Non-intrusive threat detection in a computer network

1. A method comprising:

receiving, by a database system, an identification of a plurality of potential data transmission paths between a source node, one or more intermediary nodes, and a destination node during a communication session in a computer network using a route determination operation prior to transmitting a data packet to the destination node;

determining, by the database system, whether at least one of identified data transmission paths is one of a plurality of trusted data transmission paths stored in a trusted data transmission path table prior to transmitting the data packet to the destination node by comparing the identified data transmission paths to the plurality of trusted data transmission paths in the trusted data transmission path table including adding one or more of the identified data transmission paths to the trusted data transmission path table if the intermediary nodes of the one or more identified data transmission paths are part of at least one of the plurality of trusted data transmission paths stored in the trusted data transmission path table; and

generating, by the database system, a notification based on a determination that the at least one of the identified data transmission paths is not one of the plurality of trusted data transmission paths in the trusted data transmission path table prior to transmitting the data packet from the source node to the destination node, the notification comprising one of: (i) an instruction to terminate the communication session, (ii) a list comprising at least one of the plurality of trusted data transmission paths and an instruction to transmit data using the at least one of the plurality of trusted paths in the list, and (iii) an instruction to alert a user that the at least one data transmission path is not trusted.

2. The method of claim 1 , further comprising comparing, by the database system, the one or more intermediary nodes of the at least one identified data transmission path with intermediary nodes associated with the plurality of trusted data transmission paths in the trusted data transmission path table.

3. The method of claim 1 , wherein the identification of the at least one data transmission path is received when the communication session is initiated and the at least one identified data transmission path is stored in the trusted data transmission path table as one of the plurality of trusted data transmission paths.

4. The method of claim 3 , further comprising:

receiving, by the database system, an identification of at least a second data transmission path between the source node and the destination node in the computer network during the communication session;

determining, by the database system, whether the second data transmission path is one of the plurality of trusted data transmission paths stored in the trusted data transmission path table, the determination being based on a comparison of the identified second data transmission path to each of the plurality of trusted data transmission paths stored in the trusted data transmission path table; and

assigning, by the database system, a trust level to the second data transmission path in response to a determination that the second data transmission path is not one of the plurality of trusted data transmission paths stored in the trusted data transmission path table; and

storing, by the database system, the second data transmission path, based upon its trust level, as a data transmission path in a log of untrusted data transmission paths.

5. The method of claim 4 , further comprising:

receiving, by the database system, an identification of at least a third data transmission path between the source node and the destination node in the computer network during the communication session;

determining, by the database system, whether the third data transmission path is one of the plurality of trusted data transmission paths stored in the trusted data transmission path table, the determination being based on a comparison of the identified third data transmission path to each of the plurality of trusted data transmission paths stored in the trusted data transmission path table;

determining, by the database system, whether the third data transmission path is one of the plurality of trusted data transmission paths stored in the untrusted data transmission path log in response to a determination that the identified third data transmission path is not one of the plurality of trusted data transmission paths stored in the trusted data transmission path table;

assigning, by the database system, an increased trust level to the third data transmission path in response to a determination that the third data transmission path is one of the data transmission paths stored in the untrusted data transmission path log; and

storing, by the database system, the third data transmission path in the untrusted data transmission path log in a position based upon its trust level.

6. The method of claim 5 , wherein the assigned trust level for the third data transmission path increases each time the third data transmission path between the source node and the destination node is received by the database system.

7. The method of claim 6 , further comprising storing, by the database system, the third data transmission path in the trusted data transmission path table when the trust level associated with the third data transmission path is greater than a threshold value.

8. The method of claim 1 , further comprising:

assigning, by the database system, an initial trust level value to the at least one identified data transmission path in response to the determination that the at least one of the identified data transmission path is not one of the plurality of trusted data transmission paths stored in the trusted data transmission path table, the initial trust level value identifying the at least one identified data transmission path as untrustworthy; and

assigning, by the database system, a subsequent trust level value to the at least one identified data transmission path in response to each identification of the at least one identified data transmission path as a potential data transmission path during one or more subsequent route determination operations, the subsequent trust level value progressively increasing for each identification of the at least one identified data transmission path as the potential data transmission path and at least one of the subsequent trust level values identifying the at least one identified data transmission path as trustworthy.

9. An apparatus comprising:

one or more processors; and

a non-transitory computer readable medium storing a plurality of instructions, which when executed, cause the one or more processors to:

receive an identification a plurality of potential data transmission paths between a source node, one or more intermediary nodes, and a destination node during a communication session in a computer network using a route determination operation prior to transmitting a data packet to the destination node;

determine whether at least one of the identified data transmission paths is one of a plurality of trusted data transmission paths stored in a trusted data transmission path table prior to transmitting the data packet to the destination node by comparing the identified data transmission paths to the plurality of trusted data transmission paths in the trusted data transmission path table including adding one or more of the identified data transmission paths to the trusted data transmission path table if the intermediary nodes of the one or more identified data transmission paths are part of at least one of the plurality of trusted data transmission paths stored in the trusted data transmission path table; and

generate a notification based on a determination that the at least one of the identified data transmission paths is not one of the plurality of trusted data transmission paths in the trusted data transmission path table prior to transmitting the data packet from the source node to the destination node, the notification comprising one of: (i) an instruction to terminate the communication session, (ii) a list comprising at least one of the plurality of trusted data transmission paths and an instruction to transmit data using the at least one of the plurality of trusted paths in the list, and (iii) an instruction to alert a user that the at least one data transmission path is not trusted.

10. The apparatus of claim 9 , wherein the plurality of instructions, when executed, further cause the one or more processors to compare the one or more intermediary nodes of the at least one identified data transmission path with intermediary nodes associated with the plurality of trusted data transmission paths in the trusted data transmission path table.

11. The apparatus of claim 9 , wherein the identification of the at least one data transmission path is received when the communication session is initiated and the at least one identified data transmission path is stored in the trusted data transmission path table as one of the plurality of trusted data transmission paths.

12. The apparatus of claim 11 , wherein the plurality of instructions, when executed, further cause the one or more processors to:

receive an identification of at least a second data transmission path between the source node and the destination node in the computer network during the communication session;

determine whether the second data transmission path is one of the plurality of trusted data transmission paths stored in the trusted data transmission path table, the determination being based on a comparison of the identified second data transmission path to each of the plurality of trusted data transmission paths stored in the trusted data transmission path table; and

assign a trust level to the second data transmission path in response to a determination that the second data transmission path is not one of the plurality of trusted data transmission paths stored in the trusted data transmission path table; and

store the second data transmission path, based upon its trust level, as a data transmission path in a log of untrusted data transmission paths.

13. The apparatus of claim 12 , wherein the plurality of instructions, when executed, further cause the one or more processors to:

receive an identification of at least a third data transmission path between the source node and the destination node in the computer network during the communication session;

determine whether the third data transmission path is one of the plurality of trusted data transmission paths stored in the trusted data transmission path table, the determination being based on a comparison of the identified third data transmission path to each of the plurality of trusted data transmission paths stored in the trusted data transmission path table;

determine whether the third data transmission path is one of the plurality of trusted data transmission paths stored in the untrusted data transmission path log in response to a determination that the identified third data transmission path is not one of the plurality of trusted data transmission paths stored in the trusted data transmission path table;

assign an increased trust level to the third data transmission path in response to a determination that the third data transmission path is one of the data transmission paths stored in the untrusted data transmission path log; and

store the third data transmission path in the untrusted data transmission path log in a position based upon its trust level.

14. The apparatus of claim 13 , wherein the assigned trust level for the third data transmission path increases each time the third data transmission path between the source node and the destination node is received by the database system.

15. The apparatus of claim 14 , wherein the plurality of instructions, when executed, further cause the one or more processors to store the third data transmission path in the trusted data transmission path table when the trust level associated with the third data transmission path is greater than a threshold value.

16. A computer program product comprising a non-transitory computer-readable medium having computer readable program code embodied therein to be executed by one or more processors when retrieved from the non-transitory computer-readable medium, the program code including instructions to:

receive an identification a plurality of potential data transmission paths between a source node, one or more intermediary nodes, and a destination node during a communication session in a computer network using a route determination operation prior to transmitting a data packet to the destination node;

determine whether at least one of the identified data transmission paths is one of a plurality of trusted data transmission paths stored in a trusted data transmission path table prior to transmitting the data packet to the destination node by comparing the identified data transmission paths to the plurality of trusted data transmission paths in the trusted data transmission path table including adding one or more of the identified data transmission paths to the trusted data transmission path table if the intermediary nodes of the one or more identified data transmission paths are part of at least one of the plurality of trusted data transmission paths stored in the trusted data transmission path table; and

generate a notification based on a determination that the at least one of the identified data transmission paths is not one of the plurality of trusted data transmission paths in the trusted data transmission path table prior to transmitting the data packet from the source node to the destination node, the notification comprising one of: (i) an instruction to terminate the communication session, (ii) a list comprising at least one of the plurality of trusted data transmission paths and an instruction to transmit data using the at least one of the plurality of trusted paths in the list, and (iii) an instruction to alert a user that the at least one data transmission path is not trusted.

17. The computer program product of claim 16 , wherein the program code includes further instructions to compare the one or more intermediary nodes of the at least one identified path with intermediary nodes associated with the plurality of trusted paths.

18. The computer program product of claim 16 , wherein the identification of the at least one data transmission path is received when the communication session is initiated and the at least one identified data transmission path is stored in the trusted data transmission path table as one of the plurality of trusted data transmission paths.

19. The computer program product of claim 18 , wherein the program code includes further instructions to:

receive an identification of at least a second data transmission path between the source node and the destination node in the computer network during the communication session;

determine whether the second data transmission path is one of the plurality of trusted data transmission paths stored in the trusted data transmission path table, the determination being based on a comparison of the identified second data transmission path to each of the plurality of trusted data transmission paths stored in the trusted data transmission path table; and

assign a trust level to the second data transmission path in response to a determination that the second data transmission path is not one of the plurality of trusted data transmission paths stored in the trusted data transmission path table; and

store the second data transmission path, based upon its trust level, as a data transmission path in a log of untrusted data transmission paths.

20. The computer program product of claim 19 , wherein the program code includes further instructions to:

receive an identification of at least a third data transmission path between the source node and the destination node in the computer network during the communication session;

determine whether the third data transmission path is one of the plurality of trusted data transmission paths stored in the trusted data transmission path table, the determination being based on a comparison of the identified third data transmission path to each of the plurality of trusted data transmission paths stored in the trusted data transmission path table;

determine whether the third data transmission path is one of the plurality of trusted data transmission paths stored in the untrusted data transmission path log in response to a determination that the identified third data transmission path is not one of the plurality of trusted data transmission paths stored in the trusted data transmission path table;

assign an increased trust level to the third data transmission path in response to a determination that the third data transmission path is one of the data transmission paths stored in the untrusted data transmission path log; and

store the third data transmission path in the untrusted data transmission path log in a position based upon its trust level.

21. The computer program product of claim 20 , wherein the assigned trust level for the third data transmission path increases each time the third data transmission path between the source node and the destination node is received by the database system.

22. The computer program product of claim 21 , wherein the plurality of instructions, when executed, further cause the one or more processors to store the third data transmission path in the trusted data transmission path table when the trust level associated with the third data transmission path is greater than a threshold value.