Zero hop algorithm for network threat identification and mitigation
View Patent ↗A method, system, apparatus, and computer-readable medium to enable a set of security device interfaces within a broadcast domain to identify and mitigate attacks. For each address of a device communicating within the broadcast domain, a responsible interface is determined by a zero hop ownership determination algorithm. The algorithm operates by counting a respective number of replies observed by each of multiple interfaces. Each reply is made in response to a respective request for one address. A responsible interface is assigned to the one address using the respective number of replies observed by each respective interface. The algorithm approximates the security device interface physically closest to the address in question without querying the switches themselves and without requiring the security device interface to be in-line on the network.
1. A computer-implemented method comprising: for each respective interface of a plurality of interfaces in a network, counting a respective number of replies observed by the respective interface, wherein each reply of the replies is made in response to a respective request of a plurality of requests, and each request of the plurality of requests is for one address; assigning a responsible interface of the plurality of interfaces to the one address using the respective number of replies observed by each respective interface; the plurality of interfaces and the one address are within a broadcast domain; managing communication with the one address in response to being assigned as the responsible interface, the managing the communication comprises redirecting communication sent by the one address in response to determining that the one address is a threat; and sending a message to each interface of the plurality of interfaces in response to being assigned as the responsible interface for the one address.
2. The method of claim 1 wherein
the plurality of interfaces and the one address are within a segment of the network.
3. The method of claim 1 wherein
the network is a virtual network.
4. The method of claim 1 wherein
the counting is performed at a data link layer of the network.
5. The method of claim 1 wherein
at least one of the plurality of interfaces operates in promiscuous mode.
6. The method of claim 1 wherein
no interface of the plurality of interfaces is in-line on the network.
7. The method of claim 1 wherein
the managing the communication comprises gathering statistical information about the communication with the one address.
8. The method of claim 1 wherein
the managing the communication comprises
changing a state of the one address upon determining that no communication with the one address has occurred for a period of time.
9. The method of claim 1 wherein
the managing the communication comprises
performing mitigation during communication with the one address.
10. The method of claim 9 wherein
the performing the mitigation occurs in response to determining that the one address is a threat.
11. The method of claim 1 wherein
the redirecting the communication occurs in response to determining that the one address is a threat.
12. The method of claim 1 further comprising:
sending a message to each interface of the plurality of interfaces in response to being assigned as the responsible interface for the one address.
13. The method of claim 1 further comprising: in response to receiving the message from a second interface, sending a second message to the second interface, wherein the second message indicates that the second interface is the responsible interface for the one address.
14. The method of claim 1 wherein
at least one respective request of the plurality of requests is sent by each respective interface of the plurality of interfaces to the one address.
15. The method of claim 1 wherein
the assigning the responsible interface comprises
determining a largest number of replies from the respective number of replies for each respective interface, and
identifying one respective interface having the largest number of replies as the responsible interface.
16. The method of claim 1 further comprising:
initiating the counting in response to
receiving a packet from the one address and
determining that the one address is not in a list of addresses.
17. The method of claim 1 further comprising:
initiating the counting in response to expiration of a timer.
18. The method of claim 17 wherein
the timer expires after sufficient time has elapsed to receive a respective response for each request of the plurality of requests.
19. The method of claim 1 further comprising:
initiating the counting in response to a message to initiate the counting.
20. The method of claim 19 further comprising:
sending the message to initiate the counting to a second interface in response to determining that the second interface should be assigned as the responsible interface.
21. An apparatus comprising: computer-readable storage medium including: a counting module to count a respective number of replies observed by a respective interface of a plurality of interfaces in a network, wherein each reply of the replies is made in response to a respective request of a plurality of requests, and each request of the plurality of requests is for one address; an assigning module to assign a responsible interface of the plurality of interfaces to the one address using the respective number of replies observed by each respective interface; the plurality of interfaces and the one address are within a broadcast domain, and no interface of the plurality of interfaces is in-line on the network; at least one of the plurality of interfaces operates in promiscuous mode; a managing module to manage communication with the one address in response to being assigned as the responsible interface; and a sending module to send a message to each interface of the plurality of interfaces in response to being assigned as the responsible interface for the one address.
22. The apparatus of claim 21 wherein
the plurality of interfaces and the one address are within a segment of the network.
23. The apparatus of claim 21 wherein
the network is a virtual network.
24. The apparatus of claim 21 wherein
the counting is performed at a data link layer of the network.
25. The apparatus of claim 21 further comprising:
a managing module to manage communication with the one address in response to being assigned as the responsible interface.
26. The apparatus of claim 1 wherein managing the communication comprises gathering statistical information about the communication with the one address.
27. The apparatus of claim 1 wherein managing the communication comprises changing a state of the one address upon determining that no communication with the one address has occurred for a period of time.
28. The apparatus of claim 1 wherein managing the communication comprises performing mitigation during communication with the one address.
29. The apparatus of claim 28 wherein
the performing the mitigation occurs in response to determining that the one address is a threat.
30. The apparatus of claim 1 wherein managing the communication comprises redirecting communication sent by the one address in response to determining that the one address is a threat.
31. The apparatus of claim 30 wherein
the redirecting the communication occurs in response to determining that the one address is a threat.
32. The apparatus of claim 25 further comprising:
a sending module to send a message to each interface of the plurality of interfaces in response to being assigned as the responsible interface for the one address.
33. The apparatus of claim 1 further comprising: a second sending module to send a second message to a second interface in response to receiving the message from the second interface, wherein the second message indicates that the second interface is the responsible interface for the one address.
34. The apparatus of claim 1 wherein at least one respective request of the plurality of requests is sent by each respective interface of the plurality of interfaces to the one address.
35. The apparatus of claim 1 wherein the assigning the responsible interface comprises determining a largest number of replies from the respective number of replies for each respective interface, and identifying one respective interface having the largest number of replies as the responsible interface.
36. The apparatus of claim 1 further comprising: an initiating module to initiate the counting in response to receiving a packet from the one address and determining that the one address is not in a list of addresses.
37. The apparatus of claim 1 further comprising: initiating the counting in response to expiration of a timer.
38. The apparatus of claim 37 wherein
the timer expires after sufficient time has elapsed to receive a respective response for each request of the plurality of requests.
39. The apparatus of claim 1 further comprising: initiating the counting in response to a message to initiate the counting.
40. The apparatus of claim 39 further comprising:
sending the message to initiate the counting to a second interface in response to determining
that the second interface should be assigned as the responsible interface.
41. A computer-readable storage medium comprising:
counting instructions to count a respective number of replies observed by a respective interface of a plurality of interfaces in a network, wherein
each reply of the replies is made in response to a respective request of a plurality of requests, and
each request of the plurality of requests is for one address; and
assigning instructions to assign a responsible interface of the plurality of interfaces to the one address using the respective number of replies observed by each respective interface;
the plurality of interfaces and the one address are within a broadcast domain;
managing instructions to manage communication with the one address in response to being assigned as the responsible interface; and
sending instructions to send a message to each interface of the plurality of interfaces in response to being assigned as the responsible interface for the one address.
42. The computer-readable storage medium of claim 41 further comprising:
second sending instructions to send a second message to a second interface in response to receiving the message from the second interface, wherein
the second message indicates that the second interface is the responsible interface for the one address.
43. A computer system comprising:
counting means to count a respective number of replies observed by a respective interface of a plurality of interfaces in a network, wherein
each reply of the replies is made in response to a respective request of a plurality of requests, and
each request of the plurality of requests is for one address; and
assigning means to assign a responsible interface of the plurality of interfaces to the one address using the respective number of replies observed by each respective interface;
the plurality of interfaces and the one address are within a broadcast domain;
sending means to send a message to each interface of the plurality of interfaces in response to being assigned as the responsible interface for the one address; and
managing means to manage communication with the one address in response to being assigned as the responsible interface.
44. The system of claim 43 further comprising:
second sending means to send a second message to a second interface in response to receiving the message from the second interface, wherein
the second message indicates that the second interface is the responsible interface for the one address.