Source: https://patents.google.com/patent/US7590728B2/en
Timestamp: 2019-04-23 23:04:45+00:00

Document:
This application claims priority under 35 U.S.C. 119(e) to U.S. Provisional Patent Application No. 60/551,697, filed Mar. 10, 2004, entitled “SYSTEM AND METHOD FOR DETECTION OF ABERRANT NETWORK BEHAVIOR BY CLIENTS OF A NETWORK ACCESS GATEWAY” by Steven D. Tonnesen, which is hereby fully incorporated by reference herein.
The following applications are hereby fully incorporated by reference herein in their entirety: U.S. application Ser. No. 10/683,317, filed Oct. 10, 2003 entitled “SYSTEM AND METHOD FOR PROVIDING ACCESS CONTROL,” by Richard MacKinnon, Kelly Looney, and Eric White; U.S. Provisional Application No. 60/551,698, filed Mar. 10, 2004 entitled “SYSTEM AND METHOD FOR BEHAVIOR-BASED FIREWALL MODELING,” by Patrick Turley which converted into U.S. application Ser. No. 11/076,719, filed Mar. 10, 2005 entitled “SYSTEM AND METHOD FOR BEHAVIOR-BASED FIREWALL MODELING,” by Richard MacKinnon, Kelly Looney, and Eric White; U.S. Provisional Application No. 60/551,754, filed Mar. 10, 2004 entitled “SYSTEM AND METHOD FOR COMPREHENSIVE CODE GENERATION FOR SYSTEM MANAGEMENT,” by Keith Johnston which converted into U.S. application Ser. No. 11/078,223, filed Mar. 10, 2005 entitled “SYSTEM AND METHOD FOR COMPREHENSIVE CODE GENERATION FOR SYSTEM MANAGEMENT,” by Keith Johnston; U.S. Provisional Application No. 60/551,703, filed Mar. 10, 2004 entitled “SYSTEM AND METHOD FOR PROVIDING A CENTRALIZED DESCRIPTION/CONFIGURATION OF CLIENT DEVICES ON A NETWORK ACCESS GATEWAY,” by Patrick Turley and Keith Johnston; U.S. Provisional Application No. 60/551,702, filed Mar. 10, 2004 entitled “SYSTEM AND METHOD FOR ACCESS SCOPE CONTROL (“WALLED GARDENS”) FOR CLIENTS OF A NETWORK ACCESS GATEWAY,” by Patrick Turley, Keith Johnston, and Steven D. Tonnesen which converted into U.S. application Ser. No. 11/076,591, filed Mar. 10, 2005 entitled “METHOD AND SYSTEM FOR CONTROLLING NETWORK ACCESS,” by Patrick Turley, Keith Johnston, and Steven D. Tonnesen; U.S. Provisional Application No. 60/551,699, filed Mar. 10, 2004 entitled “SYSTEM AND METHOD FOR DYNAMIC BANDWIDTH CONTROL,” by Patrick Turley, et al.; U.S. Provisional Application No. 60/551,697, filed Mar. 10, 2004 entitled “SYSTEM AND METHOD FOR DETECTION OF ABERRANT NETWORK BEHAVIOR BY CLIENTS OF A NETWORK ACCESS GATEWAY,” by Steven D. Tonnesen which converted into U.S. application Ser. No. 11/076,652, filed Mar. 10, 2005 entitled “SYSTEM AND METHOD FOR DETECTION OF ABERRANT NETWORK BEHAVIOR BY CLIENTS OF A NETWORK ACCESS GATEWAY,” by Steven D. Tonnesen; U.S. Provisional Application No. 60/551,705, filed Mar. 10, 2004 entitled “SYSTEM AND METHOD FOR DOUBLE-CAPTURE/DOUBLE-REDIRECT TO A DIFFERENT LOCATION,” by Keith Johnston, et al. which converted into U.S. application Ser. No. 11/076,646, filed Mar. 10, 2005 entitled “SYSTEM AND METHOD FOR DOUBLE-CAPTURE/DOUBLE-REDIRECT TO A DIFFERENT LOCATION,” by Keith Johnston, et al.; U.S. Provisional Application No. 60/551,704, filed Mar. 10, 2004 entitled “SYSTEM AND METHOD FOR NETWORK MANAGEMENT XML ARCHITECTURAL ABSTRACTION,” by Keith Johnston and Mario Garcia which converted into U.S. application Ser. No. 11/076,672, filed Mar. 10, 2005 entitled “SYSTEM AND METHOD FOR NETWORK MANAGEMENT XML ARCHITECTURAL ABSTRACTION,” by Keith Johnston and Mario Garcia; and U.S. Provisional Application No. 60/660,408, filed Mar. 10, 2005 entitled “SYSTEM AND METHOD FOR PROVIDING A CENTRALIZED DESCRIPTION/CONFIGURATION OF CLIENT DEVICES ON A NETWORK ACCESS GATEWORK,” by Patrick Turley, et al.
testing the statistical information in the list associated with the first rule and the first client using at least one of a set of conditions corresponding to aberrant network behavior, wherein each of the set of test conditions comprises conditions associated with at least one list of the sets of lists and at least one of the set of test conditions corresponds to a second time period.
2. The system of claim 1, wherein the computer instructions are further operable to monitor a network connected to a second network interface for a second network communication.
testing the statistical information in the list associated with the first rule and the first client using at least one of a set of test conditions corresponding to aberrant network behavior, wherein each of the set of test conditions comprises conditions associated with at least one of the set of lists, at least one of the set of test conditions corresponds to a second time period and the testing is performed by the suspicion accumulator.
10. The method of claim 9, further comprising monitoring a network connected to a second network interface for a second network communication.
11. The method of claim 9, further comprising observing the network communication regardless of protocol.
12. The method of claim 10, wherein the network communication is received from a client on the first network and client is associated with an identifier.
13. The method of claim 11, wherein the identifier comprises a MAC address or an IP address for the client.
14. The method of claim 12, further comprising receiving at least one configuration adjustment from an internal source.
15. The method of claim 12, further comprising receiving at least one configuration adjustment from an external source.
16. The method of claim 15, further comprising determining if a client's network communication is aberrant by means of communication with the suspicion accumulator.
Albuquerque et al., "Network Border Patrol: Preventing Congestion Collapse and Promoting Fairness in the Internet", pp. 173-186, Feb. 2004.
Estevez-Tapiador et al., "Measuring Normality in HTTP Traffic for Anomaly-Based Intrusion Detection", pp. 175-193, Jun. 5, 2004.
Fan et al., "Distributed Real Time Intrusion Detection System for 3G", pp. 1566-1570, 2004.
Guangzhi et al., "A Framework for Network Vulnerability Analysis", pp. 289-294, 2002.
Hamano et al., "A Redirection-Based Defense Mechanism Against Flood-Type Attacks in Large-Scale ISP Networks", pp. 543-547, 2004.
International Preliminary Report on Patentability in PCT/US03/032268 dated Apr. 10, 2005, 3 pages.
International Preliminary Report on Patentability in PCT/US03/032912 dated Apr. 16, 2005, 3 pages.
Office Action issued in U.S. Appl. No. 11/076,719 dated Mar. 17, 2009, 8 pages.
Office Action issued in U.S. Appl. No. 11/076,719, dated Sep. 4, 2008, Patrick Turley, 7 pages.
Oh et al., Interaction Translation Methods for XML/SNMP Gateway, Jul. 11, 2003, retrieved from . . . http://web-archive.org/web/20030711162412/http://dpnm.postech.ac.kr/papers/DSOM/02/xml-snmp-gateway/xml-snmp-gateway.pdf, 12 pages.
Sarolahti, "Congestion Control on Spurious TCP Retransmission Timeouts", pp. 682-686, 2003.
Thottethodi et al., "Exploiting Global Knowledge to Achieve Self-Tuned Congestion Control for k-ary n-cube Networks", pp. 257-272, Mar. 2004.
Trabeisi et al., "Malicious Sniffing Systems Detection Platform", pp. 201-207, 2004.
U.S. Appl. No. 06/205,552, filed Mar. 20, 2001, Fudge.
U.S. Appl. No. 06/477,143, filed Nov. 5, 2002, Ginossar.
U.S. Appl. No. 09/821,565, filed Nov. 8, 2001, Ishikawa.
U.S. Appl. No. 09/881,147, filed Mar. 27, 2003, Cooper et al.
U.S. Appl. No. 10/000,396, filed Jun. 5, 2003, Copeland.
U.S. Appl. No. 10/072,683, filed Aug. 14, 2003, Zuk et al.
U.S. Appl. No. 10/195,326, filed Jan. 22, 2004, Lee et al.
U.S. Appl. No. 10/236,402, filed Mar. 11, 2004, Bauer.
U.S. Appl. No. 10/291,095, filed May 13, 2004, Cantrell et al.
U.S. Appl. No. 10/469,206, filed May 6, 2004, Ohtani et al.
U.S. Appl. No. 10/641,494, filed Feb. 17, 2005, Valluri.
U.S. Appl. No. 10/643,864, filed Sep. 2, 2004, Nakae et al.
U.S. Appl. No. 10/709,423, filed Jul. 7, 2005, Lu et al.
U.S. Appl. No. 10/930,392, filed Feb. 24, 2005, Cantrell et al.
U.S. Appl. No. 10/930,922, filed Feb. 3, 2005, Cantrell et al.
U.S. Appl. No. 10/953,326, filed Apr. 28, 2005, Suzuki.
U.S. Patent Office Action issued Jul. 9, 2008, in U.S. Appl. No. 11/076,672, Keith Johnston, 5 pages.
U.S. Patent Office Action issued Sep. 4, 2008, in U.S. Appl. No. 11/076,719, Patrick Turley, 7 pages.
Wen et al., "Development of a Snort-Based Security Network Management and Real-Time Intrusion Detection System", pp. 40-43, Feb. 2004.
Xing et al., "A Survery of Computer Vulnerability Assessment", pp. 1-11, Jan. 2004.
Yu et al., "Fuzzy Logic Based Adaptive Congestion Control Scheme for High-Speed Network", pp. 389-393, Aug. 2004.

References: Application No. 60
 Application No. 60
 Application No. 60
 Application No. 60
 Application No. 60
 Application No. 60
 Application No. 60
 Application No. 60
 Application No. 60
 Application No. 60