This application claims the benefit of U.S. Provisional Application 60/929,153, filed Jun. 15, 2007, which is incorporated herein by reference in its entirety.BACKGROUND OF THE INVENTION
1. Field of the Invention
The invention described herein relates to information security, and in particular, relates to the detection of attempts to subvert an information system.
2. Background Art
Modern information systems are plagued by a variety of security problems. Many of these problems arise from the fact that a given information processing component may be connected broadly to a large universe of other components and users. The chief example, of course, is the Internet. Using the Internet, millions of users and their machines are free to interact with one another. Some of these interactions, however, may be malicious. A typical user can be victimized by a virus or worm received through communication with another machine, for example. Other malicious applications can also be sent to a user. Some such applications may, for example, cause the port through which a user typically receives telnet traffic to be changed from the usual TCP port 23. This could allow a malicious user to avoid a firewall that may otherwise be in effect at port 23. Other intrusion attempts may include the transmission of malformed packets that may be sent by hackers in an attempt to confuse applications that are not expecting incoming packets to be packaged as such.
The existing technologies for defending against such attacks tend to require significant processing and memory. One or more packets that contain a virus, for example, can be filtered out, but this requires a filter mechanism that is capable of detecting common viruses. This in turn may require a database of such viruses, or at minimum a database of information that characterizes such viruses. Using such a database, the user that may be under attack can compare an incoming packet to entries in the database. A match would signify that the incoming packet represents a virus.
For some computer systems, the amount of memory required to store such a database, and the level of processing required to execute such defensive measures, may not be a problem. But these requirements may be a problem for other systems. Some information systems have less computing power and/or less memory available to defend against such attacks. Information processing components that have relatively little processing power and/or small amounts of memory are referred to herein as lightweight devices. An example of a lightweight device is a cable modem. A cable modem (CM) can be embodied as a lightweight device, one that can be embedded in a larger component, such as a personal computer or router. While a cable modem will in fact have a processor and memory available, it does not represent a general purpose computing platform. Such an embedded device therefore has limited functionality for functions other than the basic operations required of a cable modem.
There is therefore a need for a system and method that addresses the above security concerns, but which can operate with the limited computational resources of an embedded device or other lightweight device.BRIEF DESCRIPTION OF THE DRAWINGS/FIGURES
DETAILED DESCRIPTION OF THE INVENTION
The invention described herein is a system and method for the multi-stage analysis of incoming packets. Three stages are used, each of which addresses a particular category of threat by examining the headers and/or payload of each packet (“deep packet inspection”). The first stage detects incoming viruses or worms. The second stage detects malicious applications. The third stage detects attempts at intrusion. These three stages operate in sequence, but in alternative embodiments of the invention they may be applied in a different order.
These three stages are followed by a fourth stage that performs verification. If any of the first three stages detects a possible attack, then the packet or packets that have been flagged are routed to a central verification facility. In an embodiment of the invention, the verification facility is a server, coupled with a database. Here, suspect packets are compared to entries in the database to more comprehensively determine whether or not the packets represent an attempt to subvert the information processing system. The term “subvert” as used herein refers to the insertion of data or executable logic into an information system or the assertion of some level of control of the system, in order to gain otherwise restricted privileges or information, or to damage the system. The fourth stage can therefore confirm a subversion attempt, or alternatively show that an alert raised by an earlier stage is not valid and represents a false positive.
This arrangement relieves the embedded device (at which the packets were originally received) from the memory-intensive process of having to rigorously evaluate every incoming packet. Instead, by implementing stages one to three as described above, suspicious packets are identified, then forwarded to stage four for final verification. This minimizes the amount of processing and the amount of memory required at the embedded device.
If stage four reveals that the packet or packets represent a bonafide subversion attempt, then a notification is sent back to the embedded device. The embedded device may then take appropriate action. For example, the internet protocol (IP) source address of an offending packet may be recorded on a list so that future packets received from that source can be rejected, or “blacklisted”. Alternatively, or in addition, processing of the packet stream which includes the offending packet may be halted. Finally, an alert may be sent to a central monitoring facility for further action.
A packet that is shown to be suspect after the processing of any of stages one, two, or three, is then sent to central server 160. Central server 160 is an example of a central verification facility, at which a more comprehensive determination can be made as to whether a given packet or packets represent an attempt to subvert system 100, or any component thereof. In the illustration, central server 160 is connected to CMTS 110 via a network 170. In an alternative embodiment, central server 160 may be connected directly to CMTS 110.
As described above, if a packet is determined by central server 160 to represent an attempt to subvert system 100 or any component thereof, central server 160 can so inform the cable modem that initially received the packet. That cable modem can then respond accordingly. One possible response, in an embodiment of the invention, is for the cable modem to notify a central monitoring system 165. As shown in
Note that system 100 is intended to be one possible topology of a system that embodies the invention. Alternative embodiments are also possible. For example, in an alternative embodiment, central server 160 and central monitoring system 165 may in fact be incorporated in a single component or subsystem. In addition, central server 160 may provide its stage four verification service as a contracted security service. In the context of a cable communications system, the verification service may be provided by a cable service provider.
In step 230, stage two is performed. Here, a second signature of the incoming packet is determined, and compared to signatures of known malicious applications. Again, the signatures of the known applications can be relatively short, so that storage requirements are minimal. A match results in an alert state. In step 240, stage three is performed. Here, a third signature is calculated for an incoming packet and compared to signatures of known intrusion packets. Again, the signatures of the known intrusion packets can be relatively short. As in stages one and two, a match at stage three results in an alert state.
In step 245, a determination is made as to whether any of stages one to three have created alerts. If any of the signatures calculated from the incoming packet matched any of the stored signatures (i.e., if an alert has been raised), then processing continues at step 250. Here, stage four is performed. The packet(s) are sent, in this stage, to a central verification facility. At this facility, more comprehensive testing is performed. It is here that false positives that may have been raised in stages one, two, or three are weeded out. Alternatively, a packet that has caused an alert can be verified at this stage as representing an attack. The process concludes at step 260. If in step 245, it is determined that there have been no alerts raised by stages one through three, then processing proceeds directly to step 260, at which point process 200 concludes.
Step 220 is illustrated in greater detail in
In step 340, the first packet signature is compared to stored signatures of known viruses or worms. These stored signatures are maintained in memory accessible in or by the embedded device. These stored signatures of known worms or viruses are relatively short, reducing the memory requirement. Because they are relatively short, however, the possibility exists for a false positive alert being raised. This necessitates processing at stage four, which will be described in greater detail below.
In step 350, it is determined whether the first packet signature matches any of the stored signatures. If so, then an alert condition is created, e.g., a flag is raised signifying an alert condition. This alert process is represented by step 360. The process concludes at step 370.
In step 450, a determination is made as to whether the second packet signature matches any of the stored signatures of known applications. If so, an alert condition is raised in step 460. The process then concludes at step 470. As before, given that the stored signatures of known applications are relatively short, the possibility exists for false positives, i.e., the raising of an alert flag in step 460 when the received packet does not in fact represent a known malicious application. Any packet that raises an alert flag in step 460 will subsequently be processed in stage four, as described below.
Step 250, i.e., stage four, is illustrated in greater detail in
If, in step 640, it is determined that the received packet(s) match any of the database entries, then processing moves to step 650. Here, the embedded device at which the suspect packet was initially received is informed by the central verification facility that the packet represents a subversion attempt. In step 660, the embedded device responds in some manner. For example, the source IP address of the received packet may be added to a list of IP source addresses whose packets are to be ignored. In addition, or alternatively, the embedded device may terminate the current stream for security reasons. Alternatively, the embedded device may send an alert to a centralized monitoring system. The process concludes at step 670.
Note that stage four may require more than one packet in order to make a definitive determination as to whether subversion has been attempted. Certain malicious programs may require more than one packet. In this case, two or more packets may be sent to the central verification facility and compared to database entries as appropriate.
Also, in an embodiment of the invention, every packet received by the embedded device is analyzed using the above four-stage process. In an alternative embodiment, only a subset of a packet stream is sent through this process. This reduces the amount of security provided by the process, since some packets may not be analyzed. Performance of the embedded device is improved, however, since not every packet is processed. For example, in an embodiment of the invention, only every nth packet is analyzed. Alternatively, given an incoming stream of packets, only the first packet, a middle packet, and the last packet are analyzed.
In an embodiment of the present invention, the system and components of the present invention described herein are implemented using one or more computers, such as a computer 700 shown in
The computer system 700 includes one or more processors (also called central processing units, or CPUs), such as a processor 704. The processor 704 is connected to a communication infrastructure 706, such as a bus. The computer 700 also includes a main or primary memory 708, such as random access memory (RAM). The primary memory 708 has stored therein control logic (computer software) and data.
The computer 700 may also include one or more secondary storage devices 710. The secondary storage devices 710 may include, for example, a hard disk drive 712 and/or a removable storage device or drive 714.
The removable storage drive 714 interacts with a removable storage unit 718. The removable storage unit 718 includes a computer useable or readable storage medium having stored therein computer software (control logic) and/or data. Removable storage unit 718 may represent a floppy disk, magnetic tape, compact disk, DVD, optical storage disk, or any other computer data storage device. The removable storage drive 714 reads from and/or writes to the removable storage unit 718 in a well known manner.
The computer 700 further includes a communications or network interface 727. The network interface 727 enables the computer 700 to communicate with remote devices. For example, the network interface 727 allows the computer 700 to communicate over communication networks or media 726 (representing a form of a computer useable or readable medium), such as LANs, WANs, the Internet, etc. The network interface 727 may interface with remote sites or networks via wired or wireless connections. In the embodiment of the invention illustrated in
Control logic, such as that illustrated in
Any apparatus or manufacture comprising a computer useable or readable medium having or conveying control logic (software) is referred to herein as a computer program product or program storage device. This includes, but is not limited to, the computer 700, the main memory 708, the hard disk 712, the removable storage unit 718 and the communications media 726 conveying the control logic. Any such computer program products, having control logic stored therein that, when executed by one or more data processing devices, cause such data processing devices to operate as described herein, represent embodiments of the invention.
The invention can work with software, hardware, and/or operating system implementations other than those described herein. Any software, hardware, and operating system implementations suitable for performing the functions described herein can be used.