Patent ID: 6363489
Filing Date: 2002-03-26
Classification: H04L

Abstract:
A method for detecting and handling a communication from an unauthorized source on a network, the method comprising the steps of:(a) receiving the communication from the unauthorized source; (b) analyzing the communication for detecting an information gathering procedure; (c) if said information-gathering procedure is detected, indicating a source address of the communication as a suspected network reconnaissance collector; (d) returning an earmark to said suspected reconnaissance collector, such that said earmark includes specially crafted false data, and such that said earmark includes data that can serve to identify an unauthorized source; (e) analyzing each subsequent communication for a presence of said earmark; (f) if said earmark is present, indicating source address of the communication as a suspected network reconnaissance collector, and (g) if said source address is said intruder source address, applying intrusion handling procedures towards the communication from said intruder source address.