Identifying attackers on a network
View Patent ↗Described are computer-based methods and apparatuses, including computer program products, for identifying attackers on a network. A data packet is filtered by a multi-tiered filtering and transmission system. Data packets matching the first tier filter are discarded. Data packets matching the second tier filter are transmitted to an output module based on a criterion. Data packets in the third tier filter are hashed into bins and data packets matching an entry in the bin are transmitted to the output module based on a criterion for the bin. Data packets in the fourth tier transmission system are transmitted to the output module based on a criterion. Data packets that do not meet the criterion for transmission to the output module are transmitted to an attack identification module which analyzes the data packets to identify attacks.
1. A method of identifying attackers on a network, the method comprising:
receiving a data packet or part thereof at a discard processing module;
generating a discard entry for the data packet;
receiving the discard entry at a digest index module;
hashing the discard entry using one or more fields in the discard entry to generate a bin identification and a user signature;
processing the bin identification to associate the user signature with a first bin included in a plurality of bins, wherein each bin in the plurality of bins has a capacity;
incrementing a discard count if the data packet cannot be processed because the first bin exceeds its capacity;
processing the discard entry at the first bin into a first digest entry, wherein the first digest entry comprises identifying information associated with the data packet and a hit counter;
incrementing a count entry for the data packet received at the discard processing module;
incrementing a processed count for the data packet received at the digest index module;
calculating a difference between the count entry and the processed count; and
reporting the difference.
2. The method of claim 1 , wherein the identifying information is a network address, a network subnet address, an internet protocol (IP) address, a media access control (MAC) address, a networking protocol header field, meta-data associated with the data packet, an arrival interface, a destination interface, an origination interface, or combinations thereof.
3. The method of claim 1 , wherein processing the discard entry at the first bin comprises comparing the identifying information of the discard entry to one or more stored fields associated with the first bin.
4. The method of claim 1 , further comprising:
comparing the user signature of the discard entry to one or more stored user signatures associated with the first bin.
5. The method of claim 4 , wherein if the user signature of the discard entry matches a stored user signature, then the hit counter is incremented on the first digest entry associated with the stored user signature.
6. The method of claim 4 , wherein the user signature of the discard entry does not match the one or more stored user signatures associated with the first bin.
7. The method of claim 6 , further comprising:
processing the first bin to determine capacity of the first bin;
processing the discard entry into a second digest entry; and
adding the second digest entry to the first bin.
8. The method of claim 7 , wherein the second digest entry comprises identifying information associated with the data packet, a timestamp, a user signature, a hit counter, a packet field, packet meta data, an uniqueness indicator, or combinations thereof.
9. The method of claim 6 further comprising:
processing the first bin to determine capacity of the first bin; and
processing each digest entry of the first bin based on the capacity to determine age and hit count.
10. The method of claim 1 , further comprising:
comparing the user signature of the discard entry to one or more stored user signatures associated with the first bin, wherein the user signature of the discard entry does not match the one or more stored user signatures associated with the first bin;
processing the first bin to determine capacity of the first bin;
processing the discard entry into a second digest entry;
adding the second digest entry to the first bin, wherein the second digest entry comprises identifying information associated with the data packet, a timestamp, a user signature, a hit counter, a packet field, packet meta data, an uniqueness indicator, or combinations thereof;
processing the timestamp and the hit counter of each digest entry in the plurality of bins wherein the timestamp comprises a plurality of time entries; and
generating a hit rate list.
11. The method of claim 10 , further comprising:
generating a report comprising the hit rate list; and
transmitting the report to a display device.
12. The method of identifying attackers on a network, the method comprising:
receiving a data packet or part thereof at a discard processing module;
generating a discard entry for the data packet;
receiving the discard entry at a digest index module;
hashing the discard entry using one or more fields in the discard entry to generate a bin identification and a user signature;
processing the bin identification to associate the user signature with a first bin included in a plurality of bins, wherein each bin in the plurality of bins has a capacity;
incrementing a discard count if the data packet cannot be processed because the first bin exceeds its capacity;
processing the discard entry at the first bin into a first digest entry, wherein the first digest entry comprises identifying information associated with the data packet and a hit counter;
comparing the user signature of the discard entry to one or more stored user signatures associated with the first bin, wherein the user signature of the discard entry does not match the one or more stored user signatures associated with the first bin;
processing the first bin to determine capacity of the first bin;
processing the discard entry into a second digest entry;
adding the second digest entry to the first bin, wherein the second digest entry comprises identifying information associated with the data packet, a timestamp, a user signature, a hit counter, a packet field, packet meta data, an uniqueness indicator, or combinations thereof;
processing the timestamp and the hit counter of each digest entry in the plurality of bins wherein the timestamp comprises a plurality of time entries; and
generating a hit rate list.
13. The method of claim 12 , further comprising:
generating a report comprising the hit rate list; and
transmitting the report to a display device.
14. The method of claim 12 , further comprising:
generating one or more no access list entries comprising entries of the hit rate list;
receiving at a no access list module the one or more no access list entries; and
adding the one or more no access list entries to a no access list.
15. The method of claim 12 , wherein the discard processing module is a ring buffer, a queue, a first in first out queue, a first in last out queue, or combinations thereof.
16. The method of claim 12 , further comprising:
processing each digest entry in the plurality of bins;
generating a report of processed information.
17. The method of claim 16 , wherein the processed information is a network address, a source address, a destination address, a network interface, a port, a source port, a destination port, or combinations thereof.
18. The method of claim 12 , wherein the identifying information is a network address, a network subnet address, an internet protocol (IP) address, a media access control (MAC) address, a networking protocol header field, meta-data associated with the data packet, an arrival interface, a destination interface, an origination interface, or combinations thereof.
19. The method of claim 12 , wherein processing the discard entry at the first bin comprises comparing the identifying information of the discard entry to one or more stored fields associated with the first bin.
20. A method of identifying attackers on a network, the method comprising:
receiving a data packet or part thereof at a discard processing module;
generating a discard entry for the data packet;
receiving the discard entry at a digest index module;
hashing the discard entry using one or more fields in the discard entry to generate a bin identification and a user signature;
processing the bin identification to associate the user signature with a first bin included in a plurality of bins, wherein each bin in the plurality of bins has a capacity;
incrementing a discard count if the data packet cannot be processed because the first bin exceeds its capacity;
processing the discard entry at the first bin into a first digest entry, wherein the first digest entry comprises identifying information associated with the data packet and a hit counter;
comparing the user signature of the discard entry to one or more stored user signatures associated with the first bin, wherein the user signature of the discard entry does not match the one or more stored user signatures associated with the first bin;
processing the first bin to determine capacity of the first bin;
processing each digest entry of the first bin based on the capacity to determine age and hit count;
deleting a second digest entry of the first bin based on the age and the hit count;
incrementing an overwrite count for the second digest entry deleted at the first bin; and
processing the overwrite count at the digest index module.
21. The method of claim 20 , further comprising:
deleting the second digest entry with lowest hit count.
22. A method of identifying attackers on a network, the method comprising:
receiving a data packet or part thereof at a discard processing module;
generating a discard entry for the data packet;
receiving the discard entry at a digest index module;
hashing the discard entry using one or more fields in the discard entry to generate a bin identification and a user signature;
processing the bin identification to associate the user signature with a first bin included in a plurality of bins, wherein each bin in the plurality of bins has a capacity;
incrementing a discard count if the data packet cannot be processed because the first bin exceeds its capacity;
processing the discard entry at the first bin into a first digest entry, wherein the first digest entry comprises identifying information associated with the data packet and a hit counter;
comparing the user signature of the discard entry to one or more stored user signatures associated with the first bin, wherein the user signature of the discard entry does not match the one or more stored user signatures associated with the first bin;
processing the first bin to determine capacity of the first bin;
processing each digest entry of the first bin based on the capacity to determine age and hit count;
deleting the discard entry based on the age and the hit count of each said digest entry of the first bin;
incrementing the discard count for the discard entry; and
processing the discard count at the digest index module.
23. A method of identifying attackers on a network, the method comprising:
receiving a data packet or part thereof at a discard processing module;
generating a discard entry for the data packet;
receiving the discard entry at a digest index module;
hashing the discard entry using one or more fields in the discard entry to generate a bin identification and a user signature;
processing the bin identification to associate the user signature with a first bin included in a plurality of bins;
processing the discard entry at the first bin, comprising comparing the user signature of the discard entry to one or more stored user signatures associated with the first bin;
wherein the user signature of the discard entry does not match the one or more stored user signatures associated with the first bin;
processing the first bin to determine capacity of the first bin;
processing the discard entry into a second digest entry;
adding the second digest entry to the first bin, wherein the second digest entry comprises identifying information associated with the data packet, a timestamp, a user signature, a hit counter, a packet field, packet meta data, an uniqueness indicator, or combinations thereof;
processing the timestamp and the hit counter of each digest entry in the plurality of bins wherein the timestamp comprises a plurality of time entries; and
generating a hit rate list.
24. The method of claim 23 , further comprising:
generating a report comprising the hit rate list; and
transmitting the report to a display device.
25. The method of claim 23 , further comprising:
generating one or more no access list entries comprising entries of the hit rate list;
receiving at a no access list module the one or more no access list entries; and
adding the one or more no access list entries to a no access list.
26. A method of identifying attackers on a network, the method comprising:
receiving a data packet or part thereof at a discard processing module;
generating a discard entry for the data packet;
receiving the discard entry at a digest index module;
hashing the discard entry using one or more fields in the discard entry to generate a bin identification and a user signature;
processing the bin identification to associate the user signature with a first bin included in a plurality of bins;
processing the discard entry at the first bin, comprising comparing the user signature of the discard entry to one or more stored user signatures associated with the first bin;
wherein the user signature of the discard entry does not match the one or more stored user signatures associated with the first bin;
processing the first bin to determine capacity of the first bin;
processing each digest entry of the first bin based on the capacity to determine age and hit count;
deleting a second digest entry of the first bin based on the age and the hit count;
incrementing an overwrite count for the second digest entry deleted at the first bin; and
processing the overwrite count at the digest index module.
27. The method of claim 26 , further comprising:
deleting the discard entry based on the age and the hit count of each said digest entry of the first bin;
incrementing a discard count for the discard entry; and
processing the discard count at the digest index module.