Method and apparatus for detecting intrusions on a computer system
View Patent ↗A method of detecting intrusions on a computer includes the step of identifying an internet protocol field range describing fields within internet protocol packets received by a computer. A connectivity range is also established which describes a distribution of network traffic received by the computer. An internet protocol field threshold and a connectivity threshold are then determined from the internet protocol field range and connectivity range, respectively. During the operation of the computer, values are calculated for the internet protocol field range and connectivity range. These values are compared to the internet protocol metric threshold and connectivity metric threshold so as to identify an intrusion on the computer.
1. A method of detecting intrusions on a computer, comprising:
identifying an internet protocol field range describing fields within internet protocol packets received by a computer;
establishing a connectivity range describing a distribution of network traffic received by said computer;
determining an internet protocol field threshold and a connectivity threshold from said internet protocol field range and said connectivity range, respectively;
during said operation of said computer, calculating values for said internet protocol field range and said connectivity range; and comparing said values to said internet protocol field threshold and said connectivity threshold so as to identify an intrusion on said computer, utilizing a processor; wherein a plurality of said internet protocol field ranges are provided including an IP address range and a packet length, and a plurality of said internet protocol field thresholds are provided including an IP address range threshold and a packet length threshold.
2. The method of claim 1 , further comprising flagging packets that are identified as being said intrusion on said computer.
3. The method of claim 2 , wherein said flagging is based on manually entered rules.
4. The method of claim 1 , wherein said internet protocol field threshold includes a packet length threshold that is applied to TCP packets.
5. The method of claim 1 , wherein said internet protocol field threshold includes a packet length threshold that is applied to UDP packets.
6. The method of claim 1 , wherein said internet protocol field threshold includes a packet length threshold that is applied to ICMP packets.
7. The method of claim 1 , wherein a first packet length threshold is applied to TCP packets and UDP packets, and a second packet length threshold is applied to ICMP packets.
8. The method of claim 1 , wherein said internet protocol field threshold includes a packet length threshold that is an upper packet length threshold.
9. The method of claim 1 , wherein said internet protocol field threshold includes a packet length threshold that is a lower packet length threshold.
10. The method of claim 1 , wherein said internet protocol field range includes a protocol data unit (PDU) length, and said internet protocol field threshold includes a PDU length threshold.
11. The method of claim 1 , wherein said intrusion is identified upon said detection of overlapping fragmentation offsets.
12. The method of claim 1 , wherein said intrusion is identified upon said detection of an unknown IP protocol.
13. The method of claim 12 , wherein said detection of said unknown IP protocol is performed based on a protocol identification field.
14. The method of claim 1 , wherein said intrusion is identified based on a set of TCP code bits.
15. The method of claim 1 , wherein said intrusion is identified based on IP packet destination ports.
16. The method of claim 1 , wherein said internet protocol field range includes an IP address range and said internet protocol field range threshold includes an IP address range threshold, and said IP address range and said IP address range threshold include destination addresses.
17. The method of claim 1 , wherein said intrusion is identified utilizing a graphical user interface.
18. The method of claim 1 , wherein said internet protocol field range includes an IP address range and said internet protocol field range threshold includes an IP address range threshold, and said IP address range and said IP address range threshold include a range of IP address/mask pairs.
19. The method of claim 1 , wherein said intrusion includes at least one of compromise of confidentiality attacks, and compromise of data integrity attacks.
20. The method of claim 19 , wherein said compromise of confidentiality attacks expose sensitive information, said compromise of confidentiality attacks including sniffing a sub-net, transmitting confidential information via tunneled channels, and forcing system core dumps.
21. The method of claim 2 , wherein a remedial action is taken in response to said flagged packets that are identified as being said intrusion on said computer.
22. A system, comprising:
a processor for:
identifying an internet protocol field range describing fields within internet protocol packets received by a computer;
establishing a connectivity range describing a distribution of network traffic received by said computer; determining an internet protocol field threshold and a connectivity threshold from said internet protocol field range and said connectivity range, respectively; during said operation of said computer, calculating values for said internet protocol field range and said connectivity range; and comparing said values to said internet protocol field threshold and said connectivity threshold so as to identify an intrusion on said computer, utilizing a processor; wherein said system is operable such that a plurality of said internet protocol field ranges are provided including an IP address range and a packet length, and a plurality of said internet protocol field thresholds are provided including an IP address range threshold and a packet length threshold.
23. A computer program product embodied on a non-transitory computer readable medium, comprising: computer code for identifying an internet protocol field range describing fields within internet protocol packets received by a computer; computer code for establishing a connectivity range describing a distribution of network traffic received by said computer; computer code for determining an internet protocol field threshold and a connectivity threshold from said internet protocol field range and said connectivity range, respectively; computer code for during said operation of said computer, calculating values for said internet protocol field range and said connectivity range; and computer code for comparing said values to said internet protocol field threshold and said connectivity threshold so as to identify an intrusion on said computer, utilizing a processor; wherein said computer program product is operable such that a plurality of said internet protocol field ranges are provided including an IP address range and a packet length, and a plurality of said internet protocol field thresholds are provided including an IP address range threshold and a packet length threshold.