International Business Machines Corporation

Napatech A/s

Agilent Technologies, Inc.

Spirent Communications, Inc.

Russell L Couturier

William Alexander Bird

Iosif Viorel Onut

Wayne Francis Tackabury

Vijay Dheap

Ben A Wuest

Michael Milde Lilja

Peter Dahl Ekner

Patrick V Johnstone

Philip Due Soeberg

Thomas D Silliman

Alex Omo Agerholm

Ronald B Williams

Andrii Sergeevich Iesiev

Alex Omø Agerholm

Jeb R Linton

Cheng-Ta Lee

Guy-Vincent Jourdan

Aviv Ron

Doga Tav

Gregor Von Bochmann

Jason Flood

Michael Hanner

Avishay Bartik

Qian Cui

Aidan Butler

Mattias Johansson

Patrick Hourigan

Derek T Lohnes

Shawn Richard Delton

Darshan Gencarelle

Dinkar Chivaluri

According to one embodiment, a method, computer system, and computer program product for preventing intrusions on a network is provided. The present invention may include generating a sandbox environment responsive to detecting an attacker in the network, wherein the sandbox environment comprises dynamically generated data tailored to the target of the attacker; and moving the attacker to the sandbox environment.

Highly collaborative deceptive network alliance

A generated signal is injected into a first network node in a set of network nodes. The generated signal comprises a predetermined pattern, the predetermined pattern comprises a plurality of time periods, wherein during each time period in the plurality of time periods a first data traffic is prevented from exiting the first network node. By monitoring data flow within the set of network nodes while the generated signal is being injected, a correlation with the generated signal is detected, the correlation correlating a second network node with the first network node. The second network node is associated with the first network node. Responsive to the association, traffic from the second network node to the set of network nodes is blocked.

Signal based node relationship identification

A method, apparatus and computer program product for managing security threats to a distributed network. A set of events are aggregated from a plurality of event sources in the network for each of a set of security threats to the network. A magnitude of a characteristic of each of the set of security threats is determined. Each of the set of security threats is represented as a three dimensional graphical object in a three dimensional (3D) representation of the network according to the respective magnitude of the characteristic. A security action is taken based on the determined magnitude of one of the set of security threats.

Security threat management framework

Countering phishing attacks by generating multiple synthetic victims, where each of the synthetic victims includes synthetic victim information that represents a computer user identity and includes associated sensitive information, where the computer user identity and its associated sensitive information are fictitious in that they are not known to be associated with a legitimate computer user, providing any of the synthetic victim information of the synthetic victims to a computer-hosted phishing site, storing the synthetic victim information in a computer-accessible database, receiving from a computer-hosted target site information provided to the computer-hosted target site by a requestor, identifying in the computer-accessible database database synthetic victim information matching the requestor information, and notifying the computer-hosted target site that the requestor information is of a synthetic victim.

Countering phishing attacks

A method, apparatus and computer program product for selectively storing network traffic data are described. Network traffic is stored according to a first packet filtering policy in a first repository. The stored network traffic is scanned in the first repository according to a second packet filtering policy to identify a subset of network traffic for archiving. The identified subset of network traffic identified by the second packet filtering policy are forensically interesting packets concerning a security issue. The identified subset of network traffic from the first repository is then stored in a second repository.

Intelligent security context aware elastic storage

Embodiments are directed to a method of implementing a packet capture ring. The packet capture ring includes a plurality of appliances, and the plurality of appliances includes a first appliance and a second appliance. The first appliance and the second appliance are both attached to a network tap, and the first appliance works as a master appliance. The master appliance ingests packets from the network tap, encapsulates the packets and forwards encapsulated packets in the packet capture ring. The method includes: detecting, by the second appliance, a failure of the first appliance; working, by the second appliance, as the master appliance; and removing, by the second appliance, the first appliance from a forwarding designation list.

Fault-tolerant architecture for packet capture

An example operation may include one or more of identifying a page of a website for phishing testing, attempting each of a Hypertext Transfer Protocol (HTTP) GET request and a HTTP Secure (HTTPS) GET request via the identified page of the website, attempting each of a HTTP POST request and a HTTPS POST request via the identified page of the website, determining if the website is a phishing website based on server responses to the attempted HTTP and HTTPS GET requests and the attempted HTTP and HTTPS POST requests received from the website, and in response to determining the website is a phishing website, outputting an indication of the determination for display on a display device.

Phishing detection through secure testing implementation

A method for analyzing past user sessions for malicious intent. A security incident is detected by a computer system. Responsive to detecting the security incident, a forensic investigation is triggered by the computer system using a set of security rules for detecting website vulnerability in which the set of security rules is applied to a set of past user sessions, wherein the set of security rules is for a dynamic analysis product.

Automatic user session profiling system for detecting malicious intent

Embodiments provide a system and method for network tracking. By using packet capture applications having a flow identifier and a time stamper, one or more raw packets from one or more packet flows intercepted from a network can be tagged with a unique identifier and timestamp that can later be used to aggregate packet flows that have been analyzed by one or more capture applications. The unique identifier can relate to the network interface of the particular capture application and can also have an increasing value, where the increase in value can be monotonic. Later capture applications, while capable of generating secondary timestamps, can disregard those secondary timestamps for the primary timestamp of the first capture application in order to remove complications arising from latency issues.

Persistent flow identifiers enabling disparate applications

Embodiments are directed to a packet capture ring that provides a single network tap for packet capture and a series of processors (or appliances) for handling serialization and search request processing in a confederated and highly scalable manner. One such appliance (a 'primary' appliance) maintains a tap port to the network. Each packet capture appliance has a locally attached repository that stores raw packets and a juxtaposed index that allows for retrieval of those packets. The primary appliance sends a single copy of encapsulated packets in opposite directions around the ring to its descendants. A designation is made across the system as to a 'currently designated' appliance for servicing requests for indexing and storage of captured packets. This current designation shifts from appliance to appliance in the system, as a &#x201c;previously designated&#x201d; appliance has its storage capacity filled.

Packet capture ring: reliable, scalable packet capture for security applications

Identity data collected from network flows is managed and graphed according to a hierarchical schema that reduces data storage requirements and enhance database querying efficiencies. Preferably, the schema comprises a set of objects, such as a 'source' object, a 'time' object, and an &#x201c;identity&#x201d; object. A source object represents a source of an identity, namely, where an identity comes from. A time object represents a time bucket along a particular time frame corresponding to when an identity appears on the network. An identity object represents the actual identity itself. As each distinctive identity data is detected, it is added to the graph, preferably just once, and relationships between particular pairs of identities are identified. The resulting graph has significantly-reduced storage requirements, and it facilitates the discovery of linked identities much more efficiently, even when the identities are not directly connected.

Representing identity data relationships using graphs

Network vulnerability testing methods, systems, devices, appliances and software products generate stateful and stateless network representative of network threats. The traffic is applied to a network or device under test, thereby to test the vulnerability of the network or device to threats. A graphical user interface, which does not require a programming or scripting language can be used to generate an intermediate descriptive format that can in turn be used to generate stateful or stateless threat signatures. By using the intermediate descriptive form, threats can be generated under the control of the graphical user interface and in accordance with stored threat signatures, without the need for a programming or scripting language.

Network testing methods and systems

A protocol sleuthing system according to the present invention for load testing a network server includes a computer configured to interconnect with the network server, a protocol engine stored in and implemented by the computer and operative to generate a plurality of synthetic users, to generate a synthetic transaction in accordance with a specified protocol, and to cause each of the plurality of synthetic users to sequentially implement a plurality of the synthetic transactions with the network sever for load testing thereof, a configuration file connected to the protocol engine that includes variables required to generate the synthetic transaction, information that defines the behavior of the plurality of synthetic users implementing the synthetic transaction, and information that defines the number of synthetic users to be created by the protocol engine, and a module that is operative to monitor each of the plurality of synthetic transactions implemented by each of the plurality of synthetic users with the network server, to detect any error event occurring during any of the plurality of synthetic transactions implemented by any of the plurality of synthetic users, and to report any error event detected during such network testing.

Growing community of inventors

Worchester, MA, United States of America

Russell L Couturier