Deterring network incursion
View Patent ↗A system, method, and computer-readable medium for deterring network incursion by formulating appropriate responses to attacks. Once an attack is detected, the system may respond in such a manner as to imitate a network device. The system may respond in a manner that provides a high cost to pursue further communication with the system. For example, the system may respond to TCP syn requests and window probes with messages indicating small packet and window sizes. As such, attempts to send packets to the system have a high network and processing cost. An attacking computer running multiple threads may ultimately slow or be disabled as a result of the receiving the responses and attempting to continue to communicate with the system.
1. A computer-implemented method comprising: determining whether a source address for a first packet sent by the source address to a destination address qualifies as a threat, and when the source address qualifies as the threat, determining whether the destination address is synthetic; examining the first packet; determining a response to the first packet based upon the examining and based upon whether the source address qualifies as the threat; when the destination address is determined to be not synthetic and the source address is the threat, determining whether the source address is on a local network; when the source address is determined to be on a local network and the source address qualifies as the threat, determining that the response comprises creating a synthetic hardware address, and performing for each respective device of a plurality of devices on the local network: selecting the respective device, creating an address control protocol message comprising the synthetic hardware address as a message source address, inserting a corresponding hardware address for the respective device in the address control protocol message as a message destination hardware address, and sending the address control protocol message.
2. The method of claim 1 further comprising:
when the destination address is determined to be synthetic,
determining the response to be dropping the first packet.
3. The method of claim 2 further comprising:
dropping the first packet.
4. The method of claim 1 further comprising: when the source address is determined to be not on the local network and the source address is the threat, determining that the response is to perform for each respective device of a plurality of devices on the local network: selecting the respective device, creating a respective synthetic hardware address for the respective device, creating an address control protocol message comprising the respective synthetic hardware address as a message source address, inserting a corresponding hardware address for a gateway communicating on behalf of the source address in the address control protocol message as a message destination hardware address, and sending the address control protocol message.
5. The method of claim 4 further comprising:
performing the response.
6. The method of claim 4 wherein
the creating the respective synthetic hardware address for the respective device comprises ensuring that the respective synthetic hardware address is not in use on the local network.
7. The method of claim 4 further comprising:
inserting a corresponding logical address for the gateway in the address control protocol message as a message destination logical address.
8. The method of claim 4 wherein
the gateway inserts an entry into an address resolution protocol table in response to receiving the address resolution protocol message, wherein
the entry comprises
the respective synthetic hardware address for the respective device.
9. The method of claim 1 further comprising: performing the response.
10. The method of claim 1 wherein the creating the synthetic hardware address comprises ensuring that the synthetic hardware address is not in use on the local network.
11. The method of claim 1 further comprising: inserting a corresponding logical address for the respective device in the address control protocol message as a message destination logical address.
12. The method of claim 1 wherein the respective device inserts an entry into an address resolution protocol table in response to receiving the address resolution protocol message, wherein the entry comprises the synthetic hardware address as a source hardware address for the source address.
13. The method of claim 1 further comprising: when the source address is determined to be on the local network and the source address qualifies as the threat, determining that the response is to perform for each respective device of a plurality of devices on the local network: selecting the respective device, creating a respective synthetic hardware address for the respective device, creating an address control protocol message comprising the respective synthetic hardware address as a message source address, inserting a corresponding hardware address for a gateway communicating on behalf of the source address in the address control protocol message as a message destination hardware address, and sending the address control protocol message.
14. The method of claim 13 further comprising:
performing the response.
15. The method of claim 13 wherein
the creating the respective synthetic hardware address for the respective device comprises
ensuring that the respective synthetic hardware address is not in use on the local network.
16. The method of claim 13 further comprising:
inserting a corresponding logical address for the source address in the address control protocol message as a message destination logical address.
17. The method of claim 13 wherein
the source address inserts an entry into an address resolution protocol table in response to receiving the address resolution protocol message, wherein
the entry comprises
the respective synthetic hardware address for the respective device.
18. The method of claim 1 further comprising:
when the source address fails to qualify as the threat,
determining whether the destination address qualifies as a second threat.
19. The method of claim 18 further comprising:
when the destination address qualifies as the second threat,
determining whether the destination address comprises a synthetic hardware address, and
when the destination address is a synthetic hardware address, determining the response to be dropping the first packet.
20. The method of claim 19 further comprising:
dropping the first packet.
21. The method of claim 18 further comprising:
when the destination address fails to qualify as the second threat,
determining whether the destination address is a synthetic hardware address, and
when the destination address is the synthetic hardware address, determining the response to comprise
modifying the first packet by replacing the destination address with a hardware address for a device at the destination address; and
sending the first packet.
22. The method of claim 21 further comprising:
performing the response.
23. The method of claim 1 further comprising:
when the source address qualifies as the threat,
determining a packet type of the first packet.
24. The method of claim 23 further comprising:
when the packet type of the first packet is an address resolution protocol request,
determining that the response comprises
creating a reply comprising the destination address as a reply source address, and sending the reply to the source address.
25. The method of claim 23 further comprising:
when the packet type of the first packet is an internet common message protocol echo request, determining that the response comprises
creating a reply to indicate that the destination address is active; and
sending the reply to the source address.
26. The method of claim 23 further comprising:
when the packet type of the first packet is transmission control protocol,
determining whether the first packet is a transmission control protocol syn request;
when the first packet is the transmission control protocol syn request,
determining that the response comprises
creating a transmission control protocol syn response indicating that the source address must receive an acknowledgement for each subsequent packet before the source address can transmit another subsequent packet; and
sending the transmission control protocol syn response to the source address.
27. The method of claim 23 further comprising:
when the packet type of the first packet is transmission control protocol,
determining whether the first packet is a transmission control protocol syn request;
when the first packet is the transmission control protocol syn request,
determining that the response comprises
creating a transmission control protocol syn response comprising a payload; and
sending the transmission control protocol syn response to the source address.
28. The method of claim 27 wherein
a size of the payload is smaller than a maximum size permitted by a network by which the first packet was transmitted.
29. The method of claim 23 further comprising:
when the packet type of the first packet is transmission control protocol,
determining whether the first packet is a transmission control protocol window probe; and
when the first packet is the transmission control protocol window probe,
determining that the response comprises
creating a transmission control protocol window probe response comprising a transmission control protocol window size of zero, and
sending the transmission control protocol window probe response to the source address.
30. The method of claim 23 further comprising:
when the packet type of the first packet is transmission control protocol,
determining whether the first packet is a transmission control protocol window probe;
when the first packet is the transmission control protocol window probe,
determining that the response comprises
creating a transmission control protocol syn response comprising a payload; and
sending the transmission control protocol syn response to the source address.
31. The method of claim 30 wherein
a size of the payload is smaller than a maximum size permitted by a network by which the first packet was transmitted.
32. The method of claim 23 further comprising:
when the packet type of the first packet is transmission control protocol,
determining whether the first packet is a transmission control protocol acknowledgement; and
when the first packet is the transmission control protocol acknowledgement, determining that the response comprises
ignoring the first packet.
33. The method of claim 23 further comprising:
performing the response.
34. The method of claim 1 wherein
the source address comprises at least one of a logical address and a physical address.
35. The method of claim 1 wherein
the destination address comprises a logical address.
36. The method of claim 1 wherein
the examining the first packet comprises examining a header for the first packet.
37. The method of claim 1 wherein
the examining the first packet does not comprise examining a payload for the first packet.
38. A system comprising: tangible computer readable medium with logic instruction means executable by a computer processor including: threat-determining means for determining whether a source address for a first packet sent by the source address to a destination address qualifies as a threat; synthetic-address-determining means for determining whether the destination address is synthetic; examining means for examining the first packet; and response-determining means for determining a response to the first packet based upon the examining and based upon whether the source address qualifies as the threat; location-determining means for determining whether the source address is on a local network; wherein when the location-determining means determine that the source address is on the local network and the source address qualifies as the threat, the response-determining means are configured to determine that the response is to create a synthetic hardware address, and perform for each respective device of a plurality of devices on the local network: select the respective device, create an address control protocol message comprising the synthetic hardware address as a message source address, insert a corresponding hardware address for the respective device in the address control protocol message as a message destination hardware address, and send the address control protocol message.
39. The system of claim 38 wherein:
the response-determining means determine the response to be dropping the first packet when the destination address is synthetic and the source address qualifies as the threat.
40. The system of claim 39 further comprising:
dropping means for dropping the first packet.
41. The system of claim 38 wherein when the location-determining means determine that the source address is not on the local network and the source address qualifies as the threat, the response-determining means are configured to determine that the response is to perform for each respective device of a plurality of devices on the local network: select the respective device, create a respective synthetic hardware address for the respective device, create an address control protocol message comprising the respective synthetic hardware address as a message source address, insert a corresponding hardware address for a gateway communicating on behalf of the source address in the address control protocol message as a message destination hardware address, and send the address control protocol message.
42. The system of claim 38 wherein when the location-determining means determine that the source address is on the local network and the source address qualifies as the threat, the response-determining means are configured to determine that the response is to perform for each respective device of a plurality of devices on the local network: select the respective device, create a respective synthetic hardware address for the respective device, create an address control protocol message comprising the respective synthetic hardware address as a message source address, insert the source address in the address control protocol message as a message destination hardware address, and send the address control protocol message.
43. The system of claim 38 further comprising:
second threat-determining means for determining whether the destination address qualifies as a second threat.
44. The system of claim 43 further comprising:
second synthetic-address-determining means for determining whether the destination address is a synthetic hardware address.
45. The system of claim 44 , wherein
when the second synthetic-address-determining means determine that the destination address is
the synthetic hardware address,
the response-determining means are configured to determine that the response comprises
modifying the first packet by replacing the destination address with a hardware address for a device at the destination address, and
sending the first packet.
46. The system of claim 38 further comprising:
packet-type-determining means for determining a packet type of the first packet.
47. The system of claim 46 wherein
when the packet-type-determining means determine that the packet type of the first packet is an address resolution protocol request,
the response-determining means are configured to determine that the response comprises
creating a reply comprising the destination address as a reply source address, and
sending the reply to the source address.
48. The system of claim 38 further comprising:
performing means for performing the response.
49. A system comprising: tangible computer readable medium with logic instruction means executable by a computer processor including: a threat-determining module configured to determine whether a source address for a first packet sent by the source address to a destination address qualifies as a threat; a packet-type-determining module configured to determine a packet type of the first packet; an examining module configured to examine the first packet; and a response-determining module configured to determine a response to the first packet based upon the examining and based upon whether the source address qualifies as the threat; and a location-determining module configured to determine whether the source address is on a local network; wherein when the location-determining module determines that the source address is on the local network and the source address qualifies as the threat, the response-determining means are configured to determine that the response is to create a synthetic hardware address, and perform for each respective device of a plurality of devices on the local network: select the respective device, create an address control protocol message comprising the synthetic hardware address as a message source address, insert a corresponding hardware address for the respective device in the address control protocol message as a message destination hardware address, and send the address control protocol message.
50. The system of claim 49 further comprising:
a synthetic-address-determining module configured to determine whether the destination address is synthetic.
51. The system of claim 50 wherein:
the response-determining module determines the response to be dropping the first packet when the destination address is synthetic and the source address qualifies as the threat.
52. The system of claim 51 further comprising:
a dropping module configured to drop the first packet.
53. The system of claim 49 wherein when the location-determining module determines that the source address is not on the local network and the source address qualifies as the threat, the response-determining module is configured to determine that the response is to perform for each respective device of a plurality of devices on the local network: select the respective device, create a respective synthetic hardware address for the respective device, create an address control protocol message comprising the respective synthetic hardware address as a message source address, insert a corresponding hardware address for a gateway communicating on behalf of the source address in the address control protocol message as a message destination hardware address, and send the address control protocol message.
54. The system of claim 49 wherein when the location-determining module determines that the source address is on the local network and the source address qualifies as the threat, the response-determining module is configured to determine that the response is to perform for each respective device of a plurality of devices on the local network: select the respective device, create a respective synthetic hardware address for the respective device, create an address control protocol message comprising the respective synthetic hardware address as a message source address, insert the source address in the address control protocol message as a message destination hardware address; and send the address control protocol message.
55. The system of claim 49 further comprising:
a second threat-determining module configured to determine whether the destination address qualifies as a second threat.
56. The system of claim 49 further comprising:
a second synthetic-address-determining module configured to determine whether the destination address is a synthetic hardware address.
57. The system of claim 56 , wherein
when the second synthetic-address-determining module determines that the destination address is the synthetic hardware address,
the response-determining module is configured to determine that the response comprises
modifying the first packet by replacing the destination address with a hardware address for a device at the destination address, and
sending the first packet.
58. The system of claim 49 wherein
when the packet-type-determining module determines that the packet type of the first packet is an address resolution protocol request,
the response-determining module is configured to determine that the response comprises
creating a reply comprising the destination address as a reply source address, and
sending the reply to the source address.
59. The system of claim 49 further comprising:
a performing module configured to perform the response.
60. A computer product comprising: logic instruction embedded on computer-readable storage medium executable by a computer processor to cause the computer processor to: determine whether a source address for a first packet sent by the source address to a destination address qualifies as a threat; examine the first packet; determine whether the destination address is synthetic; determine a response to the first packet based upon the examining and whether the source address qualifies as the threat; and location-determining instructions configured to cause the computer processor to determine whether the source address is on a local network; wherein when the location-determining instructions determines that the source address is on the local network and the source address qualifies as the threat, the instructions cause the computer processor to determine that the response is to create a synthetic hardware address, and perform for each respective device of a plurality of devices on the local network: select the respective device, create an address control protocol message comprising the synthetic hardware address as a message source address, insert a corresponding hardware address for the respective device in the address control protocol message as a message destination hardware address, and send the address control protocol message.
61. The computer product of claim 60 wherein:
the instructions cause the computer processor to determine the response to be dropping the first packet when the destination address is synthetic and the source address qualifies as the threat.
62. The computer product of claim 61 further comprising:
dropping instructions configured to cause the computer processor to drop the first packet.
63. The computer product of claim 60 wherein when the location-determining instructions determines that the source address is not on the local network and the source address qualifies as the threat, the instructions cause the computer processor to determine that the response is to perform for each respective device of a plurality of devices on the local network: select the respective device, create a respective synthetic hardware address for the respective device, create an address control protocol message comprising the respective synthetic hardware address as a message source address, insert a corresponding hardware address for a gateway communicating on behalf of the source address in the address control protocol message as a message destination hardware address, and send the address control protocol message.
64. The computer product of claim 60 wherein when the location-determining instructions determines that the source address is on the local network and the source address qualifies as the threat, the instructions cause the computer processor to determine that the response is to perform for each respective device of a plurality of devices on the local network: select the respective device, create a respective synthetic hardware address for the respective device, create an address control protocol message comprising the respective synthetic hardware address as a message source address, insert the source address in the address control protocol message as a message destination hardware address, and send the address control protocol message.
65. The computer product of claim 60 further comprising:
second threat-determining instructions configured to determine whether the destination address qualifies as a second threat.
66. The computer product of claim 60 further comprising:
second synthetic-address-determining instructions configured to determine whether the destination address is a synthetic hardware address.
67. The computer product of claim 66 , wherein
when the second synthetic-address-determining instructions determine that the destination address is the synthetic hardware address,
the instructions cause the computer processor to determine that the response comprises
modifying the first packet by replacing the destination address with a hardware address for a device at the destination address, and
sending the first packet.
68. The computer product of claim 60 further comprising:
packet-type-determining instructions configured to determine a packet type of the first packet.
69. The computer product of claim 68 wherein
when the packet-type-determining instructions determines that the packet type of the first packet is an address resolution protocol request,
the instructions cause the computer processor to determine that the response comprises
creating a reply comprising the destination address as a reply source address, and
sending the reply to the source address.
70. The computer product of claim 60 further comprising:
performing instructions configured to perform the response.