US20120096539A1 - Wireless intrusion prevention system and method - Google Patents
Wireless intrusion prevention system and method Download PDFInfo
- Publication number
- US20120096539A1 US20120096539A1 US13/336,787 US201113336787A US2012096539A1 US 20120096539 A1 US20120096539 A1 US 20120096539A1 US 201113336787 A US201113336787 A US 201113336787A US 2012096539 A1 US2012096539 A1 US 2012096539A1
- Authority
- US
- United States
- Prior art keywords
- network
- mobile device
- address
- source
- malware
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
- G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
- H04W12/125—Protection against power exhaustion attacks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
- H04W12/128—Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/2105—Dual mode as a secondary aspect
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0209—Architectural arrangements, e.g. perimeter networks or demilitarized zones
- H04L63/0218—Distributed architectures, e.g. distributed firewalls
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D30/00—Reducing energy consumption in communication networks
- Y02D30/70—Reducing energy consumption in communication networks in wireless communication networks
Definitions
- Mobile devices are potential targets for hackers and malware writers. As users increase the number of data applications on their mobile devices, the risk of malware being introduced into the mobile network and spread among mobile devices also increases. Malware tends to spread exponentially in a network, therefore it is important to stop malware early to prevent service disruption in significant portions of the network.
- the system and method for wireless intrusion prevention use information gathered within the entire mobile network to prevent, detect, and stop malicious attacks on a mobile network and assist in mitigating the spread of the malware.
- the system is especially effective with respect to specific types of attacks, namely mobile worm attacks, battery draining attacks, and Denial of Service (DoS) attacks.
- DoS Denial of Service
- the system and method are also applicable to other types of malware attacks and is therefore an important security component of an operator's mobile network.
- the system includes three types of components: monitors, intelligent agents, and security centers. The system components operate on both network elements and mobile devices or handsets in mitigating malware attacks.
- FIG. 2 is flowchart illustrating an exemplary method for monitoring, detecting, and mitigating malicious communications in a mobile network in accordance with an aspect of the subject matter described herein.
- monitors 108 By inspecting the incoming and outgoing data from a device 110 , 126 , 128 , 130 , monitors 108 acquire a significant amount of data. Some of the data may be duplicative with that collected by other monitors 108 . Scanning and reporting the same content from multiple devices 110 , 126 , 128 , 130 uses considerable network resources. However, such duplication increases the robustness of the wireless intrusion prevention system 100 since some attacks involve hiding or modifying of certain data. Also, some data is related to sensitive, private contents and is not monitored. Therefore, the client side (mobile device 110 side) monitors 108 and the network side monitors 108 may scan incoming and outgoing data differently.
- Some representative malware scanning algorithms for mobile devices 110 include, but are not limited to, malware signature searches; hash signature searches as described in U.S. patent application Ser. No. 11/697,647 “Malware Detection System and Method for Mobile Platforms”; malware detection in headers and compressed parts of mobile messages as described in U.S. patent application Ser. No. 11/697,658 “Malware Detection System and Method for Compressed Data on Mobile Platforms”; malware modeling as described in U.S. patent application Ser. No. 11/697,642 “Malware Modeling Detection System and Method for Mobile Platforms”; malware modeling for limited access devices as described in U.S. patent application Ser. No.
- Monitors 108 examine or scan communications among the elements of the mobile network 102 , including mobile devices 110 .
- the monitors 108 on the network 102 side use the sFlow monitoring specifications (see RFC 3176, available online at www.ietf.org/rfc/rfc3176.txt and herein incorporated by reference) thereby gathering considerable envelope and routing information and relatively little or no content information.
- representative malware algorithms for scanning on the network 102 side include, but are not limited to, malware signature searches; hash signature searches as described in U.S. patent application Ser. No. 11/697,647 “Malware Detection System and Method for Mobile Platforms”; and malware detection in headers and compressed parts of mobile messages as described in U.S. patent application Ser. No. 11/697,658 “Malware Detection System and Method for Compressed Data on Mobile Platforms”.
- An intelligent agent 106 receives information from one or several monitors 108 .
- Intelligent agents 106 can be located in both the mobile device 110 and the network 102 .
- an intelligent agent 106 on a mobile device 110 is associated with a monitor 108 in the mobile device 110 .
- an intelligent agent 106 on the network 102 is associated with multiple monitors 108 in distributed locations, for example in different cities.
- An intelligent agent 106 communicatively connects to the security center 134 .
- an intelligent agent 106 is communicatively connected to other intelligent agents 106 .
- the functions of an intelligent agent 106 include:
- the functions of the intelligent agent 106 are performed by the security center 134 .
- the global security center 134 is responsible for:
- the wireless intrusion prevention system 100 is capable of identifying and neutralizing multiple types of malicious attacks on the mobile network 102 . Examples listed below are meant to be illustrative and not to constrain the method and system to any specific embodiment.
- the DoS attack can be mitigated in a similar manner as a battery draining malware attack.
- a DoS attack can also be stopped by identifying the malicious sender. For this, IP traceback techniques can be adapted to detect spoofed addresses.
- corresponding intelligent agents 106 instruct 210 the network to drop the packets associated with the attack. If the sender of the malicious communications is within the service provider's network 102 , intelligent agents 106 disable 216 outbound communications on that mobile device, or restrict 216 communications to stop the malicious activity.
- a monitor in a mobile device scans 302 incoming programs on the mobile device for identifying characteristics of malware to report 304 to an intelligent agent.
- Many existing worms can be detected by pre-defined signatures. However, worms that change as they spread or new worms whose signatures are not yet included in antivirus databases cannot be identified based upon signature. Therefore, in addition to the signature-based detection, the monitors, intelligent agents, and security centers cooperate to detect and identify mobile worm malware using heuristic rules that describe suspicious behaviors of worms, e.g., upon infecting one device malicious worms propagate to a different device using standard spreading mechanisms such as Bluetooth or MMS.
- intelligent agents 106 instruct 310 the network 102 to drop or delete the packets associated with the suspect program and provide information to the security system 134 of the network 102 operator.
- intelligent agents 106 instruct 316 mobile devices to ignore or filter the packets associated with the suspect program. If a mobile device 110 sending the suspect program is inside the service provider's network 102 , intelligent agents disables 316 outbound communications on that mobile device. In another embodiment, the intelligent agent 106 restricts 316 communications to stop the spread of the suspect program without completely disabling the communications interfaces.
Abstract
Description
- This application is a Divisional of U.S. application Ser. No. 11/946,003, entitled, “Wireless Intrusion Prevention System and Method”, filed Nov. 27, 2007, which claims the benefit of U.S. Provisional Application Ser. No. 60/867,297 entitled, “Wireless Intrusion Prevention System and Method”, filed on Nov. 27, 2006. The entire contents of each of which are incorporated herein by reference.
- The present invention is related generally to a system and method for detecting, preventing, and stopping malware attacks on wireless networks.
- Mobile devices are potential targets for hackers and malware writers. As users increase the number of data applications on their mobile devices, the risk of malware being introduced into the mobile network and spread among mobile devices also increases. Malware tends to spread exponentially in a network, therefore it is important to stop malware early to prevent service disruption in significant portions of the network.
- Typical malware detection applications scan a single computer to determine whether the computer is infected with malware and remove the offending malware when a malware signature is detected in a compromised application. Although post-infection cleaning can remove malware from a single computer, such cleaning is only effective for malware that has already been identified and recognized. Post-infection cleaning is not capable of removing new or changing malware, and cannot prevent the infection from occurring.
- Network techniques to prevent the spread of malware involve scanning network traffic for a malware signature at distinct points, called firewalls, to prevent malware from entering the network. However, this technique does not protect the network from malware that enters the network from points within the network itself. More robust network techniques involve placing a scanner within network elements, such as one or more of the routers that make up the data network. However, both of these network techniques are effective only for malware that has already been identified and recognized, not new or changing malware. Furthermore, such network techniques do not stop infections from happening in the first place.
- Accordingly, there is a need for a system and method that can identify both new and old malware in the wireless network and prevent it from spreading to mobile phones. There is a need for a system that can detect, prevent, and stop malware attacks on wireless networks before the malware has a chance to spread and significantly disrupt service in a network.
- The system and method for wireless intrusion prevention use information gathered within the entire mobile network to prevent, detect, and stop malicious attacks on a mobile network and assist in mitigating the spread of the malware. The system is especially effective with respect to specific types of attacks, namely mobile worm attacks, battery draining attacks, and Denial of Service (DoS) attacks. However, the system and method are also applicable to other types of malware attacks and is therefore an important security component of an operator's mobile network. In an embodiment, the system includes three types of components: monitors, intelligent agents, and security centers. The system components operate on both network elements and mobile devices or handsets in mitigating malware attacks.
- The accompanying figures depict multiple embodiments of the system and method for detecting, preventing, and stopping malware attacks on wireless networks. A brief description of each figure is provided below. Elements with the same reference numbers in each figure indicate identical or functionally similar elements. Additionally, the left-most digit(s) of a reference number identifies the drawings in which the reference number first appears.
-
FIG. 1 depicts a block diagram of an exemplary deployment of monitors, agents, and a security center in accordance with an aspect of the subject matter described herein -
FIG. 2 is flowchart illustrating an exemplary method for monitoring, detecting, and mitigating malicious communications in a mobile network in accordance with an aspect of the subject matter described herein. -
FIG. 3 is flowchart illustrating an exemplary method for monitoring, detecting, and mitigating malware in a mobile network in accordance with an aspect of the subject matter described herein. - It should be noted that the invention is not limited in its application or use to the details of construction and arrangement of parts illustrated in the accompanying drawings and description. The illustrative embodiments of the invention may be implemented or incorporated in other embodiments, variations and modifications, and may be practiced or carried out in various ways. Furthermore, unless otherwise indicated, the terms and expressions employed herein have been chosen for the purpose of describing the illustrative embodiments of the present invention for the convenience of the reader and are not for the purpose of limiting the invention. In addition, as used herein, the term “exemplary” indicates a sample or example. It is not indicative of preference over other aspects or embodiments.
- Referring now to
FIG. 1 , in an embodiment, the wirelessintrusion prevention system 100 comprisesmonitors 108,intelligent agents 106, and at least onesecurity center 134. Eachmonitor 108 is associated with anetwork device monitor 108 is in communication with one or moreintelligent agents 106 that communicate with thesecurity center 134 portion of anetwork management system 132. Communications with thesecurity center 134 are generally performed viawireless communication 120. -
Network devices mobile devices 110 ormobile devices 110,network elements mobile network 102, ornetwork analyzers 130 used to independently monitor communications in the network. Theterm network element term network component network analyzers 130 in some contexts. The termmobile device 110 andhandset 110 can also be used interchangeably, althoughmobile device 110 is generally used to encompass a wider array of wireless enabled devices, including but not limited to PDAs and laptop computers. - The
mobile devices 110 may havewireless interfaces interface 112 a for communicating via Bluetooth 114 a with another Bluetooth-equippeddevice 116, or an 802.11x or Wi-Fi interface 112 b for communicating via Wi-Fi 114 b with another Wi-Fi-equippeddevice 118. Internet enabledmobile devices 110 typically havenetwork applications 122 such as a browser or web interface enabling them to send and receivedata 124 from the Internet 104. - Continuing to refer to
FIG. 1 , amonitor 108 is a component associated with anetwork device mobile network 102. As used herein, the term component includes hardware, software, firmware, or any combination thereof. Thedevice mobile device 110 or anetwork element mobile network 102. Themonitor 108 is communicatively connected to one or multipleintelligent agents 106. Themonitor 108 is capable of performing the following functions: - scanning the incoming and outgoing packets to detect malicious content or malware using heuristic rules;
- reporting detected malware to
intelligent agents 106; - recording the activity of the
network device - reporting the
network device intelligent agents 106. - By inspecting the incoming and outgoing data from a
device monitors 108 acquire a significant amount of data. Some of the data may be duplicative with that collected byother monitors 108. Scanning and reporting the same content frommultiple devices intrusion prevention system 100 since some attacks involve hiding or modifying of certain data. Also, some data is related to sensitive, private contents and is not monitored. Therefore, the client side (mobile device 110 side) monitors 108 and the network side monitors 108 may scan incoming and outgoing data differently. - For examples, monitors 108 on the client side may scan by performing any or all of the following functions:
- scanning the incoming and/or outgoing packets or files (data 124) from the
network application 122, Wi-Fi connection 112 b, or aBluetooth connection 112 a, where such scanning may be a deep scan, and include careful examination of individual contents using malware signatures and heuristic rules capable of identifying malicious programs or data; - recording the time, the source (incoming packets) and destination (outgoing packets) address, and the size of the packets, where the format of the recorded data can be made consistent with the format used in the
network 102 side monitoring; and - monitoring and recording other activities upon requests from
intelligent agents 106. - Some representative malware scanning algorithms for
mobile devices 110 include, but are not limited to, malware signature searches; hash signature searches as described in U.S. patent application Ser. No. 11/697,647 “Malware Detection System and Method for Mobile Platforms”; malware detection in headers and compressed parts of mobile messages as described in U.S. patent application Ser. No. 11/697,658 “Malware Detection System and Method for Compressed Data on Mobile Platforms”; malware modeling as described in U.S. patent application Ser. No. 11/697,642 “Malware Modeling Detection System and Method for Mobile Platforms”; malware modeling for limited access devices as described in U.S. patent application Ser. No. 11/697,664 “Malware Modeling Detection System and Method for Mobile Platforms”; and non-signature detection methods as described in U.S. patent application Ser. No. 11/697,668 “Non-Signature Malware Detection System and Method for Mobile Platforms”. -
Monitors 108 examine or scan communications among the elements of themobile network 102, includingmobile devices 110. In an embodiment, themonitors 108 on thenetwork 102 side use the sFlow monitoring specifications (see RFC 3176, available online at www.ietf.org/rfc/rfc3176.txt and herein incorporated by reference) thereby gathering considerable envelope and routing information and relatively little or no content information. When scanning of content is permitted, representative malware algorithms for scanning on thenetwork 102 side include, but are not limited to, malware signature searches; hash signature searches as described in U.S. patent application Ser. No. 11/697,647 “Malware Detection System and Method for Mobile Platforms”; and malware detection in headers and compressed parts of mobile messages as described in U.S. patent application Ser. No. 11/697,658 “Malware Detection System and Method for Compressed Data on Mobile Platforms”. - An
intelligent agent 106 receives information from one orseveral monitors 108.Intelligent agents 106 can be located in both themobile device 110 and thenetwork 102. In one embodiment, anintelligent agent 106 on amobile device 110 is associated with amonitor 108 in themobile device 110. In another embodiment, anintelligent agent 106 on thenetwork 102 is associated withmultiple monitors 108 in distributed locations, for example in different cities. Anintelligent agent 106 communicatively connects to thesecurity center 134. In alternative embodiments, anintelligent agent 106 is communicatively connected to otherintelligent agents 106. In another embodiment, the functions of anintelligent agent 106 include: - analyzing the information from
monitors 108 to build up user, device, and network 102 activity profiles; - detecting unusual
mobile device 110 activities or network connections; - reporting
mobile device 110 activities to thesecurity center 134 or otherintelligent agents 108 upon request; - reporting detected malicious attacks or malware to the
security center 134; - reporting suspicious activities or programs to the
security center 134 and requiring appropriate security actions; - cleaning or blocking detected malicious programs or data; and,
- receiving updates from the
security center 134 and informing the associated monitors 108. - An
intelligent agent 106 analyzes events reported from associatedmonitors 108 to determine if the events correlate to a characteristic of a malware attack. For example, anintelligent agent 106 reports a possible malicious attack if one or moremobile devices 110 receive multiple identical packets, a characteristic of a denial of service attack. - In an alternative embodiment, the functions of the
intelligent agent 106 are performed by thesecurity center 134. - Security centers 134 are portions of
network management systems 132 that monitornetwork 102 activities andcontrol network 102 security with a comprehensive set of security tools. Security centers 134 receive information fromintelligent agents 106 in bothmobile devices 110 and fromnetwork elements network 102. One responsibility of eachsecurity center 134 is to integrate and analyze the information from distributedmonitors 108 in thenetwork 102, e.g., information from both thenetwork 102 traffic andmobile devices 110, and use this information to protect thenetwork 102 against any malicious attack. In one embodiment, the security centers 134 have a hierarchical architecture, e.g., onelocal security center 134 is responsible for a particular portion of the radio network, and reports up to one or more global security centers 134. In this embodiment, alocal security center 134 performs the following actions: - integrate received information to build a profile for the activity of the locally monitored
network 102; - detect malicious attacks and malware, including distinguishing
normal network 102 activities from abnormal activities based on activity profile; - send security warnings, instructions, or updates to
intelligent agents 106; - generate security alarm to one or more of the
global security centers 134; and - provide a user interference that allows human experts to monitor the
network 102 activity, analyze suspicious programs, and verify security alarms. - In this embodiment, the
global security center 134 is responsible for: - coordinating
local security centers 134, integrating information from them and building a profile for the activity of theentire network 102; - detecting malicious attacks and malware that are missed by all the
local security centers 134; - analyzing the detected malicious attacks and malware to determine the appropriate security actions or solutions and generating updates for
local security centers 134 andintelligent agents 106; and - broadcasting security alarms and updates to local security centers 134.
- In an alternate embodiment, the security centers 134 have a flat architecture with overlapping regions of responsibility. The responsibilities of
security centers 134 in a flat architecture can be distributed among different servers as is commonly known in the art of distributed systems. - In an alternative embodiment, the functions of the
security center 134 are performed by theintelligent agent 106. In an alternative embodiment, either or both thesecurity center 134 and theintelligent agent 106 can be a mitigation agent triggering the mitigation actions to be performed on the network. - The wireless
intrusion prevention system 100 is capable of identifying and neutralizing multiple types of malicious attacks on themobile network 102. Examples listed below are meant to be illustrative and not to constrain the method and system to any specific embodiment. - Referring now to the flowchart of
FIG. 2 , amonitor 108 in amobile device 110 or network element monitors 202 communications in thenetwork 102 for identifying events characteristic of malicious communications to report to anintelligent agent 106. A battery draining malware typically involves port scanning a mobile device from another site using a spoofed address. Therefore battery draining malware may result in a suspicious increase of local network traffic, e.g., increasing network traffic with decreasing average packet sizes, or increased distributed communication among mobile devices. An intelligent agent or security center detects 204 the battery draining malware attack based upon an analysis or correlation of network activity. In an embodiment, anagent 106 orsecurity center 134 detects attack based upon the dynamics ofnetwork 102 activity when compared to the normal profiles of thenetwork 102 activity. In another embodiment, theintelligent agent 106 orsecurity center 134 compares activity levels to one or more predetermined thresholds. Such thresholds can be based upon historicdata regarding network 102 activity. In yet another embodiment, normal activity can be determined based upon averages of historic network activity. Alternatively, theagent 106 orsecurity center 134 can analyze the variation or percentage of change innetwork 102 activity over a specific time period to detect attacks. - In another embodiment, an
intelligent agent 106 detects 204 the battery draining malware attack by noting a packet sent to an invalid handset address. In an embodiment, a monitor on atrap handset 110, also called a honeypot, that does not have any normal active communication by itself monitors 202 any packets directed to thetrap handset 110 and reports the suspect activity. Similarly, anintelligent agent 106 orsecurity center 134 detects 204 traffic directed towardsmobile devices 110 that seldom have communications.Intelligent agents 106 report the detection to asecurity center 134 which analyzes 206 the results and determines whether a battery draining malware attack is occurring. - Once a battery draining malware attack is detected, intelligent agents in network elements perform appropriate actions to mitigate 208 the battery draining malware attack in the network. For example, on the
network 102 side,intelligent agents 106 instruct 210 thenetwork 102 to drop packets associated with the attack or provide information to thesecurity system 134 of thenetwork 102 operator. On the client side intelligent agents mitigate 212 the battery draining malware attack on the associated handsets. In an embodiment, intelligent agents instruct 216 mobile devices to ignore or filter the packets associated with the attack. If amobile device 110 sending malicious communications is inside the service provider'snetwork 102,intelligent agents 106 disable 216 outbound communications on thatmobile device 110, or restrict 216 communications to stop the malicious activity without completely disabling the communications interfaces. For example, communications could be limited to allowing themobile device 110 to reach network addresses associated with aservice center 134 in order to download antivirus software. - Another kind of attack, a DoS attack, is designed to overwhelm the network and quickly consume its resources. DoS attacks are identified 204 in a similar manner as a battery draining malware by detecting 204 a significant increase of activities associated with a
network device mobile devices 110. For example, under a DoS attack, the profile will show the an increase in volume of network traffic within a short time interval. This activity would indicate the likelihood of a DoS attack. Once a possible DoS attack is identified, thesecurity center 134 can analyze 206 the detection results and determine 206 whether or not an attack is actually occurring by taking certain actions, e.g., intercepting the network traffic, and/or sending responses to the suspect source IP addresses and requiring feedback. - The DoS attack can be mitigated in a similar manner as a battery draining malware attack. In addition, a DoS attack can also be stopped by identifying the malicious sender. For this, IP traceback techniques can be adapted to detect spoofed addresses. Once the sender is identified, corresponding
intelligent agents 106 instruct 210 the network to drop the packets associated with the attack. If the sender of the malicious communications is within the service provider'snetwork 102,intelligent agents 106 disable 216 outbound communications on that mobile device, or restrict 216 communications to stop the malicious activity. - Referring now to the flowchart of
FIG. 3 , a monitor in a mobile device scans 302 incoming programs on the mobile device for identifying characteristics of malware to report 304 to an intelligent agent. Many existing worms can be detected by pre-defined signatures. However, worms that change as they spread or new worms whose signatures are not yet included in antivirus databases cannot be identified based upon signature. Therefore, in addition to the signature-based detection, the monitors, intelligent agents, and security centers cooperate to detect and identify mobile worm malware using heuristic rules that describe suspicious behaviors of worms, e.g., upon infecting one device malicious worms propagate to a different device using standard spreading mechanisms such as Bluetooth or MMS. - On the client side, a monitor in a mobile device scans 302 incoming programs. Once the monitor detects suspicious behaviors in incoming programs, the
monitor 108 marks the program as suspicious and reports 304 the suspect program to the security center. The security center correlates 306 reports from distributed monitors. If a suspicious program is detected from many distributedmonitors 108, the security center concludes that the corresponding program is a spreading worm, performs 308 mitigating actions in thenetwork 102 and instructsintelligent agents 106 to perform 312 mitigating actions in themobile devices 110. - In an embodiment, on the network side,
intelligent agents 106 instruct 310 thenetwork 102 to drop or delete the packets associated with the suspect program and provide information to thesecurity system 134 of thenetwork 102 operator. In another embodiment, on the client side,intelligent agents 106 instruct 316 mobile devices to ignore or filter the packets associated with the suspect program. If amobile device 110 sending the suspect program is inside the service provider'snetwork 102, intelligent agents disables 316 outbound communications on that mobile device. In another embodiment, theintelligent agent 106 restricts 316 communications to stop the spread of the suspect program without completely disabling the communications interfaces. - In another embodiment, the service center also instructs other network level security centers to take action to prevent the work from spreading. The suspicious program is also analyzed in the security centers by experts to determine whether or not the suspect program is truly malicious, and if it is not malicious the security center can reverse the protective measures taken by the intelligent agents.
- The embodiments of the invention shown in the drawings and described above are exemplary of numerous embodiments that may be made within the scope of the appended claims. It is contemplated that numerous other configurations of the disclosed system and method for detecting, preventing, and stopping malware attacks on wireless networks may be created taking advantage of the disclosed approach. It is the applicant's intention that the scope of the patent issuing herefrom will be limited only by the scope of the appended claims.
Claims (8)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US13/336,787 US20120096539A1 (en) | 2006-11-27 | 2011-12-23 | Wireless intrusion prevention system and method |
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US86729706P | 2006-11-27 | 2006-11-27 | |
US11/946,003 US8087085B2 (en) | 2006-11-27 | 2007-11-27 | Wireless intrusion prevention system and method |
US13/336,787 US20120096539A1 (en) | 2006-11-27 | 2011-12-23 | Wireless intrusion prevention system and method |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/946,003 Division US8087085B2 (en) | 2006-11-27 | 2007-11-27 | Wireless intrusion prevention system and method |
Publications (1)
Publication Number | Publication Date |
---|---|
US20120096539A1 true US20120096539A1 (en) | 2012-04-19 |
Family
ID=39468656
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/946,003 Active 2030-04-16 US8087085B2 (en) | 2006-11-27 | 2007-11-27 | Wireless intrusion prevention system and method |
US13/336,787 Abandoned US20120096539A1 (en) | 2006-11-27 | 2011-12-23 | Wireless intrusion prevention system and method |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US11/946,003 Active 2030-04-16 US8087085B2 (en) | 2006-11-27 | 2007-11-27 | Wireless intrusion prevention system and method |
Country Status (3)
Country | Link |
---|---|
US (2) | US8087085B2 (en) |
CA (1) | CA2706721C (en) |
WO (1) | WO2008067335A2 (en) |
Cited By (24)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20130303159A1 (en) * | 2012-05-14 | 2013-11-14 | Qualcomm Incorporated | Collaborative learning for efficient behavioral analysis in networked mobile device |
US8595565B1 (en) * | 2010-12-15 | 2013-11-26 | The Boeing Company | Methods and systems for optimizing information technology costs based on outage costs |
EP2680182A1 (en) * | 2012-06-29 | 2014-01-01 | GSMK Gesellschaft für sichere Mobile Kommunikation mbH | Mobile device and method to monitor a baseband processor in relation to the actions on an application processor |
US20140004829A1 (en) * | 2012-06-29 | 2014-01-02 | Gsmk Gesellschaft Fur Sichere Mobile Kommunikation Mbh | Mobile device and method to monitor a baseband processor in relation to the actions on an applicaton processor |
US9152787B2 (en) | 2012-05-14 | 2015-10-06 | Qualcomm Incorporated | Adaptive observation of behavioral features on a heterogeneous platform |
WO2015159287A1 (en) * | 2014-04-14 | 2015-10-22 | Trap Data Security Ltd. | System and method for cyber threats detection |
US9319897B2 (en) | 2012-08-15 | 2016-04-19 | Qualcomm Incorporated | Secure behavior analysis over trusted execution environment |
US9324034B2 (en) | 2012-05-14 | 2016-04-26 | Qualcomm Incorporated | On-device real-time behavior analyzer |
US9330257B2 (en) | 2012-08-15 | 2016-05-03 | Qualcomm Incorporated | Adaptive observation of behavioral features on a mobile device |
US20160182533A1 (en) * | 2014-12-17 | 2016-06-23 | The Boeing Company | Computer defenses and counterattacks |
US9439077B2 (en) | 2012-04-10 | 2016-09-06 | Qualcomm Incorporated | Method for malicious activity detection in a mobile station |
US9491187B2 (en) | 2013-02-15 | 2016-11-08 | Qualcomm Incorporated | APIs for obtaining device-specific behavior classifier models from the cloud |
US9495537B2 (en) | 2012-08-15 | 2016-11-15 | Qualcomm Incorporated | Adaptive observation of behavioral features on a mobile device |
US9609456B2 (en) | 2012-05-14 | 2017-03-28 | Qualcomm Incorporated | Methods, devices, and systems for communicating behavioral analysis information |
WO2017091047A1 (en) * | 2015-11-27 | 2017-06-01 | 삼성전자 주식회사 | Method for blocking connection in wireless intrusion prevention system and device therefor |
US9684870B2 (en) | 2013-01-02 | 2017-06-20 | Qualcomm Incorporated | Methods and systems of using boosted decision stumps and joint feature selection and culling algorithms for the efficient classification of mobile device behaviors |
US9686023B2 (en) | 2013-01-02 | 2017-06-20 | Qualcomm Incorporated | Methods and systems of dynamically generating and using device-specific and device-state-specific classifier models for the efficient classification of mobile device behaviors |
US9690635B2 (en) | 2012-05-14 | 2017-06-27 | Qualcomm Incorporated | Communicating behavior information in a mobile computing device |
US9742559B2 (en) | 2013-01-22 | 2017-08-22 | Qualcomm Incorporated | Inter-module authentication for securing application execution integrity within a computing device |
US9747440B2 (en) | 2012-08-15 | 2017-08-29 | Qualcomm Incorporated | On-line behavioral analysis engine in mobile device with multiple analyzer model providers |
US10089582B2 (en) | 2013-01-02 | 2018-10-02 | Qualcomm Incorporated | Using normalized confidence values for classifying mobile device behaviors |
RU2680753C1 (en) * | 2015-02-09 | 2019-02-26 | Телефонактиеболагет Лм Эрикссон (Пабл) | Suppression of interpretation from internet attacks in ran using internet-transport |
WO2020085676A1 (en) * | 2018-10-26 | 2020-04-30 | Samsung Electronics Co., Ltd. | Electronic apparatus and controlling method thereof |
US11681804B2 (en) | 2020-03-09 | 2023-06-20 | Commvault Systems, Inc. | System and method for automatic generation of malware detection traps |
Families Citing this family (157)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7305700B2 (en) | 2002-01-08 | 2007-12-04 | Seven Networks, Inc. | Secure transport for mobile communication network |
US7853563B2 (en) | 2005-08-01 | 2010-12-14 | Seven Networks, Inc. | Universal data aggregation |
US7917468B2 (en) | 2005-08-01 | 2011-03-29 | Seven Networks, Inc. | Linking of personal information management data |
US8468126B2 (en) | 2005-08-01 | 2013-06-18 | Seven Networks, Inc. | Publishing data in an information community |
US7877703B1 (en) | 2005-03-14 | 2011-01-25 | Seven Networks, Inc. | Intelligent rendering of information in a limited display environment |
US8438633B1 (en) | 2005-04-21 | 2013-05-07 | Seven Networks, Inc. | Flexible real-time inbox access |
WO2006136660A1 (en) | 2005-06-21 | 2006-12-28 | Seven Networks International Oy | Maintaining an ip connection in a mobile network |
US7769395B2 (en) | 2006-06-20 | 2010-08-03 | Seven Networks, Inc. | Location-based operations and messaging |
CA2701689C (en) * | 2006-10-06 | 2016-09-06 | Smobile Systems, Inc. | System and method of malware sample collection on mobile networks |
US9069957B2 (en) * | 2006-10-06 | 2015-06-30 | Juniper Networks, Inc. | System and method of reporting and visualizing malware on mobile networks |
US7945955B2 (en) * | 2006-12-18 | 2011-05-17 | Quick Heal Technologies Private Limited | Virus detection in mobile devices having insufficient resources to execute virus detection software |
US8805425B2 (en) | 2007-06-01 | 2014-08-12 | Seven Networks, Inc. | Integrated messaging |
US8693494B2 (en) | 2007-06-01 | 2014-04-08 | Seven Networks, Inc. | Polling |
US8364181B2 (en) | 2007-12-10 | 2013-01-29 | Seven Networks, Inc. | Electronic-mail filtering for mobile devices |
US9002828B2 (en) | 2007-12-13 | 2015-04-07 | Seven Networks, Inc. | Predictive content delivery |
US8107921B2 (en) | 2008-01-11 | 2012-01-31 | Seven Networks, Inc. | Mobile virtual network operator |
US8862657B2 (en) | 2008-01-25 | 2014-10-14 | Seven Networks, Inc. | Policy based content service |
US20090193338A1 (en) | 2008-01-28 | 2009-07-30 | Trevor Fiatal | Reducing network and battery consumption during content delivery and playback |
US8787947B2 (en) | 2008-06-18 | 2014-07-22 | Seven Networks, Inc. | Application discovery on mobile devices |
US8078158B2 (en) | 2008-06-26 | 2011-12-13 | Seven Networks, Inc. | Provisioning applications for a mobile device |
US8667583B2 (en) | 2008-09-22 | 2014-03-04 | Microsoft Corporation | Collecting and analyzing malware data |
US20120137364A1 (en) * | 2008-10-07 | 2012-05-31 | Mocana Corporation | Remote attestation of a mobile device |
US8909759B2 (en) | 2008-10-10 | 2014-12-09 | Seven Networks, Inc. | Bandwidth measurement |
US8060936B2 (en) | 2008-10-21 | 2011-11-15 | Lookout, Inc. | Security status and information display system |
US9781148B2 (en) | 2008-10-21 | 2017-10-03 | Lookout, Inc. | Methods and systems for sharing risk responses between collections of mobile communications devices |
US9367680B2 (en) | 2008-10-21 | 2016-06-14 | Lookout, Inc. | System and method for mobile communication device application advisement |
US8984628B2 (en) | 2008-10-21 | 2015-03-17 | Lookout, Inc. | System and method for adverse mobile application identification |
US8347386B2 (en) | 2008-10-21 | 2013-01-01 | Lookout, Inc. | System and method for server-coupled malware prevention |
US8051480B2 (en) | 2008-10-21 | 2011-11-01 | Lookout, Inc. | System and method for monitoring and analyzing multiple interfaces and multiple protocols |
US8108933B2 (en) | 2008-10-21 | 2012-01-31 | Lookout, Inc. | System and method for attack and malware prevention |
US8533844B2 (en) | 2008-10-21 | 2013-09-10 | Lookout, Inc. | System and method for security data collection and analysis |
US8099472B2 (en) | 2008-10-21 | 2012-01-17 | Lookout, Inc. | System and method for a mobile cross-platform software system |
US8087067B2 (en) | 2008-10-21 | 2011-12-27 | Lookout, Inc. | Secure mobile platform system |
US9043919B2 (en) | 2008-10-21 | 2015-05-26 | Lookout, Inc. | Crawling multiple markets and correlating |
US9235704B2 (en) | 2008-10-21 | 2016-01-12 | Lookout, Inc. | System and method for a scanning API |
US8855601B2 (en) | 2009-02-17 | 2014-10-07 | Lookout, Inc. | System and method for remotely-initiated audio communication |
US8467768B2 (en) | 2009-02-17 | 2013-06-18 | Lookout, Inc. | System and method for remotely securing or recovering a mobile device |
US9955352B2 (en) | 2009-02-17 | 2018-04-24 | Lookout, Inc. | Methods and systems for addressing mobile communications devices that are lost or stolen but not yet reported as such |
US9042876B2 (en) | 2009-02-17 | 2015-05-26 | Lookout, Inc. | System and method for uploading location information based on device movement |
US8538815B2 (en) | 2009-02-17 | 2013-09-17 | Lookout, Inc. | System and method for mobile device replacement |
US8490176B2 (en) * | 2009-04-07 | 2013-07-16 | Juniper Networks, Inc. | System and method for controlling a mobile device |
US8752142B2 (en) * | 2009-07-17 | 2014-06-10 | American Express Travel Related Services Company, Inc. | Systems, methods, and computer program products for adapting the security measures of a communication network based on feedback |
US7743419B1 (en) * | 2009-10-01 | 2010-06-22 | Kaspersky Lab, Zao | Method and system for detection and prediction of computer virus-related epidemics |
US8442510B2 (en) * | 2009-10-09 | 2013-05-14 | At&T Intellectual Property I, L.P. | Mobile point-of-presence for on demand network client services and security |
US8397301B2 (en) | 2009-11-18 | 2013-03-12 | Lookout, Inc. | System and method for identifying and assessing vulnerabilities on a mobile communication device |
US9756076B2 (en) | 2009-12-17 | 2017-09-05 | American Express Travel Related Services Company, Inc. | Dynamically reacting policies and protections for securing mobile financial transactions |
US8621636B2 (en) | 2009-12-17 | 2013-12-31 | American Express Travel Related Services Company, Inc. | Systems, methods, and computer program products for collecting and reporting sensor data in a communication network |
KR20110071709A (en) * | 2009-12-21 | 2011-06-29 | 삼성전자주식회사 | Defending method against battery exhaustion attacks and battery-based wireless communication device and recording medium thereof |
US20110161452A1 (en) * | 2009-12-24 | 2011-06-30 | Rajesh Poornachandran | Collaborative malware detection and prevention on mobile devices |
US8650129B2 (en) | 2010-01-20 | 2014-02-11 | American Express Travel Related Services Company, Inc. | Dynamically reacting policies and protections for securing mobile financial transaction data in transit |
US9202049B1 (en) | 2010-06-21 | 2015-12-01 | Pulse Secure, Llc | Detecting malware on mobile devices |
US8850539B2 (en) | 2010-06-22 | 2014-09-30 | American Express Travel Related Services Company, Inc. | Adaptive policies and protections for securing financial transaction data at rest |
US8924296B2 (en) | 2010-06-22 | 2014-12-30 | American Express Travel Related Services Company, Inc. | Dynamic pairing system for securing a trusted communication channel |
US10360625B2 (en) | 2010-06-22 | 2019-07-23 | American Express Travel Related Services Company, Inc. | Dynamically adaptive policy management for securing mobile financial transactions |
JP5676762B2 (en) | 2010-07-26 | 2015-02-25 | セブン ネットワークス インコーポレイテッド | Mobile application traffic optimization |
WO2013015835A1 (en) | 2011-07-22 | 2013-01-31 | Seven Networks, Inc. | Mobile application traffic optimization |
US9077630B2 (en) | 2010-07-26 | 2015-07-07 | Seven Networks, Inc. | Distributed implementation of dynamic wireless traffic policy |
US8838783B2 (en) | 2010-07-26 | 2014-09-16 | Seven Networks, Inc. | Distributed caching for resource and mobile network traffic management |
WO2012015388A1 (en) * | 2010-07-26 | 2012-02-02 | Hewlett-Packard Development Company, L. P. | Mitigation of detected patterns in a network device |
US9043433B2 (en) | 2010-07-26 | 2015-05-26 | Seven Networks, Inc. | Mobile network traffic coordination across multiple applications |
CN103154884B (en) | 2010-10-27 | 2016-08-10 | 惠普发展公司,有限责任合伙企业 | Mode detection |
US8843153B2 (en) | 2010-11-01 | 2014-09-23 | Seven Networks, Inc. | Mobile traffic categorization and policy for network use optimization while preserving user experience |
WO2012060996A2 (en) | 2010-11-01 | 2012-05-10 | Michael Luna | Caching adapted for mobile application behavior and network conditions |
US8484314B2 (en) | 2010-11-01 | 2013-07-09 | Seven Networks, Inc. | Distributed caching in a wireless network of content delivered for a mobile application over a long-held request |
WO2012060995A2 (en) | 2010-11-01 | 2012-05-10 | Michael Luna | Distributed caching in a wireless network of content delivered for a mobile application over a long-held request |
US8166164B1 (en) | 2010-11-01 | 2012-04-24 | Seven Networks, Inc. | Application and network-based long poll request detection and cacheability assessment therefor |
EP2636268B1 (en) | 2010-11-22 | 2019-02-27 | Seven Networks, LLC | Optimization of resource polling intervals to satisfy mobile device requests |
CN103404193B (en) | 2010-11-22 | 2018-06-05 | 七网络有限责任公司 | The connection that adjustment data transmission is established with the transmission being optimized for through wireless network |
US8763126B2 (en) | 2010-12-08 | 2014-06-24 | At&T Intellectual Property I, L.P. | Devices, systems, and methods for detecting proximity-based mobile propagation |
US9064112B2 (en) * | 2010-12-09 | 2015-06-23 | At&T Intellectual Property I, L.P. | Malware detection for SMS/MMS based attacks |
EP2661697B1 (en) | 2011-01-07 | 2018-11-21 | Seven Networks, LLC | System and method for reduction of mobile network traffic used for domain name system (dns) queries |
US9084105B2 (en) | 2011-04-19 | 2015-07-14 | Seven Networks, Inc. | Device resources sharing for network resource conservation |
US8990891B1 (en) | 2011-04-19 | 2015-03-24 | Pulse Secure, Llc | Provisioning layer two network access for mobile devices |
US20120278886A1 (en) * | 2011-04-27 | 2012-11-01 | Michael Luna | Detection and filtering of malware based on traffic observations made in a distributed mobile traffic management system |
EP2621144B1 (en) | 2011-04-27 | 2014-06-25 | Seven Networks, Inc. | System and method for making requests on behalf of a mobile device based on atomic processes for mobile network traffic relief |
EP2702500B1 (en) | 2011-04-27 | 2017-07-19 | Seven Networks, LLC | Detecting and preserving state for satisfying application requests in a distributed proxy and cache system |
US8738765B2 (en) | 2011-06-14 | 2014-05-27 | Lookout, Inc. | Mobile device DNS optimization |
US9239800B2 (en) | 2011-07-27 | 2016-01-19 | Seven Networks, Llc | Automatic generation and distribution of policy information regarding malicious mobile traffic in a wireless network |
US20130031191A1 (en) * | 2011-07-27 | 2013-01-31 | Ross Bott | Mobile device usage control in a mobile network by a distributed proxy system |
US8655312B2 (en) * | 2011-08-12 | 2014-02-18 | F-Secure Corporation | Wireless access point detection |
US8788881B2 (en) | 2011-08-17 | 2014-07-22 | Lookout, Inc. | System and method for mobile device push communications |
US8925049B2 (en) * | 2011-11-18 | 2014-12-30 | Lockheed Martin Corporation | Automated wireless vulnerability assessment using hand-held wireless devices |
WO2013086214A1 (en) | 2011-12-06 | 2013-06-13 | Seven Networks, Inc. | A system of redundantly clustered machines to provide failover mechanisms for mobile traffic management and network resource conservation |
US8918503B2 (en) | 2011-12-06 | 2014-12-23 | Seven Networks, Inc. | Optimization of mobile traffic directed to private networks and operator configurability thereof |
EP2788889A4 (en) | 2011-12-07 | 2015-08-12 | Seven Networks Inc | Flexible and dynamic integration schemas of a traffic management system with various network operators for network traffic alleviation |
WO2013086447A1 (en) | 2011-12-07 | 2013-06-13 | Seven Networks, Inc. | Radio-awareness of mobile device for sending server-side control signals using a wireless network optimized transport protocol |
WO2013090834A1 (en) | 2011-12-14 | 2013-06-20 | Seven Networks, Inc. | Operation modes for mobile traffic optimization and concurrent management of optimized and non-optimized traffic |
US8861354B2 (en) | 2011-12-14 | 2014-10-14 | Seven Networks, Inc. | Hierarchies and categories for management and deployment of policies for distributed wireless traffic optimization |
WO2013090212A1 (en) | 2011-12-14 | 2013-06-20 | Seven Networks, Inc. | Mobile network reporting and usage analytics system and method using aggregation of data in a distributed traffic optimization system |
EP2795511A4 (en) | 2011-12-22 | 2015-12-16 | Intel Corp | User controllable platform-level trigger to set policy for protecting platform from malware |
US9916454B2 (en) | 2011-12-22 | 2018-03-13 | Intel Corporation | User controllable platform-level trigger to set policy for protecting platform from malware |
EP2801236A4 (en) | 2012-01-05 | 2015-10-21 | Seven Networks Inc | Detection and management of user interactions with foreground applications on a mobile device in distributed caching |
US8726338B2 (en) * | 2012-02-02 | 2014-05-13 | Juniper Networks, Inc. | Dynamic threat protection in mobile networks |
US9203864B2 (en) | 2012-02-02 | 2015-12-01 | Seven Networks, Llc | Dynamic categorization of applications for network access in a mobile network |
WO2013116852A1 (en) | 2012-02-03 | 2013-08-08 | Seven Networks, Inc. | User as an end point for profiling and optimizing the delivery of content and data in a wireless network |
US10169575B1 (en) * | 2012-03-14 | 2019-01-01 | Symantec Corporation | Systems and methods for preventing internal network attacks |
US8812695B2 (en) | 2012-04-09 | 2014-08-19 | Seven Networks, Inc. | Method and system for management of a virtual network connection without heartbeat messages |
WO2013155208A1 (en) | 2012-04-10 | 2013-10-17 | Seven Networks, Inc. | Intelligent customer service/call center services enhanced using real-time and historical mobile application and traffic-related statistics collected by a distributed caching system in a mobile network |
US9589129B2 (en) | 2012-06-05 | 2017-03-07 | Lookout, Inc. | Determining source of side-loaded software |
US9407443B2 (en) | 2012-06-05 | 2016-08-02 | Lookout, Inc. | Component analysis of software applications on computing devices |
WO2014011216A1 (en) | 2012-07-13 | 2014-01-16 | Seven Networks, Inc. | Dynamic bandwidth adjustment for browsing or streaming activity in a wireless network based on prediction of user behavior when interacting with mobile applications |
US9392003B2 (en) | 2012-08-23 | 2016-07-12 | Raytheon Foreground Security, Inc. | Internet security cyber threat reporting system and method |
US9161258B2 (en) | 2012-10-24 | 2015-10-13 | Seven Networks, Llc | Optimized and selective management of policy deployment to mobile clients in a congested network to prevent further aggravation of network congestion |
US8655307B1 (en) | 2012-10-26 | 2014-02-18 | Lookout, Inc. | System and method for developing, updating, and using user device behavioral context models to modify user, device, and application state, settings and behavior for enhanced user security |
US9307493B2 (en) | 2012-12-20 | 2016-04-05 | Seven Networks, Llc | Systems and methods for application management of mobile device radio state promotion and demotion |
US9208215B2 (en) | 2012-12-27 | 2015-12-08 | Lookout, Inc. | User classification based on data gathered from a computing device |
US9374369B2 (en) | 2012-12-28 | 2016-06-21 | Lookout, Inc. | Multi-factor authentication and comprehensive login system for client-server networks |
US8855599B2 (en) | 2012-12-31 | 2014-10-07 | Lookout, Inc. | Method and apparatus for auxiliary communications with mobile communications device |
US9424409B2 (en) | 2013-01-10 | 2016-08-23 | Lookout, Inc. | Method and system for protecting privacy and enhancing security on an electronic device |
US9241314B2 (en) | 2013-01-23 | 2016-01-19 | Seven Networks, Llc | Mobile device with application or context aware fast dormancy |
US8874761B2 (en) | 2013-01-25 | 2014-10-28 | Seven Networks, Inc. | Signaling optimization in a wireless network for traffic utilizing proprietary and non-proprietary protocols |
EP2959658A1 (en) | 2013-02-22 | 2015-12-30 | Adaptive Mobile Security Limited | Dynamic traffic steering system and method in a network |
US9326185B2 (en) | 2013-03-11 | 2016-04-26 | Seven Networks, Llc | Mobile network congestion recognition for optimization of mobile traffic |
US20140259168A1 (en) * | 2013-03-11 | 2014-09-11 | Alcatel-Lucent Usa Inc. | Malware identification using a hybrid host and network based approach |
US9830191B2 (en) | 2013-04-15 | 2017-11-28 | Seven Networks, Llc | Temporary or partial offloading of mobile application functions to a cloud-based environment |
US20140379911A1 (en) * | 2013-06-21 | 2014-12-25 | Gfi Software Ip S.A.R.L. | Network Activity Association System and Method |
EP3017578B1 (en) | 2013-07-02 | 2021-01-13 | Telefonaktiebolaget LM Ericsson (publ) | Methods, nodes and computer programs for reduction of undesired energy consumption of a server node |
US9396082B2 (en) | 2013-07-12 | 2016-07-19 | The Boeing Company | Systems and methods of analyzing a software component |
US9280369B1 (en) | 2013-07-12 | 2016-03-08 | The Boeing Company | Systems and methods of analyzing a software component |
US9336025B2 (en) | 2013-07-12 | 2016-05-10 | The Boeing Company | Systems and methods of analyzing a software component |
US9852290B1 (en) | 2013-07-12 | 2017-12-26 | The Boeing Company | Systems and methods of analyzing a software component |
US9065765B2 (en) | 2013-07-22 | 2015-06-23 | Seven Networks, Inc. | Proxy server associated with a mobile carrier for enhancing mobile traffic management in a mobile network |
US9479521B2 (en) * | 2013-09-30 | 2016-10-25 | The Boeing Company | Software network behavior analysis and identification system |
KR101502490B1 (en) * | 2013-10-18 | 2015-03-13 | 주식회사 케이티 | Subscibe terminal and security farm node for monitoring network traffic |
US9642008B2 (en) | 2013-10-25 | 2017-05-02 | Lookout, Inc. | System and method for creating and assigning a policy for a mobile communications device based on personal data |
US9973534B2 (en) | 2013-11-04 | 2018-05-15 | Lookout, Inc. | Methods and systems for secure network connections |
US9319423B2 (en) | 2013-11-04 | 2016-04-19 | At&T Intellectual Property I, L.P. | Malware and anomaly detection via activity recognition based on sensor data |
US10223530B2 (en) | 2013-11-13 | 2019-03-05 | Proofpoint, Inc. | System and method of protecting client computers |
US9753796B2 (en) | 2013-12-06 | 2017-09-05 | Lookout, Inc. | Distributed monitoring, evaluation, and response for multiple devices |
US10122747B2 (en) | 2013-12-06 | 2018-11-06 | Lookout, Inc. | Response generation after distributed monitoring and evaluation of multiple devices |
US9344894B2 (en) * | 2014-02-10 | 2016-05-17 | Qualcomm Incorporated | Methods and systems for handling malicious attacks in a wireless communication system |
US9525689B2 (en) | 2014-03-25 | 2016-12-20 | Symbol Technologies, Llc | Detection of an unauthorized wireless communication device |
US10055581B2 (en) * | 2014-06-24 | 2018-08-21 | Symbol Technologies, Llc | Locating a wireless communication attack |
US10721267B1 (en) * | 2014-07-18 | 2020-07-21 | NortonLifeLock Inc. | Systems and methods for detecting system attacks |
EP3257286B1 (en) * | 2015-02-09 | 2021-05-12 | Telefonaktiebolaget LM Ericsson (publ) | Mitigating the impact from internet attacks in a ran using internet transport |
US10050992B2 (en) | 2015-02-09 | 2018-08-14 | Telefonaktiebolaget Lm Ericsson (Publ) | Mitigating the impact from Internet attacks in a RAN using Internet transport |
US9794265B1 (en) | 2015-03-16 | 2017-10-17 | Wells Fargo Bank, N.A. | Authentication and authorization without the use of supplicants |
US9749353B1 (en) | 2015-03-16 | 2017-08-29 | Wells Fargo Bank, N.A. | Predictive modeling for anti-malware solutions |
WO2016178816A1 (en) | 2015-05-01 | 2016-11-10 | Lookout, Inc. | Determining source of side-loaded software |
KR102411770B1 (en) * | 2015-11-13 | 2022-06-22 | 삼성전자주식회사 | Apparatus and method for protecting electronic device |
US10505959B1 (en) * | 2015-12-10 | 2019-12-10 | Hewlett Packard Enterprise Development Lp | System and method directed to behavioral profiling services |
US9912700B2 (en) | 2016-01-04 | 2018-03-06 | Bank Of America Corporation | System for escalating security protocol requirements |
US9749308B2 (en) | 2016-01-04 | 2017-08-29 | Bank Of America Corporation | System for assessing network authentication requirements based on situational instance |
US10003686B2 (en) | 2016-01-04 | 2018-06-19 | Bank Of America Corporation | System for remotely controlling access to a mobile device |
US10002248B2 (en) | 2016-01-04 | 2018-06-19 | Bank Of America Corporation | Mobile device data security system |
US9723485B2 (en) | 2016-01-04 | 2017-08-01 | Bank Of America Corporation | System for authorizing access based on authentication via separate channel |
WO2017131662A1 (en) | 2016-01-27 | 2017-08-03 | Aruba Networks, Inc. | Preventing malware downloads |
US10277564B2 (en) | 2016-05-04 | 2019-04-30 | Nxp Usa, Inc. | Light-weight key update mechanism with blacklisting based on secret sharing algorithm in wireless sensor networks |
US10212141B2 (en) | 2016-05-04 | 2019-02-19 | Nxp Usa, Inc. | Autonomous key update mechanism with blacklisting of compromised nodes for mesh networks |
US10440053B2 (en) | 2016-05-31 | 2019-10-08 | Lookout, Inc. | Methods and systems for detecting and preventing network connection compromise |
US10534925B2 (en) * | 2016-10-05 | 2020-01-14 | Microsoft Technology Licensing, Llc | Detection of compromised devices via user states |
JP6645998B2 (en) * | 2017-03-16 | 2020-02-14 | 日本電信電話株式会社 | Response instruction device, response instruction method, response instruction program |
US10218697B2 (en) | 2017-06-09 | 2019-02-26 | Lookout, Inc. | Use of device risk evaluation to manage access to services |
US10505954B2 (en) * | 2017-06-14 | 2019-12-10 | Microsoft Technology Licensing, Llc | Detecting malicious lateral movement across a computer network |
JP6931094B2 (en) | 2017-06-23 | 2021-09-01 | ローベルト ボツシユ ゲゼルシヤフト ミツト ベシユレンクテル ハフツングRobert Bosch Gmbh | A method for detecting disruptions in a vehicle's communication system by checking for communication anomalies |
US11641366B2 (en) | 2021-01-11 | 2023-05-02 | Bank Of America Corporation | Centralized tool for identifying and blocking malicious communications transmitted within a network |
US11386197B1 (en) | 2021-01-11 | 2022-07-12 | Bank Of America Corporation | System and method for securing a network against malicious communications through peer-based cooperation |
Citations (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20030027551A1 (en) * | 2001-08-03 | 2003-02-06 | Rockwell Laurence I. | Network security architecture for a mobile network platform |
US20030084321A1 (en) * | 2001-10-31 | 2003-05-01 | Tarquini Richard Paul | Node and mobile device for a mobile telecommunications network providing intrusion detection |
US20040028016A1 (en) * | 2002-08-12 | 2004-02-12 | Harris Corporation | Mobile ad-hoc network with intrusion detection features and related methods |
US20050037733A1 (en) * | 2003-08-12 | 2005-02-17 | 3E Technologies, International, Inc. | Method and system for wireless intrusion detection prevention and security management |
US20060150250A1 (en) * | 2004-12-20 | 2006-07-06 | Lee Sok J | Intrusion detection sensor detecting attacks against wireless network and system and method of detecting wireless network intrusion |
US20070217371A1 (en) * | 2006-03-17 | 2007-09-20 | Airdefense, Inc. | Systems and Methods for Wireless Security Using Distributed Collaboration of Wireless Clients |
US20070291945A1 (en) * | 2006-06-15 | 2007-12-20 | Che-Ming Chuang | Distributed wireless security system |
US20080096526A1 (en) * | 2006-10-20 | 2008-04-24 | Nokia Corporation | Apparatus and a security node for use in determining security attacks |
US7426383B2 (en) * | 2003-12-22 | 2008-09-16 | Symbol Technologies, Inc. | Wireless LAN intrusion detection based on location |
US7515926B2 (en) * | 2005-03-30 | 2009-04-07 | Alcatel-Lucent Usa Inc. | Detection of power-drain denial-of-service attacks in wireless networks |
US7778606B2 (en) * | 2002-05-17 | 2010-08-17 | Network Security Technologies, Inc. | Method and system for wireless intrusion detection |
Family Cites Families (23)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7702806B2 (en) * | 2000-09-07 | 2010-04-20 | Riverbed Technology, Inc. | Statistics collection for network traffic |
US20020116639A1 (en) * | 2001-02-21 | 2002-08-22 | International Business Machines Corporation | Method and apparatus for providing a business service for the detection, notification, and elimination of computer viruses |
US6993660B1 (en) * | 2001-08-03 | 2006-01-31 | Mcafee, Inc. | System and method for performing efficient computer virus scanning of transient messages using checksums in a distributed computing environment |
US7331061B1 (en) * | 2001-09-07 | 2008-02-12 | Secureworks, Inc. | Integrated computer security management system and method |
US7062553B2 (en) * | 2001-12-04 | 2006-06-13 | Trend Micro, Inc. | Virus epidemic damage control system and method for network environment |
US8331907B2 (en) * | 2003-02-18 | 2012-12-11 | Roamware, Inc. | Integrating GSM and WiFi service in mobile communication devices |
US7287281B1 (en) * | 2003-06-17 | 2007-10-23 | Symantec Corporation | Send blocking system and method |
KR20050002320A (en) | 2003-06-30 | 2005-01-07 | 신동준 | E-mail managing system and method thereof |
US7287278B2 (en) * | 2003-08-29 | 2007-10-23 | Trend Micro, Inc. | Innoculation of computing devices against a selected computer virus |
US7620990B2 (en) * | 2004-01-30 | 2009-11-17 | Microsoft Corporation | System and method for unpacking packed executables for malware evaluation |
US7831838B2 (en) * | 2004-03-05 | 2010-11-09 | Microsoft Corporation | Portion-level in-memory module authentication |
US8074277B2 (en) * | 2004-06-07 | 2011-12-06 | Check Point Software Technologies, Inc. | System and methodology for intrusion detection and prevention |
US7748038B2 (en) * | 2004-06-16 | 2010-06-29 | Ironport Systems, Inc. | Method and apparatus for managing computer virus outbreaks |
SG119237A1 (en) * | 2004-07-30 | 2006-02-28 | E Cop Net Pte Ltd | An intrusion protection system and method |
GB2421142A (en) * | 2004-12-09 | 2006-06-14 | Agilent Technologies Inc | Detecting malicious traffic in a communications network |
US20060203736A1 (en) * | 2005-03-10 | 2006-09-14 | Stsn General Holdings Inc. | Real-time mobile user network operations center |
FI20050491A0 (en) * | 2005-05-09 | 2005-05-09 | Nokia Corp | System for delivery of certificates in a communication system |
US7496348B2 (en) * | 2005-06-07 | 2009-02-24 | Motorola, Inc. | Wireless communication network security method and system |
US20070118759A1 (en) * | 2005-10-07 | 2007-05-24 | Sheppard Scott K | Undesirable email determination |
US20070089172A1 (en) * | 2005-10-14 | 2007-04-19 | Bare Ballard C | Methods for identifying self-replicating threats using historical data |
US8312545B2 (en) * | 2006-04-06 | 2012-11-13 | Juniper Networks, Inc. | Non-signature malware detection system and method for mobile platforms |
CA2701689C (en) * | 2006-10-06 | 2016-09-06 | Smobile Systems, Inc. | System and method of malware sample collection on mobile networks |
US9069957B2 (en) * | 2006-10-06 | 2015-06-30 | Juniper Networks, Inc. | System and method of reporting and visualizing malware on mobile networks |
-
2007
- 2007-11-27 US US11/946,003 patent/US8087085B2/en active Active
- 2007-11-27 CA CA2706721A patent/CA2706721C/en active Active
- 2007-11-27 WO PCT/US2007/085677 patent/WO2008067335A2/en active Application Filing
-
2011
- 2011-12-23 US US13/336,787 patent/US20120096539A1/en not_active Abandoned
Patent Citations (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20030027551A1 (en) * | 2001-08-03 | 2003-02-06 | Rockwell Laurence I. | Network security architecture for a mobile network platform |
US20030084321A1 (en) * | 2001-10-31 | 2003-05-01 | Tarquini Richard Paul | Node and mobile device for a mobile telecommunications network providing intrusion detection |
US7778606B2 (en) * | 2002-05-17 | 2010-08-17 | Network Security Technologies, Inc. | Method and system for wireless intrusion detection |
US20040028016A1 (en) * | 2002-08-12 | 2004-02-12 | Harris Corporation | Mobile ad-hoc network with intrusion detection features and related methods |
US20050037733A1 (en) * | 2003-08-12 | 2005-02-17 | 3E Technologies, International, Inc. | Method and system for wireless intrusion detection prevention and security management |
US7426383B2 (en) * | 2003-12-22 | 2008-09-16 | Symbol Technologies, Inc. | Wireless LAN intrusion detection based on location |
US20060150250A1 (en) * | 2004-12-20 | 2006-07-06 | Lee Sok J | Intrusion detection sensor detecting attacks against wireless network and system and method of detecting wireless network intrusion |
US7515926B2 (en) * | 2005-03-30 | 2009-04-07 | Alcatel-Lucent Usa Inc. | Detection of power-drain denial-of-service attacks in wireless networks |
US20070217371A1 (en) * | 2006-03-17 | 2007-09-20 | Airdefense, Inc. | Systems and Methods for Wireless Security Using Distributed Collaboration of Wireless Clients |
US20070291945A1 (en) * | 2006-06-15 | 2007-12-20 | Che-Ming Chuang | Distributed wireless security system |
US20080096526A1 (en) * | 2006-10-20 | 2008-04-24 | Nokia Corporation | Apparatus and a security node for use in determining security attacks |
Cited By (37)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20140101493A1 (en) * | 2010-12-15 | 2014-04-10 | The Boeing Company | Methods and systems for optimizing information technology costs based on outage costs |
US8595565B1 (en) * | 2010-12-15 | 2013-11-26 | The Boeing Company | Methods and systems for optimizing information technology costs based on outage costs |
US8892961B2 (en) * | 2010-12-15 | 2014-11-18 | The Boeing Company | Methods and systems for optimizing information technology costs based on outage costs |
US9439077B2 (en) | 2012-04-10 | 2016-09-06 | Qualcomm Incorporated | Method for malicious activity detection in a mobile station |
US9690635B2 (en) | 2012-05-14 | 2017-06-27 | Qualcomm Incorporated | Communicating behavior information in a mobile computing device |
US9292685B2 (en) | 2012-05-14 | 2016-03-22 | Qualcomm Incorporated | Techniques for autonomic reverting to behavioral checkpoints |
US9152787B2 (en) | 2012-05-14 | 2015-10-06 | Qualcomm Incorporated | Adaptive observation of behavioral features on a heterogeneous platform |
US9898602B2 (en) | 2012-05-14 | 2018-02-20 | Qualcomm Incorporated | System, apparatus, and method for adaptive observation of mobile device behavior |
US9189624B2 (en) | 2012-05-14 | 2015-11-17 | Qualcomm Incorporated | Adaptive observation of behavioral features on a heterogeneous platform |
US9609456B2 (en) | 2012-05-14 | 2017-03-28 | Qualcomm Incorporated | Methods, devices, and systems for communicating behavioral analysis information |
US9202047B2 (en) | 2012-05-14 | 2015-12-01 | Qualcomm Incorporated | System, apparatus, and method for adaptive observation of mobile device behavior |
US9349001B2 (en) | 2012-05-14 | 2016-05-24 | Qualcomm Incorporated | Methods and systems for minimizing latency of behavioral analysis |
US9298494B2 (en) * | 2012-05-14 | 2016-03-29 | Qualcomm Incorporated | Collaborative learning for efficient behavioral analysis in networked mobile device |
US20130303159A1 (en) * | 2012-05-14 | 2013-11-14 | Qualcomm Incorporated | Collaborative learning for efficient behavioral analysis in networked mobile device |
US9324034B2 (en) | 2012-05-14 | 2016-04-26 | Qualcomm Incorporated | On-device real-time behavior analyzer |
US20140004829A1 (en) * | 2012-06-29 | 2014-01-02 | Gsmk Gesellschaft Fur Sichere Mobile Kommunikation Mbh | Mobile device and method to monitor a baseband processor in relation to the actions on an applicaton processor |
EP2680182A1 (en) * | 2012-06-29 | 2014-01-01 | GSMK Gesellschaft für sichere Mobile Kommunikation mbH | Mobile device and method to monitor a baseband processor in relation to the actions on an application processor |
US9191823B2 (en) * | 2012-06-29 | 2015-11-17 | GSMK Gesellschaft für sichere mobile Kommunikation mbH | Mobile device and method to monitor a baseband processor in relation to the actions on an applicaton processor |
US9747440B2 (en) | 2012-08-15 | 2017-08-29 | Qualcomm Incorporated | On-line behavioral analysis engine in mobile device with multiple analyzer model providers |
US9330257B2 (en) | 2012-08-15 | 2016-05-03 | Qualcomm Incorporated | Adaptive observation of behavioral features on a mobile device |
US9495537B2 (en) | 2012-08-15 | 2016-11-15 | Qualcomm Incorporated | Adaptive observation of behavioral features on a mobile device |
US9319897B2 (en) | 2012-08-15 | 2016-04-19 | Qualcomm Incorporated | Secure behavior analysis over trusted execution environment |
US10089582B2 (en) | 2013-01-02 | 2018-10-02 | Qualcomm Incorporated | Using normalized confidence values for classifying mobile device behaviors |
US9684870B2 (en) | 2013-01-02 | 2017-06-20 | Qualcomm Incorporated | Methods and systems of using boosted decision stumps and joint feature selection and culling algorithms for the efficient classification of mobile device behaviors |
US9686023B2 (en) | 2013-01-02 | 2017-06-20 | Qualcomm Incorporated | Methods and systems of dynamically generating and using device-specific and device-state-specific classifier models for the efficient classification of mobile device behaviors |
US9742559B2 (en) | 2013-01-22 | 2017-08-22 | Qualcomm Incorporated | Inter-module authentication for securing application execution integrity within a computing device |
US9491187B2 (en) | 2013-02-15 | 2016-11-08 | Qualcomm Incorporated | APIs for obtaining device-specific behavior classifier models from the cloud |
US9516054B2 (en) | 2014-04-14 | 2016-12-06 | Trap Data Security Ltd. | System and method for cyber threats detection |
WO2015159287A1 (en) * | 2014-04-14 | 2015-10-22 | Trap Data Security Ltd. | System and method for cyber threats detection |
US9591022B2 (en) * | 2014-12-17 | 2017-03-07 | The Boeing Company | Computer defenses and counterattacks |
US20160182533A1 (en) * | 2014-12-17 | 2016-06-23 | The Boeing Company | Computer defenses and counterattacks |
RU2680753C1 (en) * | 2015-02-09 | 2019-02-26 | Телефонактиеболагет Лм Эрикссон (Пабл) | Suppression of interpretation from internet attacks in ran using internet-transport |
WO2017091047A1 (en) * | 2015-11-27 | 2017-06-01 | 삼성전자 주식회사 | Method for blocking connection in wireless intrusion prevention system and device therefor |
US10834596B2 (en) | 2015-11-27 | 2020-11-10 | Samsung Electronics Co., Ltd. | Method for blocking connection in wireless intrusion prevention system and device therefor |
WO2020085676A1 (en) * | 2018-10-26 | 2020-04-30 | Samsung Electronics Co., Ltd. | Electronic apparatus and controlling method thereof |
US11496903B2 (en) * | 2018-10-26 | 2022-11-08 | Samsung Electronics Co., Ltd. | Electronic apparatus and controlling method thereof |
US11681804B2 (en) | 2020-03-09 | 2023-06-20 | Commvault Systems, Inc. | System and method for automatic generation of malware detection traps |
Also Published As
Publication number | Publication date |
---|---|
CA2706721A1 (en) | 2008-06-05 |
CA2706721C (en) | 2016-05-31 |
WO2008067335A3 (en) | 2008-08-07 |
US8087085B2 (en) | 2011-12-27 |
US20080178294A1 (en) | 2008-07-24 |
WO2008067335A2 (en) | 2008-06-05 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US8087085B2 (en) | Wireless intrusion prevention system and method | |
CA2701689C (en) | System and method of malware sample collection on mobile networks | |
US9069957B2 (en) | System and method of reporting and visualizing malware on mobile networks | |
RU129279U1 (en) | DEVICE FOR DETECTION AND PROTECTION AGAINST ANOMALOUS ACTIVITY ON DATA TRANSMISSION NETWORKS | |
US20080196104A1 (en) | Off-line mms malware scanning system and method | |
US7624447B1 (en) | Using threshold lists for worm detection | |
US8650287B2 (en) | Local reputation to adjust sensitivity of behavioral detection system | |
US9628508B2 (en) | Discovery of suspect IP addresses | |
US7610624B1 (en) | System and method for detecting and preventing attacks to a target computer system | |
US20050216956A1 (en) | Method and system for authentication event security policy generation | |
US20100251370A1 (en) | Network intrusion detection system | |
US20030188189A1 (en) | Multi-level and multi-platform intrusion detection and response system | |
US20050005017A1 (en) | Method and system for reducing scope of self-propagating attack code in network | |
US20030188190A1 (en) | System and method of intrusion detection employing broad-scope monitoring | |
JP2006319982A (en) | Worm-specifying and non-activating method and apparatus in communications network | |
Bailey et al. | A hybrid honeypot architecture for scalable network monitoring | |
EP1754348B1 (en) | Using address ranges to detect malicious activity | |
Raftopoulos et al. | How dangerous is internet scanning? a measurement study of the aftermath of an internet-wide scan | |
JP3652661B2 (en) | Method and apparatus for preventing denial of service attack and computer program therefor | |
EP1461704B1 (en) | Protecting against malicious traffic | |
JP2008022498A (en) | Network abnormality detection apparatus, network abnormality detecting method, and network abnormality detection system | |
JP4159814B2 (en) | Interactive network intrusion detection system and interactive intrusion detection program | |
Whyte et al. | Tracking darkports for network defense | |
CN113411296B (en) | Situation awareness virtual link defense method, device and system | |
KR20110027386A (en) | Apparatus, system and method for protecting malicious packets transmitted outside from user terminal |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |
|
AS | Assignment |
Owner name: JUNIPER NETWORKS, INC., CALIFORNIA Free format text: SECURITY INTEREST;ASSIGNORS:PULSE SECURE, LLC;SMOBILE SYSTEMS, INC.;REEL/FRAME:034037/0526 Effective date: 20141001 Owner name: PULSE SECURE, LLC, CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:JUNIPER NETWORKS, INC.;REEL/FRAME:034036/0904 Effective date: 20141001 |
|
AS | Assignment |
Owner name: PULSE SECURE, LLC, CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:JUNIPER NETWORKS, INC.;REEL/FRAME:053271/0307 Effective date: 20200720 Owner name: SMOBILE SYSTEMS, INC., CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:JUNIPER NETWORKS, INC.;REEL/FRAME:053271/0307 Effective date: 20200720 |