METHOD AND SYSTEM FOR MONITORING NETWORK ACTIVITY

Systems and techniques are described herein for monitoring network activity between a customer premise and the Internet, identifying data packets for review that are exchanged between the customer premise and the Internet, determining Internet Protocol address information for the data packets, receiving device name information associated with the data packets, and sending information to the customer premise that includes the device name and alert information related to the data packets.

FIELD

The present disclosure generally relates to monitoring data traffic at an internet service provider to identify a particular customer device that may be associated with suspicious activity, where the data traffic is sent between a customer premise and the Internet. This includes obtaining information from a router at the customer premise to help identify the customer device associated with the suspicious activity.

BACKGROUND

Internet Service Providers (ISPs) connect a wide range of customers to the Internet. Some of those customers are small and medium size businesses, and those customers may benefit from cybersecurity services. Some approaches for providing those cybersecurity services include client-side solutions with firewalls, and/or router firmware/agents. However, deploying those types of services may not be appropriate for the ISP and/or customer. Monitoring network traffic at the ISP using protocols like netflow may require capital-intensive collector appliances deployed at the customer premise. Although a netflow solution can generate massive amounts of flow data, this is generally captured post-NAT, and therefore it is still unable to identify a specific client device on the customer network that may be infected or compromised. The methods and systems described herein address some of those issues.

SUMMARY

Techniques and systems are described herein for monitoring network activity and identifying a customer device that may be associated with suspicious Internet activities.

According to at least one example, a method is provided for monitoring network activity. The method includes: monitoring a plurality of data packets exchanged between a local network and an external network; identifying, from the plurality of data packets, at least one data packet for review; determining Internet Protocol (IP) address information associated with the at least one data packet; receiving first information from a first device connected to the local network, the first information including at least a device name associated with the IP address information; and generating and sending second information that includes at least the device name and alert information related to the at least one data packet.

In another example, a system for monitoring network activity is provided that includes a storage configured to store instructions and at least one processor configured to execute the instructions and cause the at least one processor to: monitor a plurality of data packets exchanged between a local network and an external network; identify, from the plurality of data packets, at least one data packet for review; determine Internet Protocol (IP) address information associated with the at least one data packet; receive first information from a first device connected to the local network, the first information including at least a device name associated with the IP address information; and generate and send second information that includes at least the device name and alert information related to the at least one data packet.

In another example, a non-transitory computer-readable medium is provided that has stored thereon instructions that, when executed by one or more processors, cause the one or more processors to: monitor a plurality of data packets exchanged between a local network and an external network; identify, from the plurality of data packets, at least one data packet for review; determine Internet Protocol (IP) address information associated with the at least one data packet; receive first information from a first device connected to the local network, the first information including at least a device name associated with the IP address information; and generate and send second information that includes at least the device name and alert information related to the at least one data packet.

In another example, an apparatus for monitoring network activity is provided. The apparatus includes: means for monitoring a plurality of data packets exchanged between a local network and an external network; means for identifying, from the plurality of data packets, at least one data packet for review; means for determining Internet Protocol (IP) address information associated with the at least one data packet; means for receiving first information from a first device connected to the local network, the first information including at least a device name associated with the IP address information; and means for generating and sending second information that includes at least the device name and alert information related to the at least one data packet.

In some aspects, the method, apparatuses, and computer-readable medium described above can include identifying the at least one data packet for review based on threat information.

In some aspects, the method, apparatuses, and computer-readable medium described above can include receiving the first information according to the Device Data Model for TR-069.

In some aspects, the method, apparatuses, and computer-readable medium described above can include using the Customer Provided Equipment (CPE) Wide Area Network (WAN) management protocol to receive the first information.

In some aspects, the method, apparatuses, and computer-readable medium described above can include sending at least some of the second information to an electronic mail address associated with the local network.

In some aspects, the method, apparatuses, and computer-readable medium described above can include posting at least some of the second information to a customer portal associated with the local network.

In some aspects, the method, apparatuses, and computer-readable medium described above can include monitoring data exchanged between a plurality of local networks and the external network; and identifying threat information based on the monitored data.

In some aspects of the method, apparatuses, and computer-readable medium described above, the external network is the Internet.

In some aspects of the method, apparatuses, and computer-readable medium described above, the alert information related to the at least one data packet includes threat information.

In some aspects of the method, apparatuses, and computer-readable medium described above, the first information further includes media access control (MAC) address information.

DETAILED DESCRIPTION

Referring toFIG.1, system100includes at least an internet service provider (ISP)112, which is connected to a customer premise110. The connection between ISP112and customer premise110might be wireless, or it might be a physical connection that uses coaxial cable, fiber optic cable, or twisted pair telephone line. The form of connection between ISP112and customer premise110is not particularly important.

Customer premise110might be a business, or it might be a residence. In general, customer premise110includes more than one connected device, such as server102, and one or more user client devices104. Server102and user client devices104are electronically connected, such as through local network106. Network106might be a physical network made of cable, such as ethernet, and/or it might be a wireless network such as WiFi. Access to network106for individual user client devices104typically occurs through a hardwire ethernet connection, or through a wireless access point. The connection between ISP112and customer premise110is typically through a router108at each location. To ensure interoperability between different brands of equipment, routers108generally conform to established standards. TR-069 and TR-181, which are managed and maintained by The Broadband Forum, are examples of these established standards.

ISP112provides customer premise110with a connection to the Internet116. That connection to the Internet allows customer premise110to send and receive information according to established Internet standards. In general, unless an end-user is very large and sophisticated, they will use the services of an ISP to provide and maintain a connection to the Internet116. Examples of ISPs connected to the Internet116are illustrated inFIG.1. A connection between ISP112and the Internet116requires the use of specific protocols. As illustrated, router109provides that connection, and because it must conform to those specific Internet protocols, it may be different from router108, which connects to customer premise110.

To manage and maintain the various functions required by ISP112, one or more servers103are connected to routers108and109. Many of the features described herein are performed by server103.

ISP112is in a unique position, positioned between customer premise110and the Internet116. In that position, all traffic that customer premise110sends to the Internet116, or receives from the Internet116will pass through ISP112. Virtually all of that traffic is contained in data packets that are formatted according to one or more standards. The data packets themselves include Internet Protocol (IP) address information that identifies the data packet sender, and the intended recipient of the data packet. Even when some of the data contained within the data packets is encrypted, the address information is exposed so the data packets can be properly routed as they travel through various routers, switches, and connections from the source to the destination.

Sadly, bad actors can exploit vulnerabilities in a customer premise110using the Internet. Computer viruses, ransom ware, denial of service attacks and other bad acts mean that monitoring traffic between customer premise110and the Internet116is important. This monitoring can be performed from within the customer premise110, in which case a network administrator will generally have nearly full access to all traffic on customer local network106, as well as all traffic that passes to and from the Internet116through router108. This can allow the network administrator to identify malicious activity. In addition, because the monitoring is being done by a network administrator or trusted entity connected to customer premise110, that administrator has access to internal router tables, and device identification, and can generally determine which particular device might be compromised.

Good network administrators are in short supply, and a small or medium size company may not have such an individual. By contrast ISP112will almost certainly have qualified network administrators. But, a network administrator working at ISP112will generally have no access, or only minimal access to the internal workings of customer premise110. What ISP112has access to is the traffic passing between the Internet116and many different customer premises110. By monitoring the traffic through the ISP, it is often possible to determine that there is some suspicious or known malicious action occurring. This could be the exchange of data packets with a known malicious IP address. It could also be unusual higher activity levels at certain times of the day, when the history has shown minimal traffic. It could also be an increase in levels of activity to/from one particular IP address that is attached to customer premise110.

It is possible for ISP112to alert the customer of that suspicious activity, and it becomes the responsibility of the customer to determine which particular device may have been compromised. For smaller size companies without a dedicated network administrator, this may not help much, because tracking down a suspect device associated with that IP address may require logging into router108and then accessing the router tables, or accessing other information.

The features described herein allow ISP112to include additional information identifying the device that may have been compromised along with the alert of suspicious activity.

Referring toFIG.2, features of ISP112and customer premise110are illustrated in block form. Some of the features of ISP112include a security analytics platform, an auto-configuration server, Enterprise Resource Planning (ERP)/Customer Relationship Management (CRM), a customer portal, and electronic communications, such as e-mail and/or text messaging.

The components of the security analytics platform collect information from customer premise110. This collection might be periodic, such as every 15 seconds, or it might be event driven, such as following identification of suspicious activity. The collected information from customer premise110might include known hosts, source and destination IP addresses, ports and protocols. This collected information can be accessed by server103from customer premise110using network management mechanisms, such as the auto-configuration server.

As previously mentioned, the Broadband Forum manages and maintains standards, and TR-069 (also known as Customer Premise Equipment WAN Management Protocol (CWMP)) is one of those standards. TR-069 describes an Internet protocol that is based on XML/SOAP, and in certain aspects it enables remote configuration of network devices. If router108at customer premise110complies with the TR-069 standard, then it is an example of a network device that can be remotely configured. The remote configuration of router108at customer premise110can thus be performed by ISP112.

Specifically, the device data model for TR-069, which is described in TR-181 Issue 2 Amendment 14, recites use cases, with a particular use case being:

IV.5 Provide Extended Home Networking Topology View

Another use case is to determine the topology of the home network behind the gateway. For a generic understanding of the network, the Host table provides information such as the layer2and layer3interfaces via which the Host is connected as well as DHCP lease information for each connected Host.If the operator is interested in UPnP devices in the home network, the UPnP.Discovery tables (RootDevice, Device, and Service) provide that information in addition to the Host table entries that correspond to a particular UPnP Root Device, Device, or Service.Finally for CWMP enabled CPEs, the ManageableDevice table within the ManagementServer object provides information about the CWMP managed devices that the CPE has learned about through the DHCP message exchange defined in TR-069 [2] Annex F.

The Host table mentioned above is further described in TR-181-2-2-0, an example of which is available at: https://cwmp-data-models.broadband-forum.org/tr-181-2-2-0.html. For devices that use IPV4, the field “Device.Hosts.Host[x].IPv4Address[y].IPAddress” can be retrieved by the auto-configuration server of ISP112from router108at customer premise110. The corresponding field would be “Device.Hosts.Host[x].IPv6Address[y].IPAddress” for IPV6.

This is an extract with descriptions of those fields:

Device.Hosts.Host.{i}.IPv4Address.{i}.objectThe host's known IPv4 addresses. Thisincludes any addresses assigned viaDHCP, which can also be accessed viathe DHCPClient reference.At most one entry in this table can existwith a given value for IPAddress.IPAddressstring(15)[IPv4Address] IPv4 address.Device.Hosts.Host.{i}.IPv6Address.{i}.objectThe host's known IPv6 addresses. Thisincludes any addresses assigned viaDHCP, which can also be accessed viathe DHCPClient reference.At most one entry in this table can existwith a given value for IPAddress.IPAddressstring(45)[IPv6Address] IPv6 address.Device.Hosts.objectThis object provides information abouteach of the hosts on the LAN, includingthose whose IP address was allocatedby the CPE using DHCP as well as hostswith statically allocated IP addresses. Itcan also include non-IP hosts.Device.Hosts.Host.{i}.objectHost table.At most one entry in this table can existwith a given value for Alias, or with agiven value for PhysAddress.Aliasstring(64)A non-volatile handle used to referencethis instance. Alias provides amechanism for an ACS to label thisinstance for future reference. An initialunique value MUST be assigned whenthe CPE creates an instance of thisobject.PhysAddressstring(64)Unique physical identifier of the host.For many layer 2 technologies this istypically a MAC address.HostNamestring(64)The device's host name or an emptystring if unknown.

ISP112is able to collect this information on a periodic basis, such as when an unknown internal IP is found in the PortMapping table, or some other trigger event. Thus, for all Host[s] entries, retrieve PhysAddreess (MAC address) and HostName parameters to help identify the particular device. The MAC address can uniquely identify a network interface device that is generally installed in a particular device and providing a wired or wireless connection to router108within the customer premise. The HostName may include a name that has been assigned to a particular device, such as “J_Smith_Laptop.” Because a MAC address is unique, it is possible to identify the associated device (computer, phone etc.). However, the MAC address is simply a number, such as 60-F2-62-EC-45-41, and doesn't readily translate to an identifiable device that is connected to router108. Given a MAC address, a small business owner can eventually determine the associated device. Where the HostName is included, and it has a plain text description to identify a particular device (such as “J_Smith_Laptop”), that HostName may be more helpful information to the small business owner than the MAC address as they search for the specific device that might be compromised.

In addition, for all IPv4Address[y] or IPv6Address[y], retrieve the IPAddress. The retrieved data is checked to ensure it is valid. If valid, then normalize the data, such as use of conventional string format, with no extra zeros or spaces, zero-pad to ensure all IPs are 15 (IPv4) or 45 (IPv6) characters long, and then convert to some standard format, such as binary 4-byte format. By normalizing the data, different formats from different systems can be put into a common format.

Similar to the MAC address, a customer can use the IPAddress information to identify a particular device, but the IPAddress can change over time. Thus, if the HostName is available, it may be more helpful.

The discussion above with reference to TR-069 refers to Device.Hosts information. That Device.Hosts information is important, but separate from the NAT tables. The NAT tables can be used to translate an “outside” IP address/port/protocol back to an “inside” IP address which is then used with the Device.Hosts table to identify the device by name or MAC.

ISP112is able to provide alerts to the customer, such as indications a host is communicating with a known command and control (C&C) server, crypto mining operations, etc. An alert can also be provided when it appears a host is participating in a distributed denial-of-service (DDoS) attack. All of these might be considered threats, and appropriate for alerts to the customer. The alert can include any or all of the information that is retrieved, such as details on the specific threat, the IPAddress, the HostName, the MAC Address etc.

The alert information might be specific to the customer premise, or it might include generic information that is not specific to a particular customer premise.

Alerts from ISP112to the customer could be in the form of an e-mail or text message. The alerts might also be posted or provided through the customer portal.

ISP112is also able to monitor the connections of other customer premises that are serviced, and in this way ISP112can identify threats that are occurring on one customer system, and use that identified threat information as it monitors the other customer connections to other systems.

Various use case examples will now be described using the systems and techniques described herein.

FIG.4is a flow diagram illustrating an example of a process400for monitoring network activity, and performing one or more functions based on the monitored activity. At block402, the process400includes monitoring, at server103, a plurality of data packets that are exchanged between a local network (106) and an external network (116.) The data packets generally confirm to Internet Protocols (IP), where they include IP address information of sender and intended recipient, as well as payload.

At block404, the process400includes identifying, at server103, and from the plurality of monitored data packets, at least one data packet for review. The at least one data packet may be selected for review because it appears to be associated with some form of threat or compromise. The compromise or threat might be associated with a computer virus, a ransom ware attack, a denial of service attack, or any other form of malicious activity.

At block406, the process400includes determining internet protocol (IP) address information associated with the at least one data packet. The IP Address information included in the data packet header may be used for this.

At block408, the process400includes receiving first information from a first device connected to the local network, where that first information includes at least a device name associated with the IP Address information. As described above, this may include extracting information from the Host table that includes MAC Address, Alias, PhysAddress and/or NostName information.

At block410, the process400includes generating and sending second information from server103that includes at least the device name, and alert information related to the at least one data packet. The device name might be the MAC Address, Alias, PhysAddress or the HostName information. The alert information might expand on the suspicious activity or possible compromise, such as a computer virus, a ransom ware attack, or a denial of service attack.

In some examples, the external network in process400is the Internet. In other examples, the alert information related to the at least one data packet includes threat information. In other examples, the first information includes media access control (MAC) address information. The process400can further include identifying the at least one data packet for review based on threat information. The process400can further include receiving the first information according to the Device Data Model for TR-069. The process400can further include using the Customer Provided Equipment (CPE) Wide Area Network (WAN) management protocol to receive the first information. The process400can further include sending at least some of the second information to an electronic mail address associated with the local network. The process400can further include posting at least some of the second information to a customer portal associated with the local network. The process400can further include monitoring data exchanged between a plurality of local networks and the external network; and identifying threat information based on the monitored data.

The components of the devices and/or servers configured to perform the processes described herein can be implemented in circuitry. For example, the components can include and/or can be implemented using electronic circuits or other electronic hardware, which can include one or more programmable electronic circuits (e.g., microprocessors, graphics processing units (GPUs), digital signal processors (DSPs), central processing units (CPUs), and/or other suitable electronic circuits), and/or can include and/or be implemented using computer software, firmware, or any combination thereof, to perform the various operations described herein.

FIG.3is a diagram illustrating an example of a system for implementing certain aspects of the techniques described herein. In particular,FIG.3illustrates an example of ISP112server103, which can be, for example, any computing device making up internal computing system, a remote computing system, another computing device or system, or any component thereof in which the components of the system are in communication with each other using connection305. Connection305can be a physical connection using a bus, or a direct connection into processor310, such as in a chipset architecture. Connection305can also be a virtual connection, networked connection, or logical connection.

Example server103includes at least one processing unit (CPU or processor)310and connection305that couples various system components including system memory315, such as read-only memory (ROM)320and random access memory (RAM)325to processor310. Server103can include a cache312of high-speed memory connected directly with, in close proximity to, or integrated as part of processor310.

Processor310can include any general purpose processor and a hardware service or software service, such as services332,334, and336stored in storage device330, configured to control processor310as well as a special-purpose processor where software instructions are incorporated into the actual processor design. Processor310may essentially be a completely self-contained computing system, containing multiple cores or processors, a bus, memory controller, cache, etc. A multi-core processor may be symmetric or asymmetric.

To enable user interaction, server103includes an input device345, which can represent any number of input mechanisms, such as a microphone for speech, a touch-sensitive screen for gesture or graphical input, keyboard, mouse, motion input, speech, etc. Server103can also include output device335, which can be one or more of a number of output mechanisms, including speakers. In some instances, multimodal systems can enable a user to provide multiple types of input/output to communicate with server103. Server103can include communications interface340, which can generally govern and manage the user input and system output. The communication interface may perform or facilitate receipt and/or transmission wired or wireless communications using wired and/or wireless transceivers, including those making use of an audio jack/plug, a microphone jack/plug, a universal serial bus (USB) port/plug, an Apple® Lightning® port/plug, an Ethernet port/plug, a fiber optic port/plug, a proprietary wired port/plug, a BLUETOOTH® wireless signal transfer, a BLUETOOTH® low energy (BLE) wireless signal transfer, an IBEACON® wireless signal transfer, a radio-frequency identification (RFID) wireless signal transfer, near-field communications (NFC) wireless signal transfer, dedicated short range communication (DSRC) wireless signal transfer, 802.11 Wi-Fi wireless signal transfer, wireless local area network (WLAN) signal transfer, Visible Light Communication (VLC), Worldwide Interoperability for Microwave Access (WiMAX), Infrared (IR) communication wireless signal transfer, Public Switched Telephone Network (PSTN) signal transfer, Integrated Services Digital Network (ISDN) signal transfer, 3G/4G/5G/LTE cellular data network wireless signal transfer, ad-hoc network signal transfer, radio wave signal transfer, microwave signal transfer, infrared signal transfer, visible light signal transfer, ultraviolet light signal transfer, wireless signal transfer along the electromagnetic spectrum, or some combination thereof. The communications interface340may also include one or more Global Navigation Satellite System (GNSS) receivers or transceivers that are used to determine a location of server103based on receipt of one or more signals from one or more satellites associated with one or more GNSS systems. GNSS systems include, but are not limited to, the US-based Global Positioning System (GPS), the Russia-based Global Navigation Satellite System (GLONASS), the China-based BeiDou Navigation Satellite System (BDS), and the Europe-based Galileo GNSS. There is no restriction on operating on any particular hardware arrangement, and therefore the basic features here may easily be substituted for improved hardware or firmware arrangements as they are developed.

Services332,334,336may include one or more of the security analytics platform, the auto-configuration server, the customer portal, the ERP/CRM, and the electronic communication e-mail/text illustrated inFIG.2.

Illustrative aspects of the disclosure include:

Aspect 1: A method of monitoring network activity, the method comprising: monitoring a plurality of data packets exchanged between a local network and an external network; identifying, from the plurality of data packets, at least one data packet for review; determining Internet Protocol (IP) address information associated with the at least one data packet; receiving first information from a first device connected to the local network, the first information including at least a device name associated with the IP address information; and generating and sending second information that includes at least the device name and alert information related to the at least one data packet.

Aspect 2: The method according to Aspect 1, wherein the external network is the Internet.

Aspect 3: The method according to any of Aspects 1 to 2, further comprising: identifying the at least one data packet for review based on threat information.

Aspect 4: The method according to any of Aspects 1 to 3, further comprising: receiving the first information according to the Device Data Model for TR-069.

Aspect 5: The method according to any of Aspects 1 to 4, further comprising: using the Customer Provided Equipment (CPE) Wide Area Network (WAN) management protocol to receive the first information.

Aspect 6: The method according to any of Aspects 1 to 5, wherein the alert information related to the at least one data packet includes threat information.

Aspect 7: The method according to any of Aspects 1 to 6, further comprising: sending at least some of the second information to an electronic mail address associated with the local network.

Aspect 8: The method according to any of Aspects 1 to 7, further comprising: posting at least some of the second information to a customer portal associated with the local network.

Aspect 9: The method according to any of Aspects 1 to 8, wherein the first information further includes media access control (MAC) address information.

Aspect 10: The method according to any of Aspects 1 to 9, further comprising: monitoring data exchanged between a plurality of local networks and the external network; and identifying threat information based on the monitored data.

Aspect 11: A system for monitoring network activity, the system comprising: a storage configured to store instructions; and at least one processor configured to execute the instructions and cause the at least one processor to: monitor a plurality of data packets exchanged between a local network and an external network; identify, from the plurality of data packets, at least one data packet for review; determine Internet Protocol (IP) address information associated with the at least one data packet; receive first information from a first device connected to the local network, the first information including at least a device name associated with the IP address information; and generate and send second information that includes at least the device name and alert information related to the at least one data packet.

Aspect 12: The system according to Aspect 11, wherein the external network is the Internet.

Aspect 13: The system according to any of Aspects 11 to 12, wherein the at least one processor is further configured to execute the instructions and cause the at least one processor to: identify the at least one data packet for review based on threat information.

Aspect 14: The system according to any of Aspects 11 to 13, wherein the at least one processor is further configured to execute the instructions and cause the at least one processor to: receive the first information according to the Device Data Model for TR-069.

Aspect 15: The system according to any of Aspects 11 to 14, wherein the at least one processor is further configured to execute the instructions and cause the at least one processor to: use the Customer Provided Equipment (CPE) Wide Area Network (WAN) management protocol to receive the first information.

Aspect 16: The system according to any of Aspects 11 to 15, wherein the alert information related to the at least one data packet includes threat information.

Aspect 17: The system according to any of Aspects 11 to 16, wherein the at least one processor is further configured to execute the instructions and cause the at least one processor to: send at least some of the second information to an electronic mail address associated with the local network.

Aspect 18: The system according to any of Aspects 11 to 17, wherein the at least one processor is further configured to execute the instructions and cause the at least one processor to: post at least some of the second information to a customer portal associated with the local network.

Aspect 19: The system according to any of Aspects 11 to 18, wherein the first information further includes media access control (MAC) address information.

Aspect 20: The system according to any of Aspects 11 to 19, wherein the at least one processor is further configured to execute the instructions and cause the at least one processor to: monitor data exchanged between a plurality of local networks and the external network; and identify threat information based on the monitored data.

Aspect 21: A non-transitory computer-readable medium is provided that has stored thereon instructions that, when executed by one or more processors, cause the one or more processors to perform operations according to any of Aspects 1 to 20.

Aspect 22: An apparatus for monitoring network activity is provided, comprising one or more means for performing operations according to any of Aspects 1 to 20.