Systems and methods for monitoring network ports to redirect computing devices to a protected network
View Patent ↗A method for redirecting a computing device from a first network to a second network is described. A plurality of network ports is monitored. A communication from a computing device is detected at one of the network ports. Information is sent to a first server and a second server regarding the identity of the computing device. A command is sent to the first server to send a request to the computing device to renew the connection with the second server. The computing device is redirected to a second network from a first network.
1. A method for redirecting a computing device from a first network to a second network comprising:
monitoring, by a monitoring device, a plurality of network ports;
detecting, by the monitoring device, a communication from a computing device at one of the network ports;
sending information from the monitoring device to a first server and a second server regarding the identity of the computing device;
sending a command from the monitoring device to the first server to send a request to the computing device to renew the connection with the second server, wherein the command is sent after the information regarding the identity of the computing device is sent from the monitoring device to the first server and the second server;
receiving a request from the computing device to renew its connection with the second server;
determining whether the request was sent from the computing device where an attack by a worm originated, wherein the determining occurs after the request to renew its connection was received; and
redirecting the computing device to a second network from a first network;
wherein the monitoring device comprises the ports and is configured to appear to possess characteristics of a server and wherein the monitoring device configured to appear to possess characteristics of the server acts as bait for the worm to attack the monitoring device.
2. The method of claim 1 , further comprising determining if the communication detected at one of the plurality of network ports includes a harmful element.
3. The method of claim 2 , wherein the harmful element comprises the worm.
4. The method of claim 2 , wherein the harmful element comprises a computer virus.
5. The method of claim 1 , further comprising monitoring a subset of network ports.
6. The method of claim 5 , wherein the subset of ports includes ports 135, 137, 138, 139, 161, 162, 389, and 445.
7. The method of claim 1 , wherein a monitoring application on the monitoring device monitors the plurality of network ports.
8. The method of claim 1 , wherein the second server redirects the computing device from the first network to the second network.
9. The method of claim 1 , wherein a monitoring application on the monitoring device monitors a plurality of ports, wherein the monitoring application detects a communication comprising a harmful element at one of the ports, wherein the monitoring application sends the identity of the computing device to the first server and the second server, wherein the computing device renews the connection with the second server, and wherein the second server redirects the computing device to the second network.
10. A computer system that is configured to redirect a computing device from a first network to a second network, the computer system comprising:
a second server; and
a monitoring device having:
a processor;
memory in electronic communication with the processor;
instructions stored in the memory, the instructions being executable to:
monitor, by the monitoring device, a plurality of network ports;
detect, by the monitoring device, a communication from a computing device at one of the network ports;
send information from the monitoring device to a first server and the second server regarding the identity of the computing device;
send a command from the monitoring device to the first server to send a request to the computing device to renew the connection with the second server, wherein the command is sent after the information regarding the identity of the computing device is sent from the monitoring device to the first server and the second server;
determine whether the request was sent from the computing device where an attack by a worm originated, wherein the determining occurs after the request to renew its connection was received; and
the ports, wherein the monitoring device is configured to appear to possess characteristics of a server and wherein the monitoring device configured to appear to possess characteristics of the server acts as bait for the worm to attack the monitoring device;
wherein the second server receives a request from the computing device to renew its connection with the second server, wherein the second server redirects the computing device to a second network from a first network.
11. The system of claim 10 , wherein the instructions detect a harmful element within the communication detected at one of the network ports.
12. The system of claim 11 , wherein the harmful element comprises the worm.
13. The system of claim 11 , wherein the harmful element comprises a computer virus.
14. The system of claim 10 , wherein the instructions monitor a subset of the plurality of network ports.
15. The system of claim 14 , wherein the subset of ports comprises ports 135, 137, 138, 139, 161, 162, 389, and 445.
16. A non-transitory computer-readable medium comprising executable instructions to redirect a computing device from a first network to a second network, the instructions being executable to:
monitor, by a monitoring device, a plurality of network ports;
detect, by the monitoring device, a communication from a computing device at one of the network ports;
send information from the monitoring device to a first server and a second server regarding the identity of the computing device;
send a command from the monitoring device to the first server to send a request to the computing device to renew the connection with the second server, wherein the command is sent after the information regarding the identity of the computing device is sent from the monitoring device to the first server and the second server;
determine whether the request was sent from the computing device where an attack by a worm originated, wherein the determining occurs after the request to renew its connection was received; and
receive a request from the computing device to renew its connection with the second server, wherein the second server redirects the computing device to a second network from a first network;
wherein the monitoring device comprises the ports and is configured to appear to possess characteristics of a server and wherein the monitoring device configured to appear to possess characteristics of the server acts as bait for the worm to attack the monitoring device.
17. The non-transitory computer-readable medium of claim 16 , wherein the instructions are further executable to detect a harmful element in the communication received at one of the network ports.
18. The non-transitory computer-readable medium of claim 16 , wherein the instructions are further executable to monitor a subset of the plurality of network ports.
19. The non-transitory computer-readable medium of claim 18 , wherein the subset of ports comprises ports 135, 137, 138, 139, 161, 162, 389, and 445.