International Business Machines Corporation

Zscaler, Inc.

Airgap Networks Inc.

Volta Networks, Inc.

Raymond Wing Chon Cheh

Satish M Mohan

Vinay Adavi

Ritesh R Agrawal

Ivan Dean Bogdanovic

Chia Chi Cheng

A technique to stop lateral movement of ransomware between endpoints in a VLAN is disclosed. A security appliance is set as the default gateway for intra-LAN communication by overwriting the DHCP responses. Message traffic from compromised endpoints is detected. Attributes of ransomware may be detected in the message traffic, as well as attempts to circumvent the security appliance. Compromised devices may be quarantined by assigning them the default gateway to a preset blackhole IP address.

System and method for utilizing DHCP relay to accomplish quarantining client endpoints in a ransomware protected network

A technique to stop lateral movement of ransomware between endpoints in a VLAN is disclosed. A security appliance is set as the default gateway for intra-LAN communication by overwriting the DHCP responses. Message traffic from compromised endpoints is detected. Attributes of ransomware may be detected in the message traffic, as well as attempts to circumvent the security appliance. Compromised devices may be quarantined. Additionally, the DHCP address assignment may be policed to ensure accuracy and correctness to provide an additional layer of security.

System and method for utilizing DHCP relay to police DHCP address assignment in ransomware protected network

In various embodiments, the techniques and supporting systems implement a recursive routing mechanism in hierarchical topological addressed environments to analyze and determine the presence of packet-forwarding errors within an IP network comprising a plurality of network-connected devices. This includes receiving, at a software defined network device, an indication of a potential packet-forwarding error between a first and second device of the plurality of network-connected devices and injecting, by the software defined network device, a test packet at an ingress to the first device. The test packet includes an initial ingress interface location identifying the first device, an alternate ingress interface location identifying the software defined network device and an egress interface location identifying the second device. A determination may then be made as to whether the test packet is received at the second device, thus indicating the existence or lack of routing errors.

Troubleshooting multi-layered networks using datapath analysis

Growing community of inventors

Sunnyvale, CA, United States of America

Raymond Wing Chon Cheh