Source: http://www.freepatentsonline.com/y2002/0166063.html
Timestamp: 2019-12-15 12:40:19
Document Index: 511224225

Matched Legal Cases: ['art 1104', 'art 1104', 'art 1104', 'art 1104', 'art 1104', 'art 1704', 'art 1704', 'art 1104', 'Application No. 60']

System and method for anti-network terrorism - Cyber Operations, LLC
John III, Paul Lachman (Singer Island, FL, US)
Hsieh, Mansi (Los Angeles, CA, US)
10/086107
Cyber Operations, LLC (Suite 400, Jupiter, FL)
Download PDF 20020166063 PDF help
20090178108 ENTERPRISE SECURITY ASSESSMENT SHARING FOR OFF-PREMISE USERS USING GLOBALLY DISTRIBUTED INFRASTRUCTURE July, 2009 Hudis et al.
[0001] This application claims the benefit of priority to U.S. Provisional Patent Application Serial No. 60/272,712, entitled “System and Method for Anti-Network Terrorism,” filed Mar. 1, 2001. The complete disclosure of the above-identified provisional patent application is fully incorporated herein by reference.
[0004] Attacks on host network computer systems are an increasing problem for e-commerce companies, network communications providers, organizations, and governments. In a “denial of service” (DOS) attack on a host network, an attacker attempts to prevent legitimate users from accessing services provided by a particular host network. DOS attacks can essentially disable a single computer or an entire host network. Such a disruption in service can be costly to the host network provider in terms of lost revenue, repair costs, and lost productivity during the disruption.
[0006] One way to attack the host network's connectivity involves exploiting flaws in the TCP stack. The attacker establishes a connection to a victim computer of the host network. However, the attacker establishes the connection in such a way as to prevent the ultimate completion of the connection. In the meantime, the victim computer has reserved one or more of a limited number of data structures required to complete the impending connection. Accordingly, the attack denies legitimate connections while the victim computer waits to complete each “half-open” connection.
[0008] In today's network environment, the most problematic type of DOS attack includes “flooding” a host network with information. The flood of information can consume all available bandwidth of the host network's computing resources, thereby preventing legitimate network traffic from reaching the host network and preventing an individual user from accessing the services of the host network. The attacker can consume bandwidth through a network flood by generating a large number of packets, or a small number of extremely large packets, directed to the target network. Typically, those packets comprise Internet control message protocol (ICMP) ECHO packets, a user datagram protocol (UDP) stream attack, or a TCP SYN flood. In principle, however, the packets can include any form.
[0010] An attacker also can execute a more defined attack using spoofed packets called “Broadcast Amplification” or a “Smurf attack.” In this common attack, the attacker generates packets with a spoofed source address of the target. The attacker then sends a series of network requests using the spoofed packets to an organization having many computers. The packets contain an address that broadcast the packets to every computer at the organization. Every computer at the organization then responds to the spoofed packet requests and sends data to the target site. Accordingly, the target becomes flooded with the responses from the organization. Additionally, the target site may blame the organization for the attack.
[0044] FIG. 23 illustrates an exemplary “Insert Root Item” dialog window for the edit menu options illustrated in FIG. 22.
[0045] FIG. 24 illustrates an exemplary “Insert Child Item” dialog window for the edit menu options illustrated in FIG. 22.
[0046] FIG. 25 illustrates an exemplary “Edit Item” dialog window for the edit menu options illustrated in FIG. 22.
[0047] FIG. 26 illustrates an exemplary “Ant Config Page” dialog window for the edit menu options illustrated in FIG. 22.
[0049] FIG. 28 illustrates an exemplary “Set Countermeasure Box” dialog window for the countermeasure menu options illustrated in FIG. 27.
[0053] FIG. 32 illustrates an exemplary “Add/Edit Item” dialog window for the access control list manager window illustrated in FIG. 31.
[0054] FIG. 33 illustrates an exemplary “Downed IP Editor” for the window menu options illustrated in FIG. 30.
[0058] FIG. 37 illustrates an exemplary ACMS main screen having an “Alert” message displayed due to a detected DOS attack.
[0059] FIG. 38 illustrates an exemplary ACMS main screen having an “Exploit” warning due to a detected exploit attack.
[0075] Trace route module 214 can verify the source IP address of the attacking packets, can determine whether a single source or multiple sources produced the attack, and can determine whether the attack was initiated from a real or false IP address location. A false IP address is commonly referred to as a “spoofed” address. Attackers use spoofed address locations to conceal their true identity.
[0085] In step 425, the load threshold for the host network can be set. The load threshold can represent a percentage of the network capacity beyond which a network attack can be indicated. A parameter “load threshold” can be configurable and can allow an operator to set the level of the network load that system 106 considers intolerable. Thus, the load threshold can be customized for any network to accommodate different connections such as telephone modem, cable modem, or DSL connections. The threshold can be established based on a percentage of bandwidth capacity of the network. In one exemplary embodiment, the threshold can be based upon a scale of 1 to 255. Thus, a load threshold of 80 percent would equate to a numeric value of 204 load threshold (255×0.80=204).
[0086] In step 430, the sleep time can be set. The parameter “sleep time” can be the duration of the sleep cycle in seconds. The sleep time represents the amount of time system 106 will pause at step 315 (FIG. 3) between cycles of packet analysis. A single cycle includes collecting and analyzing the specified number of packets and sleeping. If the sleep time is set to zero, then packet analysis can proceed on a continuous basis.
[0087] In step 435, the number of packets to be analyzed during each cycle can be set. The parameter ‘packet polled’ can set the number of packets to sample in each listening cycle. In step 440, packet sniffing module 210 can collect the specified number of packets for analysis. For example, the number of packets to be analyzed during each cycle can be set to twenty. During each cycle, packet sniffing module 210 can collect and analyze twenty packets and then system 106 can sleep the predetermined amount of time (assuming that system 106 did not detect an attack).
[0092] The characteristics for each attack type can comprise a set of data that is common to each specific attack within its attack type. Most flood attacks are merely a derivative of an earlier version of the attack. The original version and its derivative comprise the same attack type. Accordingly, most flood attacks have a common set of data that can identify a specific attack as associated with an attack type. The set of data can comprise the repetitive pattern identified in step 510 discussed above. In this regard, “repetitive” means that each attack within the attack type includes that set of data.
[0096] Where ‘*’ stands for a sequence of digits, or specifically, a sequence number. Thus, the signature can allow the exemplary embodiment to match a partial pattern to the signature, regardless of the contents of the pair of sequence numbers.
[0101] For added reliability, the detection routine can be complemented by verification that the network traffic is unusually high before triggering an “Alert” message and/or countermeasure. Thus, in step 615, it can be determined whether decision module 206 will confirm the attack. If decision module 206 will not confirm the attack, then the method can branch directly to step 645 where an indication of the attack can be provided on GUI 220. From step 645, the method can proceed to step 320 (FIG. 3). If step 615 determines that decision module 206 will confirm the attack, then the method can branch to step 630. Additionally, if packet sniffing module 210 does not detect an attack in step 625 by determining that the packets include similar or matching data, then the method can also branch to step 630 for an alternative method of detecting the attack. In step 630, router daemon module 216 can interface with host router 104 to determine the current network load. Router daemon module 216 can then provide that information to decision module 206.
[0105] Thus, exemplary system 106 can provide an automated tool designed to monitor system traffic. The system loops around during two steps: listening and sleeping. During the listening cycle, system 106 can observe a configurable number of packets, watching for suspicious data. After identifying a suspicious pattern, system 106 can query host router 104 for network load information. If the load is within the configurable, load threshold, then system 106 can log the incident as a “Warning.” On the other hand, if the network load reaches the set threshold, then system 106 can launch a countermeasure routine and can log the time of the flood, the time of the countermeasure deployment, and the source and destination of the offending packet(s).
[0111] The host router can then be configured to deny or allow certain traffic destined for host network 101. In step 950, the access control list script can set host router 104 to “deny traffic from the source IP address to any destination.” Then in step 955, the access control list script can set host router 104 to “allow traffic from any other source to its destination.” In step 960, the access control list can be applied to the incoming interface of host router 104. At this point, the initiation of the single source countermeasure is complete. The following steps describe the operation of host router 104 to protect host network 101 from attack based on the single source countermeasure.
[0114] Thus, the exemplary method can provide “one-click” implementation of the access control file to host router 104. That “one-click” implementation can update the host router 104 to deny traffic having the attacking source IP address. Router daemon module 216 can comprise a program used by the A.N.T. server to interface with host router 104. Router daemon module 216 essentially can create a telnet session for the A.N.T. server and can execute router scripts (a series of commands for the router operating system) that perform specific functions. Router daemon module 216 also can import external variables from other information sources. Whether passed to router daemon module 216 via the command line, or stored in a config file, router daemon module 216 can import the data and can use it in conjunction with the router scripts. Accordingly, a single script can be executed each time a new attacking IP address or target IP address is identified, and router daemon module 216 can import that IP address to be used within the script.
[0119] Accordingly, the exemplary method can provide “one-click” implementation of the null route file on host router 104. That “one-click” implementation can update the host router 104 to null route traffic destined for the target IP address. Router daemon module 216 can implement the multiple source countermeasure similarly to the implementation of the single source countermeasure, as discussed above.
[0125] The countermeasure methods discussed above can be implemented as script files with a acl or null extension. The scripts can accomplish the tasks of modifying firewall rules to deny service to the attacking IP address or addresses and to null route packets with the target IP address. If the flooding is of the single-source type, no packets will be routed from that source to the victim IP address for the specified block time. If the flooding is of the multiple-source type, no packets will be routed to the victim IP address for a specified block time. The block time can be specified by the parameter “bkholedu” (black hole duration), which can be the duration of the block time period measured in minutes. That parameter can be established using the configuration screen of GUI 220, discussed below. The block time period can determine how long to block an IP address before system 106 allows it back on the network. That rule of modification can effectively render the victim computer unreachable from the Internet. As a result of launching either script, a log history can appear in “log.txt” (log text) in GUI 220 and can indicate deployment of the appropriate countermeasure.
[0130] A network bandwidth utilization chart 1104 can show in real time incoming and outgoing network traffic on a minute-by-minute basis. Chart 1104 can comprise a thirty hour time frame 1104a displayed across its x axis and traffic levels or “Bits/Bytes/Mbytes per Second” 1104b can displayed on its y axis. Chart 1104 can illustrate an inbound bandwidth utilization 1104c and outbound traffic 1104d. Chart 1104 can be constantly updated on a per minute basis. The time graph can be read from left to right, showing spikes in bandwidth utilization with the left edge depicting current network traffic. The traffic flows can also be color coded. For example, inbound bandwidth utilization 1104c can be illustrated in green, and outbound traffic 1104d can be illustrated in blue. For a larger view of an exemplary bandwidth utilization chart 1104, see FIG. 35.
[0132] FIG. 12 illustrates an exemplary downed interfaces screen 1200 referenced by function button 1110. Downed interfaces screen 1200 can provide the ability to display the network IP addresses that are not currently accessible to the Internet by the host system. A null route block 1202 can list all null routed IP addresses. Addresses listed in null route block 1202 are on the protected host network. However, traffic cannot be currently routed to them when they are in a “Downed Interface” table. Any packets directed towards these downed addresses will be promptly discarded by being directed to a null interface. In the case of a multi-sourced flood, the A.N.T. system will null route the target address for a pre-determined period of time. Thus, the malicious packets destined to a listed IP address do not slow down or stop legitimate traffic from reaching the host network.
[0134] Remove buttons 1206 can allow a system administrator manually to reverse the status of any downed IP address. Highlighting the entry and then pressing the “Remove” button will remove a downed IP address. Additionally, blocks 1202 and 1204 can display the block time (not shown) remaining for any listed downed IP address. That “Time Remaining” feature can be set accessing a configure screen by selecting the “Configure” button 1118, discussed below. The block time can be variable from 1 to 65,535 minutes.
[0135] FIG. 13 illustrates an exemplary down interface screen 1300 referenced by function button 1112. Screen 1300 can allow a system administrator to enter manually a “Source” and “Destination” IP address, along with a time duration to take down a network interface. That manual selection process can allow blocking of certain types of data to a network segment or taking an interface down at the router level. Screen 1300 can allow a simple solution to a difficult process in which the router will block traffic to and from a designated IP address at the discretion of the systems administrator. As in FIG. 12, a null route block 1302 can be dedicated to null routed IP addresses, while an access control list (ACL) block 1304 can list a programmed database of access control lists set-up by the systems administrator.
[0140] All passwords on this page can be encrypted for security purposes but can be changed from the web-based interface. Because the system can use a graph generated by Multi-Router Traffic Grapher (MRTG), the path to the graphic file can be also entered from this screen in block 1632. MRTG can allow the system the ability to show real-time traffic statistics, without directly logging in to the host router. The variables can allow the system to interact with other network components in the shortest possible time. A “Router Prompt” block 1604 can allow the system to communicate with the host router to execute commands automatically.
[0141] For example, the router name can be “core.” The prompt can be entered in the Router Prompt block 1604 as “core>.” A “Telnet Port” block 1608 can allow specification of a port on the host router that can be used to establish communications with the A.N.T. system. Normally, that port is port 23, which can be the standard telnet port for any operating system. A “Login Prompt” block 1610 can allow entry of the first router prompt after the communication link is established by the Telnet link to the host router.
[0145] Escape character can be ‘^ ]’.
[0148] A “Login Name” block 1612 can allow entry of the username for logging onto the router. On most routers, a “Login Name” may not be necessary to gain router access. Typically, only the router password is needed. In that case, the login name can be left blank. A “Password Prompt” block 1614 can allow entry of a normal prompt that the router gives a user when requesting a password. Normally, that prompt would be the word “Password.” The password can be established in block 1616.
[0149] An “Enable Prompt” block 1618 can allow entry of an enable prompt given when a user enters the enable mode of the router. The enable mode can allow high-level commands to be executed in the router. In most cases, the enable prompt can be the router prompt, followed by a pound sign (#), rather than the greater than sign (>). An “Enable Password” block 1620 can allow entry of a selectable password that can allow the user to enter high-level router commands. The password can be stored in an encrypted string on the A.N.T. system and may not be displayed in plain text.
[0150] A “Router Address” block 1622 can allow entry of the IP address at which the router resides. That IP address can be utilized by the system to telnet to the router to gain access. A “Packets Polled” block 1626 can allow entry of the number of packets that the system will collect and analyze during any given listening cycle. Once the system has collected the specified number of packets, it will begin to analyze them as discussed above. A “Sleep Time” block 1628 can allow entry of the duration of the sleeping cycle. The sleeping cycle can be varied by entering a specified time. A “Load Threshold” block 1630 can allow entry of a set level beyond which the system will detect or confirm a network flood attack.
[0151] A “Path to Graphics” block 1632 can allow entry of a default directory for the MRTG charts stored on the A.N.T. system, thereby enabling the “Main Page” to display the current log status and the system bandwidth chart in real time. An “Update Configuration” button 1634 can allow new configuration data to be written to a “config” file.
[0152] When more than one A.N.T. system is provided on a host network, a central monitoring station” (CMS) can be provided for monitoring each system within the network. The CMS can provide central command and control of A.N.T. systems on a distributed network A GUI for a CMS will now be described. FIG. 17 illustrates an exemplary main screen GUI 1700 for a CMS. Main screen 1700 can comprise three individual screens. The top screen can comprise an A.N.T. Central Monitoring Station (ACMS) screen 1701 of the windows command system, which can provide management and control over all deployed A.N.T. servers and routers. The number of A.N.T. servers and routers can be shown in a tree configuration view 1701b on the right side of ACMS screen 1701. Within this tree configuration can be a small icon 1708 for each A.N.T. server within the network. Icon 1708 can be color coded to indicate a status of the respective A.N.T. server. For example, a green icon 1708 can indicate normal operation, or a red icon 1708 can indicate an attack.
[0153] The left side 1701a of ACMS screen 1701 can display any warning messages and pertinent information relating to the message. The information can be displayed in the following blocks, which indicate the type of information contained therein: Source IP address block 1710, Destination IP address block 1712, the ANT Box Sending the Notification block 1714, Attack Type block 1716, Recurrence Rate block 1718, Time block 1720, and Packet Data window 1722. Below the Packet Data window 1722 can be additional buttons 1724a-d for functional management and countermeasure deployment. Buttons 1724a-d are discussed below with reference to FIGS. 37 and 38. A text block “Duration (sec)” 1726 can allow an operator to override the default time duration that an IP will be blocked from the host network.
[0155] An “ANT Central Monitoring Station Log” window 1702 can show the current status log of the A.N.T. server actively highlighted in the tree view 1701a. This information can be time and date stamped with the most current date on the bottom. Additionally, the information provided in window 1702 can be similar to the information provided in log entry block 1102 discussed above with reference to FIG. 11. For a larger view of log window 1702, see FIG. 36.
[0156] An “ANT Central Monitoring Station BANDWIDTH” chart 1704 can show a Multi-Router Traffic Grapher (MRTG) graph generated on the A.N.T. server highlighted in the tree view 1701a. Through block 1704, the MRTG can poll the router's SNMP data and can chart the relative inbound/outbound bandwidth utilization. By polling the router from the A.N.T. server and passing this SNMP data through A.N.T.'s communications protocol, the SNMP data can be secure from all unauthorized personnel. The information displayed in chart 1704 can be similar to the information displayed in chart 1104 discussed above with reference to FIG. 11.
[0160] The “Close” option of file menu options 1800 can allow closing the tree shown in tree configuration view 1701b of ACMS screen 1701. When clicked, all items in the tree view can be cleared, and the ACMS can allow the opening, or creation, of a .rtr file.
[0161] The “Save” option of file menu options 1800 can allow saving of any changes made to tree configuration view 1701b under the currently opened .rtr filename.
[0162] FIG. 21 illustrates an exemplary save as dialog window 2100 referenced by the “Save As” menu item of file menu options 1800. Window 2100 can allow changing the path and filename of an existing tree .rtr file and can allow saving it under a new name.
[0163] The “Exit” option of file menu options 1800 can be a common selection term to close out the current display window.
[0165] FIG. 23 illustrates an exemplary “Insert Root Item” dialog window 2300 referenced by the “Insert Root Item” menu item of edit menu options 2200. Window 2300 can allow adding a new item at the first level (the root level) of tree configuration view 1701b. All root level items can be at the network border level for quick and easy access to the entire network infrastructure.
[0166] FIG. 24 illustrates an exemplary “Insert Child Item” dialog window 2400 referenced by the “Insert Child Item” menu item of edit menu options 2200. Window 2400 can allow adding a new item below the root level (at the child level). Typically, those items comprise routers and or A.N.T. servers connected to the border routers and down the line. The further right in tree configuration view 1701b, the further the router or A.N.T. server resides from the border router. Such a layout can allow the ability to gain a quick picture of where an attack has been perpetrated within the network. Multiple routers/A.N.T. servers can reside at the same level in tree configuration view 1701b to depict multiple objects at the same level within the network infrastructure.
[0167] FIG. 25 illustrates an exemplary “Edit Item” dialog window 2500 referenced by the “Edit Item” menu item of edit menu options 2200. Window 2500 can appear when an object in the tree view is selected and the edit item option has be chosen. Window 2500 can allow the ability to modify the existing item in the tree configuration view 1701b.
[0168] The “Delete Item” of edit menu options 2200 can allow the user to delete a currently selected item in the tree configuration view 1701b.
[0169] FIG. 26 illustrates an exemplary “Ant Config Page” dialog window 2600 referenced by the “Ant Config Page” menu item of edit menu options 2200. Window 2600 can provide a windows based configuration file editor for an A.N.T. server highlighted in tree configuration view 1701b. The configuration file editor can allow changing the setup options for the currently selected A.N.T. server. All options such as those discussed above with reference to FIGS. 16A and 16B can be displayed in the configuration editor. All items except for passwords to the router(s) can be displayed in plain text and can be modified. The router passwords can be starred out to maintain security, but they can be changed from the editor screen. Window 2700 can include blocks and information similar to configuration screen 1600 discussed above with reference to FIGS. 16A and 16B.
[0171] FIG. 28 illustrates an exemplary “Set Countermeasure Box” dialog window 2800 referenced by the “Set Countermeasure Box” menu item of countermeasure menu options 2700. Window 2800 can allow entering an IP address and a username for a countermeasure server in address block 2802 and username block 2804, respectively. The countermeasure server can be the computer that the A.N.T. server will use to scan and attempt to exploit the offending computer.
[0173] The countermeasure server can be programmed with various exploits and offensive software routines by the end user. The countermeasure server can sit outside the host-protected network and can be located virtually anywhere in the world. When the countermeasure server is located outside the host protected network, the network's identity can be hidden from hostile threats. The countermeasure server can have the ability to launch attacks against a hostile computer posing a threat to the host-protected network. All communications between the ACMS and the countermeasure server can be encrypted with communications and encryption protocols. An example of such protocols is provided in U.S. Provisional Patent Application No. 60/291,815 of Sias, et al., filed May 17, 2001, and entitled “Xtream Management System. The complete disclosure of that provisional application is incorporated herein by reference.
[0174] FIG. 30 depicts exemplary window menu options 3000 referenced by window menu button 1734 of ACMS screen 1701. Window menu options 3000 can allow choosing which windows of the A.N.T. control system will be displayed at any time. The user can have a choice of displaying log window 1702, bandwidth utilization chart (MRTG) 1704, the Access List manager, and/or the downed interfaces for any particular router. This menu also can allow the end user to change the size of the icons in the tree view. Under the “Window” option the user has the ability to display any of the ACMS windows that compose the main screen. The Alert and tree views also can be in the main window.
[0175] The “Show Log Window” file option can display the log file 1702 of the highlighted item in tree configuration view 1701b in a separate window. That window can be turned on or off by clicking the option under the window options 3000. The “Show Graph Window” option can display the MRTG graph 1704 generated by polling SNMP data from the router by the A.N.T. server.
[0176] FIG. 31 illustrates an exemplary access control list manager window 3100 referenced by the “Show Access List” option of window menu options 3000. Window 3100 can allow managing access lists and deploying them to a single or multiple routers. The operator can add, edit, or delete any entry or all entries in the access list. The operator can load and save access lists for easy recall and implementation at a later time. Additionally, the operator can easily change the access list “number” for deployment of multiple access lists to a single router. List manager window 3100 can allow the user to create, modify, and delete access lists through an easy to use interface.
[0177] As an example, a list number can be shown in a list number block 3102 of the ACMS “Access List” window 3100. Four menu buttons 3104-3110 can allow creating a new list, opening an existing list, saving the current list, and deploying the current list, respectively. Send button 3110 can deploy the list to any router checked in tree configuration view 1701b on the ACMS main screen 1700. “Delete Item(s)” button 3116 and “Delete All” button 3118 can allow deleting a highlighted entry or all entries in tree configuration view 1701b, respectively.
[0178] FIG. 32 illustrates an exemplary “Add/Edit Item” dialog window 3200 referenced by the “Add Item” button 3112 or the “Edit Item” button 3114 of access control list manager window 3100. As shown, the following items can be entered or edited in window 3200: Source IP address 3202, Source netmask 3204, Target IP address 3206, Target netmask 3208, and notes 3210. The notes field can provide the operator with an easy reference as to why a particular entry has been implemented.
[0179] FIG. 33 illustrates an exemplary “Downed IP Editor” 3300 referenced by the “Show Downed IP” option of window menu options 3000. Editor 3300 can allow a system administrator to manually enter a source IP address 3302 and destination IP address 3304, along with a time duration 3306 to take down a network interface. Manual entry can be useful to block certain types of data to a network segment or to take a network interface down at the router level. Editor 3300 can allow the router to block traffic to and from a designated IP address at the discretion of the systems administrator. Editor 3300 can also provide the network administrator the ability to see which IP addresses are not currently connected to the Internet by the host router. The information provided in Editor 3300 can be similar to the information provided in Down Interface screen 1300 discussed above with reference to FIG. 13.
[0180] The “Use Large Icons” option of window menu options 3000 can allow changing the size of the items in tree configuration view 1301b from small to large. In this exemplary embodiment, only two size options are available. However, additional size options are not beyond the scope of the present invention.
[0181] FIG. 34 illustrates exemplary help menu options 3400 referenced by help menu button 1736 of ACMS screen 1701. Help menu options 3400 can allow access to an online version of a user's manual, as well as to screen shots of the A.N.T. system. Under the “Help” pull down menu there can be two options: “Cms Help” and “About.” The “Cms Help” option can be a windows help system that can include a complete A.N.T. user manual for easy and quick reference. That help system can be searched by title, or meta searched by context. The “About” option can provide a short text statement about Cyber Operations and the copyright information.
[0182] FIG. 35 illustrates an exemplary “MRTG” graph 1704 of main screen 1700 for the A.N.T. system highlighted in tree configuration view 1701b. Graph 1704 can be generated to show the traffic levels of the router interface directly connected to the uplink router. Graph 3500 can provide information similar to graph 1104 discussed above with reference to FIG. 11. Accordingly, items 1704a-d correspond to items 1104a-d discussed above. Graph 3500 can provide a graphical representation of data throughput on a minute-by-minute basis.
[0185] FIG. 37 illustrates an exemplary ACMS main screen 1700 having an “Alert” message 3702 displayed due to a detected DOS attack. Upon detection of a network flood by the A.N.T. system, “ALERT” message 3702 can flash above the Source IP location 1710 while an audible warning can sound. Placing a check mark in a checkbox 3704 labeled “Mute Sound” can stop the audible warning. An “Unread Warnings” text 3706 can show the number of alert messages waiting to be viewed. When multiple warnings are present, text 3706 can be highlighted in “black.” If no additional “Unread Warnings” are detected, then text 3706 may not be highlighted in black. Each queued unread warnings” can be read by selecting a “Next” button 1724d located in the row of buttons on the bottom left side of the main ACMS screen 1700.
[0186] As discussed with reference to FIG. 13, located below the “Alert” message, can be the Source IP 1710, Destination IP 1712, the A.N.T. server that detected the flood 1714, the attack type 1716, the number of offending packets detected 1718, and the time and date of the incoming attack 1720. The text packet data window 1722 can show the captured data packets from the attacking source, which can be stored on the A.N.T. server for later forensic analysis. Four buttons can be provided to allow viewing the last “Previous” attack (Previous button 1724a), deploying a countermeasure to the original A.N.T. box that detected the flood (Deploy to Origin button 1724b), deploying a countermeasure to all A.N.T. boxes checked in tree configuration view 1701b (Deploy to Checked button 1724c), and skipping forward to the next alert message (Next button 1724d).
[0187] The tree configuration view 1701b can show the currently deployed A.N.T. servers and routers over which the ACMS has managerial oversight. A checkbox 3710 can be located to the left of each A.N.T. box deployed on the host network. By placing a “check” in checkbox 3710 and clicking deploy to checked button 1724c, the operator can determine which A.N.T. server will respond to the hostile attack. Multiple checked boxes indicates that multiple A.N.T. servers will respond to the attack.
[0188] FIG. 38 illustrates an exemplary ACMS main screen 1700 of the windows based Central Monitoring Station having an “Exploit” warning 3802. The Exploit warning can be displayed when an attacker attempts to break into a network machine by launching a remote root exploit. As soon as a hack attempt is made, the A.N.T. server can identify the following: source of the attacker, the target server of hack attempt, and what service on the server that was the target of the attempted hack. A “Stealth Scan” button 3804 can be provided to allow scanning the attacking source computer for potential vulnerabilities. If any potential vulnerability exist, the CMS operator can be given the opportunity to attempt a counter hack or exploit of those identified system vulnerabilities.
[0189] FIG. 39 illustrates an exemplary “Countermeasure Control” screen 3900 referenced by stealth scan button 3804. When stealth scan button 3804 is selected, screen 3900 can provide the results from scanning the hostile computer that launched the exploit. The “Stealth Scan” button can launch a routine that can scan an attacking computer for system vulnerabilities. A drop down menu 3902 can provide a list of all services currently running on the hostile computer that have the potential to be exploited. A second drop down menu 3906 can provide a list of exploits that can be used against the particular services listed in drop down menu 3902. Once a service and an exploit are chosen in the specified windows 3902, 3906, an exploit button 3904 can be highlighted to become active. Selecting exploit button 3904 can execute an attempt to gain access to the hostile computer that launched the attack. Exploit button 3904 can securely send a requested action from the ACMS Countermeasure Control screen 3900 to an exploit server such as the offensive countermeasure server to execute the necessary instructions. If successful, the exploit server can open a window and can provide “Root Access” to the hostile computer. If the exploit server is unsuccessful in gaining access to the hostile computer, then the operator can return to the ACMS Countermeasure Control screen 3900 and can select another service from list 3902 and/or another exploit from list 3904. The operator can then try again to gain root access to the hostile computer. That process can be repeated until all combinations of services and exploits are exhausted. A cancel button 3908 can be available for discontinuing the counterattacking initiative.
Previous Patent: Method and apparatus for enhancing computer system security
Next Patent: Data authentication