Network intrusion detection in a network that includes a distributed virtual switch fabric
View Patent ↗A network intrusion detection system (NIDS) works in conjunction with a distributed virtual switch fabric to provide enhanced network intrusion detection in a way that does not require as much human intervention, autonomically adjusts to hardware changes in the network, and responds much more quickly than known network intrusion detection systems. The NIDS accesses network information from the distributed virtual switch fabric, which gives the NIDS access to a virtual view that includes hardware information for all networking devices in the network. This allows the NIDS to automatically determine network topology, update itself as hardware in the network is added or changed, and promptly take automated service actions in response to detected network intrusions. The result is a NIDS that is easier to configure, maintain, and use, and that provides enhanced network security.
1. A networked computer system comprising:
a plurality of systems that each include at least one processor;
a plurality of networks interconnecting the plurality of systems;
a distributed virtual switch fabric that provides a virtual view of the plurality of networks and the plurality of systems; and
a network intrusion detection system coupled to the distributed virtual switch fabric, the network intrusion detection mechanism comprising:
a plurality of attack signatures that specify characteristics of network intrusions;
an interface to the distributed virtual switch fabric that allows querying the distributed virtual switch fabric to determine from the virtual view, network topology and configuration of the networked computer system, wherein the network intrusion detection mechanism detects a change to the plurality of systems, queries the distributed virtual switch fabric to determine if the change is reflected in the virtual view of the plurality of networks and the plurality of systems, and when the change is reflected in the virtual view, the network intrusion detection mechanism autonomically changes the network topology and configuration in the network intrusion detection mechanism without input from a human system administrator; and
a plurality of service actions that each may be performed automatically by the network intrusion detection mechanism without input from a human system administrator when a network intrusion that matches at least one of the plurality of attack signatures is detected by the network intrusion detection system.
2. The networked computer system of claim 1 wherein the plurality of service actions comprises monitoring a compromised host that originated network traffic detected as the network intrusion.
3. The networked computer system of claim 1 wherein the plurality of service actions comprises quarantining a compromised host that originated network traffic detected as the network intrusion.
4. The networked computer system of claim 1 wherein the plurality of service actions comprises moving to a different network a compromised host that originated network traffic detected as the network intrusion to a different network.
5. The networked computer system of claim 1 wherein the plurality of service actions comprises shutting down a compromised host that originated network traffic detected as the network intrusion.
6. The networked computer system of claim 1 wherein the change to the plurality of systems comprises an addition to the plurality of systems.
7. An article of manufacture comprising software stored on a non-transitory computer readable storage medium, the software comprising:
a network intrusion detection system coupled to a distributed virtual switch fabric in a networked computer system that comprises a plurality of networks interconnecting a plurality of systems, the network intrusion detection mechanism comprising:
a plurality of attack signatures that specify characteristics of network intrusions;
an interface to the distributed virtual switch fabric that allows querying the distributed virtual switch fabric to determine from the virtual view, network topology and configuration of the networked computer system, wherein the network intrusion detection mechanism detects a change to the plurality of systems, queries the distributed virtual switch fabric to determine if the change is reflected in the virtual view of the plurality of networks and the plurality of systems, and when the change is reflected in the virtual view, the network intrusion detection mechanism autonomically changes the network topology and configuration in the network intrusion detection mechanism without input from a human system administrator; and
a plurality of service actions that each may be performed autonomically by the network intrusion detection mechanism without input from a human system administrator when a network intrusion that matches at least one of the plurality of attack signatures is detected by the network intrusion detection system.
8. The article of manufacture of claim 7 wherein the plurality of service actions comprises monitoring a compromised host that originated network traffic detected as the network intrusion.
9. The article of manufacture of claim 7 wherein the plurality of service actions comprises quarantining a compromised host that originated network traffic detected as the network intrusion.
10. The article of manufacture of claim 7 wherein the plurality of service actions comprises moving to a different network a compromised host that originated network traffic detected as the network intrusion to a different network.
11. The article of manufacture of claim 7 wherein the plurality of service actions comprises shutting down a compromised host that originated network traffic detected as the network intrusion.
12. The article of manufacture of claim 7 wherein the change to the plurality of systems comprises an addition to the plurality of systems.