Methods and apparatus to control network connections
Preventing anomalous connections includes detecting by a programmable device an attempt by a first device to connect to a second device, detecting a first connection anomaly responsive to characteristics of the first device and characteristics of one or more other devices, and prohibiting a connection between the first device and the second device responsive to detecting the first connection anomaly.
1. At least one storage device or storage disk comprising instructions that, when executed, cause a machine to at least:
responsive to a first device attempting to connect to a second device, attempt to connect to the second device;
determine a level of trustworthiness of the second device based on first connection characteristics, second connection characteristics, and third connection characteristics, the first connection characteristics corresponding to a first communication session including the first device and the second device, the second connection characteristics corresponding to a second communication session including a third device currently connected to the second device and the second device, the third connection characteristics corresponding to a third communication session including the machine and the second device; and
prevent the first device from connecting to the second device based on the level of trustworthiness.
2. The at least one storage device or storage disk of claim 1 , wherein the instructions cause the machine to determine the level of trustworthiness based on fourth connection characteristics corresponding to previous communication sessions including the first device and the second device.
3. The at least one storage device or storage disk of claim 1 , wherein the instructions cause the machine to determine the level of trustworthiness based on fourth connection characteristics corresponding to communication sessions including the third device and the second device that were established within a prior time period.
4. The at least one storage device or storage disk of claim 1 , wherein the instructions, when executed, cause the machine to determine the level of trustworthiness based on a certificate for the second device.
5. The at least one storage device or storage disk of claim 1 , wherein the instructions, when executed, cause the machine to determine the level of trustworthiness based on a reliability of an IP address associated with the second device.
6. The at least one storage device or storage disk of claim 1 , wherein the instructions cause the machine to determine the level of trustworthiness based on fourth connection characteristics corresponding to a plurality of communication sessions including the third device and the second device.
7. The at least one storage device or storage disk of claim 6 , wherein the plurality of communication sessions including the third device and the second device were established during a prior time period.
8. A method of preventing anomalous connections, the method comprising:
responsive to a first device attempting to connect to a second device, attempting to connect a programmable device and the second device;
detecting a first connection anomaly based on first connection characteristics, second connection characteristics, and third connection characteristics, the first connection characteristics corresponding to a first communication session including the first device and the second device, the second connection characteristics corresponding to a second current communication session between a third device and the second device, the third connection characteristics corresponding to a third communication session including the programmable device and the second device; and
prohibiting the first device from connecting to the second device based on detecting the first connection anomaly.
9. The method of claim 8 , wherein the second connection characteristics correspond to a plurality of communication sessions including the third device and the second device that were established during a prior time interval.
10. The method of claim 8 , wherein the third connection characteristics include characteristics of at least one prior communication session including the programmable device and the second device.
11. The method of claim 8 , wherein the first connection characteristics include characteristics of at least one prior communication session including the first device and the second device.
12. The method of claim 8 , wherein the detecting of the first connection anomaly is based on a certificate associated with the second device.
13. A system for detecting connection anomalies, the system comprising:
one or more processors;
a memory including instructions that, when executed, cause at least some of the one or more processors to:
in response to a first device attempting to connect to a second device:
attempt to connect to the second device;
determine a level of trustworthiness of the second device based on first connection characteristics, second connection characteristics, and third connection characteristics, the first connection characteristics corresponding to a first communication including the first device and the second device, the second connection characteristics corresponding to a second communication between the second device and a third device currently connected to the second device, the third connection characteristics corresponding to a third communication including the system and the second device; and
take an action regarding the attempt by the first device to connect to the second device based on the level of trustworthiness of the second device.
14. The system of claim 13 , wherein the at least some of the processors are to determine the level of trustworthiness based on fourth connection characteristics corresponding to at least one previous communication including the first device and the second device.
15. The system of claim 13 , wherein the at least some of the processors are to determine the level of trustworthiness based on fourth connection characteristics corresponding to at least one communication including an additional device and the second device.
16. The system of claim 13 , wherein the at least some of the one or more processors are to determine the level of trustworthiness based on a certificate for the second device.
17. The system of claim 13 , wherein the at least some of the one or more processors are to determine the level of trustworthiness based on a reliability of an IP address associated with the second device.
18. The system of claim 13 , wherein the at least some of the processors are to determine the level of trustworthiness based on fourth connection characteristics corresponding to a plurality of communications including the third device and the second device.
19. The system of claim 13 , wherein the at least some of the one or more processors are to take the action by preventing the first device from connecting to the second device.
20. The at least one storage device or storage disk of claim 1 , wherein the instructions cause the machine to determine the level of trustworthiness based on fourth connection characteristics corresponding to at least one prior communication session including the machine and the second device.
21. The method of claim 8 , wherein the detecting of the first connection anomaly is based on a reliability of an IP address associated with the second device.
22. The method of claim 8 , wherein the detecting of the first connection anomaly is based on fourth connection characteristics corresponding to at least one communication including an additional device and the second device.
23. The method of claim 8 , wherein the third device is currently connected to the second device.
24. The system of claim 13 , wherein the at least some of the processors are to determine the level of trustworthiness based on fourth connection characteristics corresponding to at least one prior communication session including the system and the second device.
25. The system of claim 13 , wherein the action regarding the attempt by the first device to connect to the second device includes transmission of an alert message to the first device, the alert message indicating that the second device is not sufficiently trustworthy.