IP Library › Granted Patent US 9,419,981
Granted Patent B2
US 9,419,981 · App. 12/092,224 · Granted Aug 16, 2016

Methods, media, and systems for securing communications between a first node and a second node

Inventors: Salvatore J. Stolfo (Ridgewood, NJ); Gabriela F. Ciocarlie (New York, NY); Vanessa Frias-Martinez (New York, NY); Janak Parekh (Manhasset, NY); Angelos D. Keromytis (New York, NY); Joseph Sherrick (Jackson, NJ)
Assignee: The Trustees of Columbia University in the City of New York
H04L63/102H04L63/145
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,419,981
App. No.
12/092,224
Granted
Aug 16, 2016
Kind
B2
Abstract

Methods, media, and systems for securing communications between a first node and a second node are provided. In some embodiments, methods for securing communication between a first node and a second node are provided. The methods comprising: receiving at least one model of behavior of the second node at the first node; and authorizing the first node to receive traffic from the second node based on the difference between the at least one model of behavior of the second node and at least one model of behavior of the first node.

Claims (45)

1. A method for securing communications between a first node and a second node, comprising:

receiving via a network at least one model of behavior of the second node at least one hardware processor of the first node, which the at least one model of behavior of the second node was generated by a node other than the first node and which at least one model of behavior of the second node represents a payload profile of normal traffic of the second node;

authorizing, using the at least one hardware processor of the first node, the first node to receive traffic from the second node based on how similar are the at least one model of behavior of the second node and at least one model of behavior of the first node, which at least one model of behavior of the first node represents a payload profile of normal traffic of the first node; and

rejecting, using the at least one hardware processor of the first node, traffic sent from the second node to the first node based on how different are the at least one model of behavior of the second node and the at least one model of behavior of the first node.

2. The method of claim 1 , further comprising determining a distance between the at least one model of behavior of the second node and the at least one model of behavior of the first node.

3. The method of claim 2 , further comprising comparing the distance to a threshold.

4. The method of claim 3 , further comprising calculating the threshold based on the distance between the at least one model of behavior of the first node and at least one model of behavior of at least one other node.

5. The method of claim 1 , wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of output behavior.

6. The method of claim 1 , wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of input behavior.

7. The method of claim 1 , wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a Bloom filter.

8. The method of claim 1 , wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is the output of n-gram frequency analysis.

9. The method of claim 1 , further comprising rejecting traffic sent to the first node from the second node based on how different are the at least one model of behavior of the second node and actual behavior of the second node.

10. The method of claim 9 , wherein the actual behavior of the second node is its output behavior.

11. The method of claim 1 , further comprising:

receiving at least one model of behavior of the first node at the second node; and

authorizing the second node to receive traffic from the first node based on how similar are the at least one model of behavior of the first node and the at least one model of behavior of the second node.

12. A device that secures communications between a first node and a second node, comprising:

an interface in communication with a network;

a memory; and

a processor in communication with the memory and the interface; wherein the processor:

receives via a network at least one model of behavior of the second node, which the at least one model of behavior of the second node was generated by a node other than the first node and which at least one model of behavior of the second node represents a payload profile of normal traffic of the second node;

authorizes the first node to receive traffic from the second node based on how similar are the at least one model of behavior of the second node and at least one model of behavior of the first node, which at least one model of behavior of the first node represents a payload profile of normal traffic of the first node; and

rejects traffic sent from the second node to the first node based on how different are the at least one model of behavior of the second node and the at least one model of behavior of the first node.

13. The device of claim 12 , wherein the processor further determines a distance between the at least one model of behavior of the second node and the at least one model of behavior of the first node.

14. The device of claim 13 , wherein the processor further compares the distance to a threshold.

15. The device of claim 14 , where the processor further calculates the threshold based on the distance between the at least one model of behavior of the first node and at least one model of behavior of at least one other node.

16. The device of claim 12 , wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of output behavior.

17. The device of claim 12 , wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of input behavior.

18. The device of claim 12 , wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a Bloom filter.

19. The device of claim 12 , wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is the output of n-gram frequency analysis.

20. The device of claim 12 , where the processor further rejects traffic sent from the second node based on the difference between the at least one model of behavior of the second node and actual behavior of the second node.

21. The device of claim 20 , wherein the actual behavior of the second node is its output behavior.

22. A non-transitory computer-readable medium containing computer executable instructions that, when executed by a processor of a first node, cause the processor to perform a method for securing communications between the first node and a second node, comprising:

receiving via a network at least one model of behavior of the second node, which the at least one model of behavior of the second node was generated by a node other than the first node and which at least one model of behavior of the second node represents a payload profile of normal traffic of the second node;

authorizing the first node to receive traffic from the second node based on how similar are the at least one model of behavior of the second node and at least one model of behavior of the first node, which at least one model of behavior of the first node represents a payload profile of normal traffic of the first node; and

rejecting traffic sent from the second node to the first node based on how different are the at least one model of behavior of the second node and the at least one model of behavior of the first node.

23. The non-transitory computer-readable medium of claim 22 , the method further comprising determining a distance between the at least one model of behavior of the second node and the at least one model of behavior of the first node.

24. The non-transitory computer-readable medium of claim 23 , the method further comprising comparing the distance to a threshold.

25. The non-transitory computer-readable medium of claim 24 , the method further comprising calculating the threshold based on the distance between the at least one model of behavior of the first node and at least one model of behavior of at least one other node.

26. The non-transitory computer-readable medium of claim 22 , wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of output behavior.

27. The non-transitory computer-readable medium of claim 22 , wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a model of input behavior.

28. The non-transitory computer-readable medium of claim 22 , wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is a Bloom filter.

29. The non-transitory computer-readable medium of claim 22 , wherein at least one of the at least one model of behavior of the second node and the at least one model of behavior of the first node is the output of n-gram frequency analysis.

30. The non-transitory computer-readable medium of claim 22 , the method further comprising rejecting traffic from the second node based on how different are the at least one model of behavior of the second node and actual behavior of the second node.

31. The non-transitory computer-readable medium of claim 30 , wherein the actual behavior of the second node is its output behavior.

Assignments (2)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Oct 13, 2009
From: SHERRICK, JOSEPH
To: THE TRUSTEES OF COLUMBIA UNIVERSITY IN THE CITY OF NEW YORK
Reel/Frame 023365/0751 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Dec 3, 2008
From: STOLFO, SALVATORE J; CIOCARLIE, GABRIELA F; FRIAS-MARTINEZ, VANESSA; PAREKH, JANAK; KEROMYTIS, ANGELOS D
To: THE TRUSTEES OF COLUMBIA UNIVERSITY IN THE CITY OF NEW YORK
Reel/Frame 021923/0007 →
Continuity (3)
Provisional Application 60732019 · Oct 31, 2005
Provisional Application 60808313 · May 24, 2006
Related Publication 20110214161A1 · Sep 1, 2011