Patent ID: 8631496
Filing Date: 2014-01-14
Classification: H04L

Abstract:
1. A method of identifying an attacker device attempting an intrusion into a Transmission Control Protocol/Internet Protocol (TCP/IP) protocol based network, said method comprising: detecting, by at least one managed device of the network, an incoming TCP/IP connection by the attacker device to the network; after said detecting the incoming TCP/IP connection, performing a process that comprises determining that the incoming TCP/IP connection is a Net BIOS connection that has created an invalid logon by the attacker device, linking the invalid logon with the NetBIOS TCP/IP connection, retrieving event log information from a security event log of the network, and determining (i) that a userid of the invalid logon is a local userid defined on a local device of the at least one managed device, (ii) that the userid of the invalid logon is a userid in a list of userids used by viruses, or (iii) that the userid of the invalid logon is neither the local userid defined on the local device nor is in the list of userids used by viruses; and after said performing the process, storing the retrieved event log information in a central violation database of the network.