WO2004100486A1 - Systeme de renseignements reseaux - Google Patents

Systeme de renseignements reseaux Download PDF

Info

Publication number
WO2004100486A1
WO2004100486A1 PCT/CA2004/000693 CA2004000693W WO2004100486A1 WO 2004100486 A1 WO2004100486 A1 WO 2004100486A1 CA 2004000693 W CA2004000693 W CA 2004000693W WO 2004100486 A1 WO2004100486 A1 WO 2004100486A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
information
security system
networks
agents
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CA2004/000693
Other languages
English (en)
Inventor
Chris Newton
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Q1 Labs Inc
Original Assignee
Q1 Labs Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Q1 Labs Inc filed Critical Q1 Labs Inc
Publication of WO2004100486A1 publication Critical patent/WO2004100486A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/04—Network management architectures or arrangements
    • H04L41/046—Network management architectures or arrangements comprising network management agents or mobile agents therefor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic

Definitions

  • the present invention relates to method and apparatus for network security and is particularly acquiring and using knowledge about networks.
  • a network of computers may be attacked by a hacker using Smurf, Denial of Services (DoS), or be abused by a rogue employee within the network, who may attack some other networks or download pornography.
  • DoS Denial of Services
  • IDS systems are used to spot, alert, and stop intrusions. Typically running on dedicated computers hooked to the network, IDS systems actively monitor network traffic for suspicious activities. Statistics or rule-based artificial intelligence is used to detect abnormal activities. Thus, IDS systems depend on the recognition of known attack patterns. For example, contents in the network traffic may be monitored to match the patterns in an IDS system's databases. The real-time analysis of the network traffic provides the capability to send instant notifications via e-mails, pager alerts, or other means. Based on a predefined security policy, some IDS systems can take defensive actions against intrusions, such as initiating the termination of network connections or changing the configuration of network devices (e.g., firewalls and routers).
  • firewalls and routers e.g., firewalls and routers
  • An object of the present invention is to provide an improved method and apparatus for network security.
  • Security is really all about knowledge, which is something that security devices and networks clearly lack. Everyday, in the real world, we use our knowledge, and records of people, places, and things, to make decisions about them. We don't hire people based only on what they look like when they are standing at our door. We don't let people into the country without proper identification and records. The thought of doing so seems harmless, but it is exactly what security devices and networks do every day, for every communication that occurs. IDSs and firewalls have no other information available to them other then what the packet looks like, standing at the door.
  • Hosted services web servers, email servers;
  • a network security system for providing intelligence about other networks comprising: a master network intelligence database including a first communication interface; a plurality of network information agents for gathering information about networks and providing the information to the master network intelligence database via the communication interface; and a second communication interface for a customer network security system securing a network in dependence upon information from the master network intelligence database.
  • a network security system for providing intelligence about other networks comprising: a master network intelligence database including first and second communication interfaces; a plurality of network information agents for gathering information about networks and providing the information to the master network intelligence database via the first communication interface; and a customer network security system for securing a network in dependence upon information received from the master network intelligence database via the second communication interface.
  • An advantage of the present invention is providing security based upon the reputation of networks.
  • FIG. 2 illustrates further detail of the apparatus of Fig. 1; and Fig. 3 illustrates operation of the apparatus of Fig. 1.
  • the apparatus 10 includes a master network intelligence database (M- NID) 12, and a plurality of customer network intelligence databases (C-NID) 14.
  • M- NID master network intelligence database
  • C-NID customer network intelligence databases
  • the Master NID resides at a location 16 offering the service, and customers 18 obtain a Customer NID 14, or C-NID, from the service provider 16.
  • the Master NID 12 then feeds the customers' NID 14 updates as new data are collected.
  • a Policy enforcer (PE) 20 layered on top of the C-NID 14 interfaces with services and devices on a customer company network 18.
  • the PE 20 allows an administrator to take conceptual ideas of who he wants his network to talk to, not talk to, or how he wants to configure services, and turns them into the technical rules sets that the devices require.
  • the PE 20 talks to the C-NID 14, turns concepts into rules and feeds the rules to the NID device agents 40 installed on the customer network security devices.
  • the Master NID 12 includes information on networks through properties 22 of those networks and applies both a weighting system to those properties and time sensitivity (how things become less or more important over time).
  • Perimeter Security Agent These are the agents from M-NID service provider that scour the Internet, looking for evidence of perimeter security measures in place at remote networks.
  • Newgroup/Forum Agent performing linguistic analysis to glean information about the networks.
  • Search Engine Agent for example a Google TM Agent.
  • Public Web agent gleans information from public websites.
  • FIG. 3 there is illustrated operation of the apparatus of Fig. 1.
  • the customer deploys NID device agents 40 on all of its network devices.
  • the Policy enforcer PE 20 layered on top of the C-NID 14 interfaces with services 46 and devices 42, 44, 48, 50 on a customer company network 18 via the NID device agents.
  • the PE 20 allows an administrator to take conceptual ideas of who he wants his network to talk to, not talk to, or how he wants to configure services, and turns them into the technical rules sets that the devices require via info from the C-NID. For example, the statement "I don't see any need for accepting mail from any residential ISP outside North America, nor from Universities, or other sites that have a high spam rating".
  • the Policy enforcer 20 then takes that concept, and with the help of the C-NID 14, turns it into a rule set of matching networks, and feeds it to the NID device agent on the mail server 46.
  • Another feature of the NID can be self-registration.
  • Some network administers will want to register the information about their network in the M-NID to ensure that they get unimpeded access to other networks that have deployed the NID. They will readily go to https://nid_register. to enter in their corporate network information (such as if they have firewalls, size of network, security personnel contact info they could also have a third party verification of their claims via an external auditor (which strengthens the believability of the claims).
  • Self-registering ensures that a network's info in the NID is correct. As the NID grows, self-registration becomes something that companies will want to do, to ensure that they get unimpeded access to larger networks with which they wish to communicate.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

L'invention a trait à un système de sécurité de réseau, qui adopte une approche active de la sécurité de réseau, et ce par la fourniture de renseignements concernant d'autres réseaux. Une base de données de renseignements réseaux principale, laquelle fait appel à une pluralité d'agents d'informations réseaux, qui recueillent des informations sur des réseaux et fournissent ces informations à la base de données de renseignements réseaux principale. Un système de sécurité de réseau client peut ensuite sécuriser le réseau client en fonction des informations reçues de la base de données de renseignements réseaux principale. Les informations de sécurité contiennent : au moins un niveau d'hostilité sur Internet, recueilli à partir de nombreux sites, l'historique des événements de sécurité, des niveaux de pourriels, les services hébergés, le système sans fil public, le type d'organisation, les associations d'organisations, les fournisseurs d'accès à Internet homologues, la connexion à largeur de bande à Internet, les mesures de sécurité active, le nombre d'utilisateurs sur le réseau, l'âge du réseau, le contenu inapproprié présenté, l'industrie, la position géographique, les serveurs mandataires ouverts, et les informations de contact.
PCT/CA2004/000693 2003-05-08 2004-05-10 Systeme de renseignements reseaux Ceased WO2004100486A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CA2428192A CA2428192C (fr) 2003-05-08 2003-05-08 Systeme de renseignement sur des reseaux
CA2,428,192 2003-05-08

Publications (1)

Publication Number Publication Date
WO2004100486A1 true WO2004100486A1 (fr) 2004-11-18

Family

ID=33426199

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CA2004/000693 Ceased WO2004100486A1 (fr) 2003-05-08 2004-05-10 Systeme de renseignements reseaux

Country Status (2)

Country Link
CA (1) CA2428192C (fr)
WO (1) WO2004100486A1 (fr)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007098960A1 (fr) * 2006-03-03 2007-09-07 Art Of Defence Gmbh Pare-feu pour applications web distribuées
US8230505B1 (en) 2006-08-11 2012-07-24 Avaya Inc. Method for cooperative intrusion prevention through collaborative inference

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4505672A4 (fr) 2022-04-01 2026-03-11 Reliaquest Holdings Llc Système et procédé d'atténuation de menace

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1130870A2 (fr) * 2000-02-28 2001-09-05 Attention System Co., Ltd. Système pour prévenir l'accés irregulier
EP1143660A2 (fr) * 1999-06-10 2001-10-10 Alcatel Internetworking, Inc. Protocole de transition d'état pour des unités de haute disponibilité
US20030051026A1 (en) * 2001-01-19 2003-03-13 Carter Ernst B. Network surveillance and security system
US20030084349A1 (en) * 2001-10-12 2003-05-01 Oliver Friedrichs Early warning system for network attacks

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1143660A2 (fr) * 1999-06-10 2001-10-10 Alcatel Internetworking, Inc. Protocole de transition d'état pour des unités de haute disponibilité
EP1130870A2 (fr) * 2000-02-28 2001-09-05 Attention System Co., Ltd. Système pour prévenir l'accés irregulier
US20030051026A1 (en) * 2001-01-19 2003-03-13 Carter Ernst B. Network surveillance and security system
US20030084349A1 (en) * 2001-10-12 2003-05-01 Oliver Friedrichs Early warning system for network attacks

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007098960A1 (fr) * 2006-03-03 2007-09-07 Art Of Defence Gmbh Pare-feu pour applications web distribuées
US8566919B2 (en) 2006-03-03 2013-10-22 Riverbed Technology, Inc. Distributed web application firewall
US8230505B1 (en) 2006-08-11 2012-07-24 Avaya Inc. Method for cooperative intrusion prevention through collaborative inference

Also Published As

Publication number Publication date
CA2428192C (fr) 2013-07-02
CA2428192A1 (fr) 2004-11-08

Similar Documents

Publication Publication Date Title
US8024795B2 (en) Network intelligence system
Scarfone et al. Guide to intrusion detection and prevention systems (idps)
US8935742B2 (en) Authentication in a globally distributed infrastructure for secure content management
US9185127B2 (en) Network protection service
US20060026679A1 (en) System and method of characterizing and managing electronic traffic
US20080052758A1 (en) Method and system for propagating network policy
US20250310377A1 (en) Integrating Deception-Based Attack Intelligence with External Attack Surface Management (EASM) Data
Scarfone et al. Sp 800-94. guide to intrusion detection and prevention systems (idps)
Vacas et al. Detecting network threats using OSINT knowledge-based IDS
Haber et al. Attack vectors
CA2428192C (fr) Systeme de renseignement sur des reseaux
Kim et al. Fingerprinting edge and cloud services in iot
Sommestad et al. A test of intrusion alert filtering based on network information
Andrés et al. Security Sage's guide to hardening the network infrastructure
Barrett et al. CompTIA Security+ SY0-401 Exam Cram
Morthala Building Firewall Application To Enhance The Cyber Security
Mansoor et al. An analysis of security systems for electronic information for establishing secure internet
Fischer Create a Security Operations Center on Your Campus
Chapple Security+® Practice Tests: Prepare for, practice, and pass the CompTIA Security+ exam
Hausman et al. CompTIA Security+ SY0-301 Exam Cram
Liptak et al. Instrument Engineers' Handbook, Volume 3: Process Software and Digital Networks
Meyer et al. Be aware with a Honeypot
Lackner Hide the honey from the bees
Çalışkan et al. TECHNICAL DEFENCE METHODS, TOOLS, TECHNIQUES AND EFFECTS
Luan Intrusion detection and management over the world wide web

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BW BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE EG ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NA NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SY TJ TM TN TR TT TZ UA UG US UZ VC VN YU ZA ZM ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): BW GH GM KE LS MW MZ NA SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LU MC NL PL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
122 Ep: pct application non-entry in european phase