Wireless intrusion prevention system and method
View Patent ↗A wireless intrusion prevention system and method to prevent, detect, and stop malware attacks is presented. The wireless intrusion prevention system monitors network communications for events characteristic of a malware attack, correlates a plurality of events to detect a malware attack, and performs mitigating actions to stop the malware attack.
1. A malware detection and mitigation system, comprising:
a plurality of mobile devices configured to execute a respective plurality of monitors operably adapted to scan network communications to determine destinations of the network communications, amounts of network traffic including one or more of the network communications to the destinations over time intervals, and average packet size of the network communications;
a plurality of detection agents each executing on a respective one of the mobile devices and operably adapted to communicate with at least one of the plurality of monitors of the respective one of the plurality of mobile devices, to determine normal amounts of network traffic over the time intervals to the destinations, to determine normal average packet size of the network communications to the destinations, to detect changes in the amounts of network traffic over the time intervals to a particular destination relative to the determined normal amount of network traffic to the particular destination over the time intervals, to detect changes in the average packet size of the network communications to the particular destination relative to the determined normal average packet size of the network communications to the particular detection, to detect a malware attack based on at least one of detected changes in the amount of network traffic over the time intervals, detected changes in the average packet size, and the destinations of the network communications, and to communicate an attack indication when the malware attack is detected; and
a network device separate from the one of the plurality of mobile devices, wherein the network device comprises a mitigating agent operably adapted to communicate with the plurality of detection agents via a mobile network to receive the attack indication and to trigger a mitigating action in response in the mobile network to the attack indication.
2. The malware detection and mitigation system of claim 1 , wherein the mitigating action comprises at least one mitigating action directed to the one of the plurality of mobile devices and at least one mitigating action directed to a network element.
3. The malware detection and mitigation system of claim 1 , wherein the network communications are wireless network communications.
4. The malware detection and mitigation system of claim 1 , wherein the malware attack is selected from the group consisting of a battery draining malware attack, a denial of service malware attack, and a mobile worm malware attack.
5. The malware detection and mitigation system of claim 1 , wherein the plurality of detection agents are configured to detect changes in the amount of the network traffic over the time intervals and changes in the average packet size of the communications that are correlated with a characteristic of the malware attack, the characteristic selected from the group consisting of an increase in network traffic to the particular destination and an increase in network traffic to the particular destination and a decrease in the average packet size of the network communications to the particular destination.
6. The malware detection and mitigation system of claim 1 , further comprising one or more network elements configured to execute respective ones of a second plurality of monitors.
7. The malware detection and mitigation system of claim 6 , wherein the one or more network elements are each selected from the group consisting of a handset, a mobile device, a gateway, a traffic sniffer, a honeypot, a router, a switch, and a register.
8. The malware detection and mitigation system of claim 1 , wherein the mitigating action is selected from the group consisting of reporting the malware attack, disabling the network communications, restricting the network communications, ignoring the network communications, performing a malware scan, and intercepting the network communications and forwarding to the security center.
9. The malware detection and mitigation system of claim 1 , wherein the plurality of detection agents are configured to detect the malware attack in response to detecting a packet bound for an inactive mobile device.
10. The malware detection and mitigation system of claim 1 , wherein the plurality of detection agents are further configured to detect a malware attack in response to detecting a program sent to a plurality of mobile devices.
11. The malware detection and mitigation system of claim 1 ,
wherein the monitors are further configured to determine senders of the network communications,
wherein the detection agents are configured to determine an identity of a sender associated with the malware attack and to provide information indicative of the identity of a sender in the attack indication, and
wherein the mitigating agent of the network device is configured to instruct the mobile devices to drop packets from the sender associated with the malware attack.