Intelligent detection and prevention of anomalies in interface protocols
An information handling system may include a management controller configured to provide out-of-band management of the information handling system. The management controller may be configured to: receive network traffic from a client information handling system, the network traffic relating to management of the information handling system; and transmit at least a portion of the network traffic to a traffic classifier. The traffic classifier may be configured to: determine a protocol associated with the network traffic; compare the network traffic with protocol-specific classification data based on the determined protocol; and determine, based on the comparison, a likelihood that the network traffic is malicious. Based on the determined likelihood exceeding a threshold, the management controller may be configured to execute a remedial action with respect to the network traffic.
1. An information handling system comprising:
a network interface adapter coupled to a data network; and
a management controller coupled to a management network separate from the data network, wherein the management controller is configured to provide out-of-band management of the information handling system, the out-of-band management including management while the information handling system is powered off;
wherein the management controller is configured to:
receive network traffic from a client information handling system via the management network, the network traffic relating to management of the information handling system;
transmit at least a portion of the network traffic to a traffic classifier, wherein the traffic classifier is configured to:
determine a protocol associated with the network traffic, wherein the protocol is a management protocol usable for out-of-band management of the information handling system via the management network and is selected from the group consisting of Intelligent Platform Management Interface (IPMI), Secure Shell (SSH), Remote Access Controller Administration (RACADM), Web Services-Management (WS-MAN), and Redfish;
compare the network traffic with protocol-specific classification data based on the determined protocol, wherein comparing the network traffic with the protocol-specific classification data includes evaluating headers and schemas of the network traffic to analyze protocol-specific fields of the network traffic for malicious content; and
determine, based on the comparison, a likelihood that the network traffic is malicious; and
based on the determined likelihood exceeding a threshold, execute a remedial action with respect to the network traffic.
2. The information handling system of claim 1 , wherein the remedial action includes ignoring the network traffic.
3. The information handling system of claim 1 , wherein the remedial action includes blocking future network traffic from the client information handling system.
4. The information handling system of claim 1 , wherein the remedial action includes notifying an administrator.
5. The information handling system of claim 1 , wherein the traffic classifier is configured to execute in a plurality of containers on a traffic classifier information handling system.
6. The information handling system of claim 1 , wherein the traffic classifier is configured to execute in a plurality of containers on a plurality of traffic classifier information handling systems.
7. The information handling system of claim 1 , wherein the traffic classifier is further configured to:
receive input from an administrator indicating an accuracy of the determined likelihood; and
update the protocol-specific classification data based on the input.
8. A method comprising:
in an information handling system comprising a network interface adapter coupled to a data network and a management controller coupled to a management network separate from the data network, wherein the management controller is configured to provide out-of-band management of the information handling system, the out-of-band management including management of the information handling system while the information handling system is powered off:
the management controller receiving network traffic from a client information handling system via the management network, the network traffic relating to management of the information handling system;
the management controller transmitting at least a portion of the network traffic to a traffic classifier, wherein the traffic classifier is configured to:
determine a protocol associated with the network traffic, wherein the protocol is a management protocol usable for out-of-band management of the information handling system via the management network and is selected from the group consisting of Intelligent Platform Management Interface (IPMI), Secure Shell (SSH), Remote Access Controller Administration (RACADM), Web Services-Management (WS-MAN), and Redfish;
compare the network traffic with protocol-specific classification data based on the determined protocol, wherein comparing the network traffic with the protocol-specific classification data includes evaluating headers and schemas of the network traffic to analyze protocol-specific fields of the network traffic for malicious content; and
determine, based on the comparison, a likelihood that the network traffic is malicious; and
based on the determined likelihood exceeding a threshold, the management controller executing a remedial action with respect to the network traffic.
9. The method of claim 8 , wherein the remedial action includes ignoring the network traffic.
10. The method of claim 8 , wherein the remedial action includes blocking future network traffic from the client information handling system.
11. The method of claim 8 , wherein the remedial action includes notifying an administrator.
12. The method of claim 8 , wherein the traffic classifier is further configured to:
receive input from an administrator indicating an accuracy of the determined likelihood; and
update the protocol-specific classification data based on the input.
13. The method of claim 8 , wherein the traffic classifier is configured to execute in a plurality of containers on a traffic classifier information handling system.
14. An article of manufacture comprising a non-transitory, computer-readable medium having computer-executable code thereon that is executable by at least one processor of at least one information handling system for:
receiving, from each of a plurality of management controllers of other information handling systems coupled to respective management networks separate from data networks of the other information handling systems, portions of network traffic forwarded from respective client information handling systems via the management networks, the network traffic relating to management via the management controllers, wherein the plurality of management controllers are configured to provide out-of-band management of the other information handling system, the out-of-band management including management of the other information handling systems while the other information handling systems are powered off;
determining a protocol associated with each portion of the network traffic, wherein the protocol is a management protocol usable for out-of-band management of the information handling system via the management network and is selected from the group consisting of Intelligent Platform Management Interface (IPMI), Secure Shell (SSH), Remote Access Controller Administration (RACADM), Web Services-Management (WS-MAN), and Redfish;
comparing each portion of the network traffic with protocol-specific classification data based on the respective determined protocol, wherein comparing the network traffic with the protocol-specific classification data includes evaluating headers and schemas of the network traffic to analyze protocol-specific fields of the network traffic for malicious content;
determining, based on the comparison, a likelihood that each portion of the network traffic is malicious; and
for each portion of the network traffic, based on the determined likelihood exceeding a threshold, causing each respective management controller to execute a remedial action with respect to the network traffic.
15. The article of claim 14 , wherein the remedial action includes ignoring the network traffic.
16. The article of claim 14 , wherein the remedial action includes blocking future network traffic from the client information handling system.
17. The article of claim 14 , wherein the remedial action includes notifying an administrator.
18. The article of claim 14 , wherein the computer-executable code is configured to execute in a plurality of containers on a single traffic classifier information handling system.
19. The article of claim 14 , wherein the computer-executable code is configured to execute in a plurality of containers on a plurality of traffic classifier information handling systems.
20. The article of claim 14 , wherein the computer-executable code is further executable for:
receiving input from an administrator indicating an accuracy of the determined likelihood; and
updating the protocol-specific classification data based on the input.