Method and apparatus for security management via vicarious network devices
View Patent ↗In one embodiment of a method and apparatus for protecting data, voice, and video networks from individuals with malicious intent, a real network or network device has a vicarious simulated counterpart that may take the place of the real device or network upon appropriate triggering. The simulated counterpart behaves like the real device, but records the suspect transactions. The integrity of the real network or device is therefore continuously maintained because the suspect is isolated from the real network and the suspect transactions are not passed on to the actual device or network. The recorded transactions may then be analyzed for purposes of exposing the perpetrator, discovering perpetrator behavior patterns, and identifying device or network security weaknesses.
1. An apparatus for security management in a data, voice, or video network comprising, in combination:
at least one vicarious device capable of automatically simulating at least one corresponding real device or transmission medium in said network, wherein said at least one vicarious device is derived from a device dataset containing one or more variables having one or more instance values describing the behavior of said corresponding real device or transmission medium over time, wherein said device dataset contains only those variables and instance values actually used when said corresponding real device or transmission medium is under attack;
at least one monitor for detecting when said network may be being attacked; and
at least one trigger for substituting at least one of said vicarious devices for said corresponding real device or transmission medium.
2. The apparatus of claim 1 , wherein said monitor and said trigger are part of a control agent.
3. The apparatus of claim 1 , wherein said at least one vicarious device stores at least some received data into a perpetrator file.
4. The apparatus of claim 3 , further comprising an analysis agent for analyzing said stored data.
5. The apparatus of claim 4 , wherein said analysis agent looks for information useful in determining one or more sources of the attack.
6. The apparatus of claim 4 , wherein said analysis agent looks for information useful in determining one or mechanisms used in the attack.
7. The apparatus of claim 1 , wherein all traffic to said corresponding real device or transmission medium is diverted to said vicarious device.
8. The apparatus of claim 7 , further comprising a buffer to retain said traffic while said at least one vicarious device is in operation and wherein said buffered traffic is sent from said buffer to said corresponding real device or transmission medium when said corresponding real device or transmission medium is returned to operation.
9. The apparatus of claim 7 , further comprising a mechanism to signal upstream devices to re-send said traffic when said corresponding real device or transmission medium is returned to operation.
10. The apparatus of claim 1 , wherein only suspect traffic is diverted to said at least one vicarious device.
11. The apparatus of claim 10 , wherein suspect traffic is further defined as traffic falling into one or more specific traffic categories.
12. The apparatus of claim 1 , wherein said at least one vicarious device is derived from, in combination:
the device dataset; and
a characterization file created from said device dataset based on correlations among said variables and said instance values and used to generate one or more predicted instance values for said at least one vicarious device.
13. The apparatus of claim 1 , wherein said at least one vicarious device and said corresponding real device or transmission medium are integrated with a management system.
14. The apparatus of claim 1 , wherein said at least one vicarious device queries said corresponding real device or transmission medium for at least one actual device value or response for use in providing at least one value or response from said at least one vicarious device.
15. The apparatus of claim 1 , wherein at least one command is sent to said corresponding real device or transmission medium from said at least one vicarious device.
16. The apparatus of claim 15 , further comprising a trusted device that relays said at least one command from said at least one vicarious device to said corresponding real device or transmission medium.
17. A method for security management in a data, voice, or video network comprising the steps, in combination, of:
detecting when said network is being attacked; and
substituting at least one vicarious device for at least one corresponding real device in said network, the at least one vicarious device automatically simulating said at least one corresponding real device in said network, wherein said at least one vicarious device is derived from a device dataset containing one or more variables having one or more instance values describing the behavior of said corresponding real device or transmission medium over time, wherein said device dataset contains only those variables and instance values actually used when said corresponding real device or transmission medium is under attack.
18. The method of claim 17 , further comprising the step of storing at least some data received by said at least one vicarious device.
19. The method of claim 18 , further comprising the step of examining said stored data.
20. The method of claim 19 , wherein said stored data is analyzed for information useful in identifying at least one source for the attack.
21. The method of claim 19 , wherein said stored data is analyzed for information useful in identifying at least one mechanism used in the attack.
22. The apparatus of claim 17 , wherein all traffic to said at least one corresponding real device is diverted to said at least one vicarious device.
23. The apparatus of claim 22 , further comprising the steps, in combination, of:
buffering said traffic while said at least one vicarious device is in operation; and
sending said buffered traffic to said corresponding real device or transmission medium when said corresponding real device or transmission medium is returned to operation.
24. The apparatus of claim 22 , further comprising the step of signaling upstream devices to re-send said traffic when said corresponding real device or transmission medium is returned to operation.
25. The apparatus of claim 17 , wherein only suspect traffic is diverted to said at least one vicarious device.
26. The apparatus of claim 25 , further comprising the step of defining suspect traffic as traffic falling into at least one specific traffic category.
27. The apparatus of claim 17 , further comprising the step of integrating said at least one vicarious device and said corresponding real device or transmission medium with a management system.
28. The apparatus of claim 17 , further comprising the steps, in combination, of:
sending at least one query from said simulated device to said corresponding real device or transmission medium to obtain at least one actual device value or response; and
using at least one of said actual device values or responses to provide at least one value or response from said at least one vicarious device.
29. The apparatus of claim 17 , further comprising the step of sending at least one command from said at least one vicarious device to said corresponding real device or transmission medium.
30. The apparatus of claim 29 , further comprising the step of relaying said at least one command via a trusted device.
31. A method for creating a simulator suitable for use in network security management comprising the steps, in combination, of:
creating a full simulated version of a real device, said simulated device having a dataset containing data values corresponding to attributes of the real device;
running the simulated device under simulated attack conditions;
capturing the simulated device's activity;
determining which attributes were used;
eliminating data values corresponding to unused attributes from the simulated device dataset to create a reduced dataset containing only data values corresponding to used attributes; and
creating a new simulated device having the reduced dataset.
32. The method of claim 31 , wherein said step of capturing is performed by a management system.
33. The method of claim 31 , wherein said step of capturing is performed by capturing management packets with a network analyzer.