Method and system for cloaked observation and remediation of software attacks
A method and system provide security for a communication network and for one or more nodes within the network. Software can be distributed throughout the network from a centralized location or administrative console. The software can be made resident in the kernel of the operating system of a receiving node. The software can provide an observation functionality, an analysis functionality, a reporting functionality and a remediation functionality or some subset of those functionalities.
1. A method for monitoring data communications of a node in a data communications network comprising:
intercepting, by a driver installed in a network stack of an operating system of the node, a data packet from the network stack of the node;
forwarding, by the driver, the intercepted data packet to a packet manager within the node;
distributing, by the packet manager, the intercepted data packet to a predetermined processing module within the node under control of the packet manager; and
deriving, by the predetermined processing module, information about the communication of data by the node from said data packet.
2. The method of claim 1 , wherein deriving information includes collecting inventory information concerning the node.
3. The method of claim 1 , wherein deriving information includes analyzing packet flows to assess node behavior.
4. The method of claim 1 , further comprising invoking a remediation module in response to the derived information.
5. The method of claim 4 , further comprising creating a message related to the invoking of the remediation module.
6. The method of claim 1 , further comprising creating a reporting message based on the derived information, the reporting message intended for transmission to the network by the node.
7. A system for monitoring data communications of a node in a data communications network, the system comprising:
a memory; and
a processor, coupled to the memory, to cause:
a driver installed in a network stack of an operating system of the node to intercept a data packet from the network stack of the node, and to forward the intercepted data packet to a packet manager within the node;
the packet manager to distribute the intercepted data packet to a predetermined processing module within the node under control of the packet manager; and
the predetermined processing module to derive information about the communication of data by the node from said data packet.
8. The system of claim 7 , wherein the predetermined processing module is to derive information by collecting inventory information concerning the node.
9. The system of claim 7 , wherein the predetermined processing module is to derive information by analyzing packet flows to assess node behavior.
10. The system of claim 7 , wherein the processor is to invoke a remediation module in response to the derived information.
11. The system process of claim 10 , wherein the processor is further to create a message related to the invoking of the remediation module.
12. The system of claim 7 , wherein the processor is to create a reporting message based on the derived information, the reporting message intended for transmission to the network by the node.
13. A non-transitory computer-readable medium including data that, when accessed by a machine, cause the machine to perform a method for monitoring data communications of a node in a data communications network, the method comprising:
intercepting, by a driver installed in a network stack of an operating system of the node, a data packet from the network stack of the node;
forwarding, by the driver, the intercepted data packet to a packet manager within the node;
distributing, by the packet manager, the intercepted data packet to a predetermined processing module within the node under control of the packet manager; and
deriving, by the predetermined processing module, information about the communication of data by the node from said data packet.
14. The computer-readable medium of claim 13 , wherein deriving information comprises collecting inventory information concerning the node.
15. The computer-readable medium of claim 13 , wherein deriving information comprises analyzing packet flows to assess node behavior.
16. The computer-readable medium of claim 13 , wherein the method further comprises invoking a remediation module in response to the derived information.
17. The computer-readable medium of claim 13 , wherein the method further comprises creating a reporting message based on the derived information, the reporting message intended for transmission to the network by the node.
18. The computer-readable medium of claim 16 , wherein the method further comprises creating a message related to the invoking of the remediation module.