Intrusion prevention system
View Patent ↗The invention provides a method and system for monitoring a computer network and determining whether the network faces a threat from users. In the event that the existence of a threat is determined, the system in accordance with the invention provides a real-time assessment of the threat to the network and responds to prevent damage to the network.
1. A method for detecting unauthorized intrusion in a computer network, comprising the steps of:
copying packets that are being transmitted in real-time over the computer network;
sorting the copied packets based on port type;
sending packets of a particular port type to one or more port modules, each port module being designed for processing packets of a single port type;
processing packets with each port module by reviewing and comparing information from various parts of each packet;
determining a presence and absence of port-specific activities based on each packet with each port module;
generating binary vectors representing the presence and absence of port-specific activities based on each packet with each port module;
assessing each binary vector and determining a level of expertise and deception for the port-specific activities represented by the binary vector with each port module;
outputting a behavioral rating from each port module in real-time based on the assessing and determining steps, the behavioral rating comprising at least two dimensions of deception and expertise.
2. The method of claim 1 , further comprising combining behavioral ratings from a plurality of port modules.
3. The method of claim 1 , further comprising determining if a threshold for a behavioral rating has been exceeded.
4. The method of claim 3 , wherein if the threshold for a behavioral rating has been exceeded, then blocking user activity.
5. The method of claim 3 , wherein if the threshold for a behavioral rating has been exceeded, then initiate a tracking of user activity.
6. The method of claim 1 , wherein outputting a behavioral rating in real-time based on the determining step further comprises outputting a behavioral rating comprising at least one of a persistence and accuracy dimension.
7. The method of claim 1 , further comprising mapping the behavioral rating on at least one two-dimensional grid.
8. The method of claim 1 , further comprising generating a profile a user based upon monitored behavioral measures.
9. The method of claim 1 , wherein the step of assessing each binary vector and determining a level of expertise and deception is carried out utilizing a back propagation network.
10. The method of claim 9 , wherein the back propagation network includes psychological assessment information.
11. The method of claim 1 , wherein the behavioral rating comprises one of high deception/high expertise, high deception/low expertise, low deception/high expertise and low deception/low expertise.
12. The method of claim 4 , wherein the blocking user activity comprises sending a blocking command to a firewall for blocking further network access.
13. The method of claim 4 , wherein blocking user activity comprises a loss of a connection between a user and the computer network and storage of all relevant session data up to the point of forced loss.
14. The method of claim 5 , wherein tracking of user activity comprises storing activity information in a database that may be used to provide evidence of an intruder's harmful intent activities.
15. A system for preventing unauthorized intrusion in a network system, comprising:
a traffic sorter for sorting copied packets based on port type;
an activity monitor operatively coupled to the traffic sorter, the activity monitor comprising a plurality of port modules, each port module being designed for processing packets of a single type and processing packets by reviewing and comparing information from various parts of each packet and determining a presence and absence of port-specific activities based on each packet, each port module outputting a behavioral rating in real-time based, the behavioral rating comprising at least two dimensions of deception and expertise;
an inter-port fusion module operatively coupled to the activity monitor for grouping behavioral ratings received from the port modules of the activity monitor; and
an outcome director operatively coupled to the inter-port fusion monitor that determines whether to block or track user activities based upon the behavioral ratings received from the inter-port fusion module.
16. The system of claim 15 , wherein each port module generates binary vectors representing the presence and absence of port-specific activities based on each packet.
17. The system of claim 16 , wherein each port module assesses each binary vector and determines a level of expertise and deception for the port-specific activities represented by the binary vector.