Network security

There is provided a network security method in a computer network. The method comprises detecting, by a gateway computer, a target device being connected to the computer network, detecting the target device transmitting a DNS query for resolving a hostname into an IP address, transmitting a query to a content rating system, wherein the query comprises the resolved hostname related to the DNS query of the target device, receiving, from the content rating system, a list of categorization categories assigned to the resolved hostname, determining a type of the target device on the basis of the received list of categorization categories assigned to the hostname, and generating a security related decision on the basis of the determined type of the target device.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to, and the benefit of, United Kingdom Patent Application No. 1907200.8, filed May 22, 2019, which is incorporated by reference herein in its entirety.

Field of the Invention

The present invention relates to network security and more specifically to network security related to Internet of Things (IoT) devices.

DEFINITIONS

This specification uses definitions of IP protocol in RFC 791 and DNS system in RFC 1034 as examples of the embodiments as follows:Target Device IP networking device, subject for classification as IoT deviceGateway IP networking device that forwards data packets between the Target Device and WAN or InternetDNS Interceptor Software component running in the Gateway and capable of intercepting DNS traffic from the Target DeviceContent Rating System Software system that matches hostname to the list of string labels (Content Categories) specifying the type of content available from the Internet resourceClassifier Software component that updates the Report and runs the Classification Criteria checkReport Document describing network activity of the Target DeviceClassification Criteria Function that takes variables from the Report and produces classification result

BACKGROUND

Rapid growth of Internet of Things (IoT) devices have raised concerns about the security of the IoT devices. For example, several vendors are producing small IoT devices having Internet connectivity that may suffer from poor security implementations and lack mechanisms for eliminating security vulnerabilities. In order to control security risks of the IoT devices, it is necessary to detect the presence of the IoT devices in the computer network.

Some of the known methods to detect IoT devices use fingerprinting technique where a detection agent collects certain metrics from IoT device's network activity and compares this to a reference metric that has been collected in advance by a system vendor. However, this requires preliminary knowledge of the specific IoT devices such as building a fingerprint database.

Securing computer networks having vulnerable IoT devices requires identifying the types of devices being connected to the network before further actions for minimizing the damages resulting from the vulnerabilities related to such devices can be taken.

SUMMARY

Various aspects of examples of the invention are set out herein.

According to an aspect of the invention, there is provided a method comprising: detecting, by a gateway computer, a target device being connected to the computer network; detecting the target device transmitting a DNS query for resolving a hostname into an IP address; transmitting a query to a content rating system, wherein the query comprises the resolved hostname related to the DNS query of the target device; receiving, from the content rating system, a list of categorization categories assigned to the resolved hostname; determining a type of the target device on the basis of the received list of categorization categories assigned to the hostname; and generating a security related decision on the basis of the determined type of the target device.

According to an aspect of the invention, there is provided a computer apparatus that acts as a gateway computer in a computer network comprising: a memory configured to store computer program code, and a processor configured to read and execute computer program code stored in the memory, wherein the processor is configured to cause the computer apparatus to perform: detecting a target device being connected to the computer network; detecting the target device transmitting a DNS query for resolving a hostname into an IP address; transmitting a query to a content rating system, wherein the query comprises the resolved hostname related to the DNS query of the target device; receiving, from the content rating system, a list of categorization categories assigned to the resolved hostname; determining a type of the target device on the basis of the received list of categorization categories assigned to the hostname; and generating a security related decision on the basis of the determined type of the target device.

According to an aspect of the invention there is provided computer program comprising computer readable code which, when run on a computer system or server, causes the computer system or server to: detect a target device being connected to a computer network; detect the target device transmitting a DNS query for resolving a hostname into an IP address; transmit a query to a content rating system, wherein the query comprises the resolved hostname related to the DNS query of the target device; receive, from the content rating system, a list of categorization categories assigned to the resolved hostname; determine a type of the target device on the basis of the received list of categorization categories assigned to the hostname; and generate a security related decision on the basis of the determined type of the target device.

According to an aspect of the invention there is provided a non-transitory computer storage medium, wherein computer program is stored on the computer readable medium, wherein the computer program comprises computer readable code which, when run on a computer system or server, causes the computer system or server to: detect a target device being connected to a computer network; detect the target device transmitting a DNS query for resolving a hostname into an IP address; transmit a query to a content rating system, wherein the query comprises the resolved hostname related to the DNS query of the target device; receive, from the content rating system, a list of categorization categories assigned to the resolved hostname; determine a type of the target device on the basis of the received list of categorization categories assigned to the hostname; and generate a security related decision on the basis of the determined type of the target device.

Embodiments of the invention are defined in the depended claims.

DETAILED DESCRIPTION

In order to provide improved determination on the type of devices having network connectivity, such as IoT devices, and thus improved network security, a method that does not require preliminary knowledge of the specific IoT devices nor building fingerprint databases is enabled. The method according to an embodiment covers a whole range of devices, not just those known to a vendor.

An example schematic diagram of a system according to the invention will be described with reference toFIG. 1. Embodiments of the present invention may, for example, relate to a system configuration in which a local network environment, such as a home or SOHO network, and the Internet are interconnected. In the local network environment, a server device serves as the Internet gateway computer2between local clients (here a target device1) and a server in the Internet. The gateway2may be an IP networking device that forwards data packets between the target device1and WAN or Internet5. In an embodiment, the gateway2may be a computer or a computer program configured to perform the tasks of a gateway, such as a default gateway or a router. The gateway2may also act as a proxy server and a firewall. The target device1, such as an IoT device, may be a computer running a number of applications. The target device1and the gateway computer1each typically comprise a hard drive, a processor, and RAM (not shown).

In the example system ofFIG. 1, the gateway2further comprises a classifier component20that updates a network activity report21relating to the target device1. The classifier component20may use a classification criteria22that is a function using variables from the network activity report21to produce a classification result. The gateway2also comprises a DNS interceptor component that is capable of intercepting DNS traffic from the target device1.

The gateway2may also exchange data with a content rating system database4. A content rating system is a software system that matches hostname to the list of string labels (Content Categories) specifying the type of content that is available from the Internet resource. In one embodiment, the database4is maintained by a content filtering service provider. The database4is updated with automatically or manually generated content rating information of the Internet resources. The process of data exchange between the gateway2and the database4is performed by a processing logic comprising hardware, software or a combination of both.

Although in the example ofFIG. 1, the elements are illustrated as separate or combined entities, it is possible to implement each element in any other combinations whether separate and/or combined.

FIG. 2is a flowchart of a method of detecting malware according to an embodiment.

In S201, a computer apparatus acting as a gateway computer in a computer network detects a target device being connected to the computer network.

In S202, the computer apparatus detects the target device transmitting a DNS query for resolving a hostname into an IP address.

In S203, the computer apparatus transmits a query to a content rating system. The query comprises the resolved hostname related to the DNS query of the target device.

In S204, the computer apparatus receives a list of categorization categories assigned to the resolved hostname.

In S205, the computer apparatus determines a type of the target device on the basis of the received list of categorization categories assigned to the hostname.

In S206, the computer apparatus generates a security related decision on the basis of the determined type of the target device.

FIG. 3is a signal sequence diagram that illustrates a more detailed example of the process.

In S301, the classifier component of the Gateway regularly checks whether the Target device is connected to the computer network and updates a network activity report by incrementing a counter t, the counter t being a number of time in seconds of how long the Target device has been connected to the network. The connectivity check may be implemented by using an ICMP (Internet Control Message Protocol) packet exchange or any other corresponding method.

In S302, while consuming Internet resources, the Target device makes DNS queries in order to resolve the hostnames into IP addresses. A DNS placement covers many application layer protocols at once. In S303, a DNS response message is sent to the Target device.

In S304, a DNS interceptor component in the Gateway activates when the DNS query is detected and conveys the resolved hostname to the classifier component of the Gateway.

In S305, the classifier component transmits a query to the Content Rating System relating to the hostname.

In S306, the classifier component receives back a list of categorization categories assigned to the hostname from the Content Rating System. In an embodiment, the classifier may then update one or more of the following variables in the network activity report of the Target device:

n: total number of content categories encountered,

m: total number of hostnames encountered,

c1. . . cn: string vector, the list of content categories encountered,

x1. . . xn: number vector, number of how many times each content category was encountered,

y1. . . ym: number vector, number of how many times each hostname was encountered.

In S307, when the network activity report contains sufficient amount of data, a result about the type of the Target device is produced by using a classification criteria. The result may, for example, determine whether the Target device is an IoT device. The classification criteria may be implemented by using any or more of the variables in the network activity report, any threshold values or any appropriate method, for example by using the following function:

where:incomplete: the input data is not sufficient for classificationgeneric: Target Device is not IoT deviceiot: Target Device is IoT device.

Finally, a security related decision can be generated that is based on the determined type of the Target device.

In S308and S309, when identifying the determined type of the target device as being vulnerable to a security threat, the target device and/or an application/service related to the target device may be handled by one or more of: limiting the connectivity of the target device and/or the application/service to a certain set of verified resources (e.g. ‘sandbox’), terminating a process or an action of the target device and/or an application/service, removing or otherwise making safe the target device and/or application/service and performing a further malware scan on the target device and/or application/service. Further, upon identifying the determined type of the target device as being vulnerable to a security threat, one or more following actions may be taken: sending from the gateway computer to a security server details of actions taken on the target device, sending from the security server to the gateway computer an indication as to whether or not the target device is malicious or suspicious, sending from the security server to the target device instructions for handling the target device and/or application/service, prompting the target device to kill and/or remove application/service.

In an embodiment, it is also possible that data relating to any target devices, applications or services exhibiting identified vulnerabilities/misconfigurations are stored in a database for further analysis/monitoring. In addition, a security application/server may provide a warning about the detected vulnerability/misconfiguration.

Next some use case examples of an embodiment according to the invention are described. The following classification examples enable determining whether the target devices are IoT devices by using the threshold criteria described previously in relation to S307ofFIG. 3and the threshold values of:

Example 2. XX IoT Hub

Example 3. XX NAS

Example 4. XX laptop