Alcatel Lucent

Faud Ahmad Khan

Stanley T Chow

Vinod Choyi

Dmitri Vinokurov

Bassem Abdel-Aziz

Yong Sun

Pierrick Guingo

Gerald Batten

A system and method for identifying the number of computer hosts and types of operating systems behind a network address translation is provided. The method includes processing an internet protocol packet associated with the host computer system. The process may involve capturing the internet protocol packet and extracting key fields from the internet protocol packet to produce a fingerprint. The method continues with analyzing the fields in order to determine if a network address translator is connected between the host computer and a public network (e.g. the internet). If there is a network address translator connected, fields may be analyzed in order to determine the number of computers using the network address translator. The fields may also be analyzing in order to determine with a level of probability that the fingerprint identifies the correct operating system running the host computers. Generally, the internet protocol packet that is analyzing will be captured from an aggregation point in the carrier network.

Method and apparatus for fingerprinting systems and operating systems in a network

Methods and systems are presented for detection of malware such as worms in which a network switch entices the malware into sending scan packets by allocating one or more ports as bait addresses, sending outgoing bait packets, and identifying compromised hosts that send unexpected incoming packets to a bait address.

Malware detection system and method

A system and method are provided for supporting storage and analysis by law enforcement agency premises equipment of intercepted network traffic. The system and method provide integrity of the intercepted network traffic stored in an archive in accordance with lawful intercept requirements by storing all of the intercepted traffic, both benign and malicious, in the archive in its original form. The system and method furthermore provide for security from any malicious data packets of the archive by separating the malicious packets from the benign packets and forwarding only the benign packets to analysis applications of the law enforcement agency premises equipment.

System and method of securely processing lawfully intercepted network traffic

Mechanism for identifying malicious content, DoS attacks, and illegal IPTV services. By monitoring the characteristics of various control messages being transmitted within a network that services Internet protocol television (IPTV) content to identify suspicious behavior (e.g., such as that associated with malicious content, denial of service (DoS) attacks, IPTV service stealing, etc.). In addition to monitoring control messages within such a network, deep packet inspection (DPI) may be performed for individual packets within an IPTV stream to identify malicious content therein (e.g., worms, viruses, etc. actually within the IPTV stream itself). By monitoring control messages and/or actual IPTV content within a network (e.g., vs. at the perimeter of a network only), protection against both outside and inside attacks can be effectuated. This network level basis of operation effectively guards against promulgation of malicious content to other devices within the network.

Mechanism for identifying malicious content, DoS attacks, and illegal IPTV services

A soft-denial system for client-server networks is disclosed for translating server authorization denials into responses that are known to be innocuous to the client application. The soft-denial system includes a client-application which originates a service request across a network to a server-application which rejects the request due to lack of authorization and subsequently provides a denial response. A soft-denial application intercepts the denial response, translates the response into a response known to be innocuous to the client-application, and forwards the innocuous response to the client-application. The soft-denial system is particularly useful for overcoming client-application failures due to authorization expectation mismatches.

Growing community of inventors

Osgood, Canada

Faud Ahmad Khan