have been sent in response to communication attempts by Internet protocol addresses.

[0025] The system has communication means to communicate with Internet protocol addresses performing counter measures against recorded Internet protocol addresses. The communication means is capable of sending a partially encrypted transmission control protocol packet in response to transmission control protocol packets sent from Internet protocol addresses directed toward unused local Internet protocol addresses. To delay automated probes from scanning Internet protocol addresses, the communication means is capable of establishing a connection with Internet protocol addresses attempting to send communications to unused local Internet protocol addresses and ignoring further communications slowing the progress of automated probes. The communication means is also capable of sending reset communications to local Internet protocol addresses and Internet protocol addresses attempting to send communications to unused local Internet protocol addresses breaking the connection with the computer network. The communication means is further capable of sending a transmission control protocol packet setting a receive window of zero byte size and responding to transmission control protocol window probes from Internet protocol addresses by sending transmission control protocol packets maintaining a receive windows of zero byte size.

[0026] FIG. 1. FIG. 1 is a diagram of a computer network having a system of the claimed invention.

[0027] FIG. 2. FIG. 2 is a flow chart of an exemplary method and system where an inbound data packet is acted upon according to a server response to an ARP.

[0028] FIG. 3. FIG. 3 is a continuation of the flow chart in FIG. 2 where the inbound data packet is acted upon according to the violator list.

[0029] FIG. 4. FIG. 4 is a continuation of the flow chart in FIG. 3 where the violator list is sent to a central location for compilation with violator lists of other systems of the claimed invention.

[0030] The claimed invention is a method and system for preventing unauthorized intrusions into local computer networks by creating virtual machines to occupy unused Internet protocol (IP) addresses within the local computer network and then performing counter measures against unauthorized users who probe local computer network IP addresses as a means of finding network vulnerabilities.

[0031] Unauthorized users are detected by monitoring the communications between a border router (or other local computer) and a local IP address initiated by a communication attempt directed at that local IP address to determine whether the communication is directed toward a used IP address associated with a real machine or computer in the network or toward an unused IP address within the network. Once the unauthorized communication has been identified as being directed toward an unused IP address, counter measures are used to end connection attempts, slow automated scanning rates, and capture scanning probes.

[0032] The principles and operation of the method and system according to the claimed invention may be better understood with reference to the drawings and the accompanying description, it being understood that these drawings are given for illustrative purposes only and are not meant to be limiting. Although the following detailed description centers upon a packet-switched network, in which communication is performed and data is transmitted in the form of packets, it is understood that this is for the purposes of description only, and is without any intention of being limiting, as the claimed invention is also operable with other types of networks.

[0033] The inventor of the claimed invention made available to the public an open-source network security application and system called LaBrea that performed several of the functions of the claimed invention. The open-source LaBrea system monitored only unused IP addresses in a computer network for connection attempts by sources outside of the computer network. The claimed invention provides a method and system that improves upon the open-source LaBrea system by dynamically building a status listing of all the IP addresses within the computer network that the system is configured to monitor and then dynamically generating a Bad Guy or violator list of IP addresses that attempt to connect to unused IP addresses within the computer network. This detailed description describes how the improved LaBrea method and system functions.

[0034] FIG. 1 is a diagram of a computer network 2 having an improved LaBrea system unit 4 of the claimed invention situated between a network firewall 6 and a network border router 8 of the computer network 2. Each LaBrea system unit 4 is essentially a personal computer having a network interface card connected to the computer network 2. The improved LaBrea software program is loaded onto the personal computer and the network interface card is placed into what is known as promiscuous mode, which enables the LaBrea system unit 4 to monitor all data packets 10 being transferred through the network connection where the system 4 is connected. The LaBrea system units 4 do not have local user interfaces. The parameters of the LaBrea system 4 are configurable via a website that allows users of the LaBrea system 4 to configure the settings of the LaBrea system 4 to fit their particular needs.

[0035] Computers communicate over a network link by way of several established protocols containing packets of data arranged in standard defined positions. Different types of protocols have been developed to perform different tasks in order to minimize unneeded information transfers. Several of these protocols are commonly arranged together so that computers of different types in different networks can effectively communicate with one another over the Internet. In order for these protocols to interact with one another, an Address Resolution Protocol (ARP) has been developed to resolve how sources and destinations are specified between higher level, distance-spanning protocols such as the Internet Protocol (IP) and lower level, local-communication protocols such as the Ethernet Protocol. The claimed invention monitors ARP packet activity to discover unused IP addresses within computer networks 2 and use connection attempts against those addresses to build a list of unauthorized violators.

[0036] FIG. 2 is a flow chart of an exemplary method the system performs in monitoring ARP communications between a server and a border router or other local computer on the local computer network. An inbound data packet 10 created by an external network IP address or a local IP address attempts to communicate with a local IP address within the computer network. The border router or local computer generates an ARP packet 20 to find the IP address that the packet targets. If a computer at the target IP address responds to the ARP packet 30, the border router forwards 40 the inbound data packet 10 to the IP address that is occupied with a real machine of the computer network 2. The system 4, which monitors all of this traffic, then records the status of the IP address associated with the real machine as being real or occupied 50.

[0037] If a computer at the target IP address does not respond to the ARP packet, the method and system of the claimed invention sends a forged ARP response 60, which creates the appearance that a real machine is associated with the previously unused IP address. The system then records the status of the unused IP address as virtually occupied 70.

[0038] FIG. 3 is a continuation of the flow chart of FIG. 2. Subsequent inbound Internet Protocol (IP) packets 80 are monitored to determine whether the source IP address of the inbound packet 80 is recorded as a bad guy or violator on the bad guy list 90. If the IP address of the inbound packet is recorded on the bad guy list and the target IP address is the IP address of a real machine 100, the system performs counter measure 110.

[0039] If the source IP address is not listed on the bad guy list and the target IP address is real 140, no action is taken 150 by the system and the inbound packet communication 80 is allowed to interface with the target IP address.

[0040] If the source IP address is not on the bad guy list and the target IP address is virtually occupied by the method and system, the source IP is added to the bad guy list 160 if the source IP address is not listed on an override table 170 maintained by the user of the method and system 4. The system 4 then performs one of three counter measures 110, 120, 130 depending upon the user settings of the system 4.

[0041] The system and method provides three proactive counter measures 110, 120, 130 to prevent unauthorized users from connecting to IP addresses associated with real computers or to slow or capture an unauthorized users' automated scan of a computer network containing unused IP addresses.

[0042] A first counter measure 110 of the method and system is sending a reset signal to the local computer and to the source IP address of the inbound packet 80 to terminate the connection 180 between the source IP address and the computer network. This method is used to block connections to real or occupied IP addresses, and can be used to provide false information to scans of unused IP addresses. All further counter measures of the method and system 4 are used exclusively against connection attempts targeting unused IP addresses.

[0043] A second counter measure 120 of the method and system is sending an acknowledgement packet in response to the inbound connection initiation packet 10 and then ignoring further packets 80 from the source IP address 190. The source IP address will then attempt to send further communications to the virtually occupied IP address thus slowing the source IP address scanning progress.

[0044] A third counter measure 130 of the method and system is what is known as persist capture mode. The persist capture mode completes the establishment of a connection between a violator and a local virtually occupied IP address, and then sends a transmission control protocol (TCP) packet which sets a TCP receive window of zero byte size to the source IP address 200. The source IP address will then shift into persist mode and send, at predetermined intervals, a TCP receive window probe, requesting authorization to continue sending data. These window probes are acknowledged by the method and system 4 by sending additional TCP packets maintaining a TCP receive window of zero byte size. Since the TCP receive window set by the virtually occupied IP address is of zero byte size, the source IP address will continue to wait for the virtually occupied IP address to authorize communications by increasing the window size to allow data to be transferred. Because the virtually occupied IP address only sends further TCP receive window communications of zero byte size to the source IP address to maintain the source IP address in the persist state, the automated scan is effectively trapped until a manual termination of the connection is performed.

[0045] FIG. 4 is a continuation of the flow chart in FIG. 3 where the violator list 210 is sent to a central location 220 for compilation with violator lists of other systems of the claimed invention. Each local LaBrea Unit 4 is capable of compressing and encrypting the local computer network bad guy list 230 for transmission to a central receiving point via the Internet. The bad guy lists from each of the LaBrea system 4 are then aggregated 240 to form a global bad guy list 250 to be transmitted 260 back to each individual LaBrea system 4 via the Internet. This global bad guy or violator list 250 is then integrated 270 into each individual LaBrea system's 4 local bad guy or violator list 210. The global bad guy or violator list 250 may also be used to generate Internet service provider alerts and customer reports 280 regarding IP addresses placed on the global bad guy or violator list 250.

[0046] Although the invention has been described by reference to some embodiments it is not intended that the novel device be limited thereby, but that modifications thereof are intended to be included as falling within the broad scope and spirit of the foregoing disclosure, the following claims and the appended drawings.