International Business Machines Corporation

Damballa, Inc.

University of Georgia Research Foundation Inc

Dambala, Inc.

Terry Lee Nelms

Steven Wade Hunter

Gary Roy Shippy

Joseph Ward

Andrew Hobson

Tzvetelina B Battestilli

David Allen Dennerline

Hubertus Franke

Hao Yu

Roberto Perdisci

Bernard Paul Palmer, Jr

David Paul LaPotin

Systems and methods of classifying network traffic may monitor network traffic. Monitored traffic may be compared with a control protocol template (CPT). When a similarity between the monitored traffic and the CPT exceeds a match threshold, the monitored traffic may be associated with the CPT.

Systems and methods for traffic classification

Systems and methods for event path traceback may utilize a processor and a path traceback and categorization (ATC) module in communication with the processor. The processor may be configured to perform processing associated with receiving network traffic from a network. The ATC module may be configured to perform processing associated with identifying an event within the network traffic, tracing a sequence of network transactions related to the event, and outputting an annotated event path (AMP) including data about the event and the sequence of network transactions related to the event. Performing processing associated with tracing the sequence of network transactions may comprise reconstructing a sequence of transactions within the network traffic that led to the event while filtering out unrelated traffic within the network traffic.

Measuring, categorizing, and/or mitigating malware distribution paths

Improved techniques are disclosed for use in an intrusion prevention system or the like. For example, a method comprises the following steps performed by a computing element of a network. A packet of a flow is received, the flow comprising a plurality of packets, wherein the plurality of packets represents data in the network. A network intrusion analysis cost-benefit value is determined representing a benefit for analyzing the received packet for intrusions in relation to a cost for analyzing the received packet for intrusions. The method compares the network intrusion analysis cost-benefit value to a network intrusion analysis cost-benefit threshold to determine whether analyzing the received packet for intrusions before forwarding the received packet is warranted. Responsive to a determination that analyzing the received packet for intrusions before forwarding the received packet is not warranted, the received packet is forwarded, an indication is made that subsequent packets of the flow should be forwarded, and a determination is made whether the received packet indicates an intrusion after forwarding the received packet.

Network intrusion protection

A method, switch, and/or computer program product routes IP packet flows. An Ethernet switch receives an IP packet flow. Each of the packets in the IP packet flow has a header that contains a same 5-tuple. A load balancing control engine determines whether servers in a group of servers are balanced in their utilization according to 5-tuple redirection rules contained in the load balancing control engine. In response to the load balancing control engine determining, according to the 5-tuple redirection rules, that the servers are balanced, the Ethernet switch routes the IP packet flow to the servers. In response to the load balancing control engine determining that the servers are unbalanced, the load balancing control engine instructs the Ethernet switch to redirect the IP packet flow to a server that is relatively less busy than other servers.

Load-balancing via modulus distribution and TCP flow redirection due to server overload

A method, system, and/or computer program product steers Internet Protocol (IP) packet fragments. A switch receives a first IP packet fragment that contains a 3-tuple in its header. In response to determining that the first IP packet fragment is not a lead packet fragment in the series of IP packet fragments, the first IP packet fragment is pushed onto a data stack. The switch subsequently receives a second IP packet fragment that contains a 5-tuple, which includes the 3-tuple from the first IP packet fragment plus a source port and destination port used by the second IP packet fragment. The 3-tuple is mapped to the 5-tuple in a fragmentation table, thus enabling both the first IP packet fragment and the second IP packet fragment to be steered to the destination port to which the second IP packet fragment is being sent.

Steering fragmented IP packets using 5-tuple based rules

Intrusion protection. A first packet en route to a first destination is received. A first value representing a benefit for analyzing the first packet for intrusions in relation to a cost for analyzing the first packet for intrusions is automatically determined. An automatic determination is made that the first value is sufficiently high to warrant an analysis of the first packet for intrusions, and in response, the first packet is analyzed for intrusions. If the analysis of the first packet for intrusions indicates an intrusion, the first packet is discarded without forwarding the first packet to the first destination. A second packet en route to a second destination is received. A second value representing a benefit for analyzing the second packet for intrusions in relation to a cost for analyzing the second packet for intrusions is automatically determined. An automatic determination is made that the second value is not sufficiently high to warrant analysis of the second packet for intrusions, and in response, the second packet is forwarded to a next hop en route to the second destination without analyzing the second packet for intrusions.

Growing community of inventors

Dallas, GA, United States of America

Terry Lee Nelms