System and method for securing a network from zero-day vulnerability exploits

Patent metadata

Field	Value
Publication number	US-9264441-B2
Application number	US-7901308-A
Country	US
Kind code	B2
Filing date	Mar 24, 2008
Priority date	Mar 24, 2008
Publication date	Feb 16, 2016
Grant date	Feb 16, 2016

Abstract

A method of securing a network from vulnerability exploits, including the steps of a traffic analysis engine receiving a plurality of packets destined for an internal operating system; the traffic analysis engine selectively forwarding the packets to at least one virtual machine emulating the internal operating system; the virtual machine processing each forwarded packet; a rapid analysis engine identifying a malicious packet from the processed packets; and the rapid analysis engine creating a new signature to identify the malicious packet.

First claim

What is claimed is:

1. A method of securing a network from vulnerability exploits, comprising:
receiving a plurality of packets destined for an internal operating system;
comparing, by a processor, packets received to at least one signature defined in an intrusion prevention system;
upon a determination that a packet being compared does not match any signature in said intrusion prevention system, storing the packet in a buffer, the buffer providing storage for a plurality of packets;
forwarding a copy of the packet to a virtual machine emulating said internal operating system in processing the packet;
monitoring performance of the virtual machine;
deleting the stored packet from the buffer upon a determination that the stored packet was stored in the buffer for a predetermined time period;
detecting a failure of the virtual machine;
analyzing the packets in the buffer to identify a malicious packet in response to detecting the failure of the virtual machine; and
creating a new signature based upon the identified malicious packet.

2. The method of claim 1 further comprising:
adding said new signature to said intrusion prevention system.

3. The method of claim 1 further comprising:
recording execution of at least one of said receiving, said comparing, said forwarding, said processing, said identifying, and said creating in a memory.

4. A method of securing a network from vulnerability exploits, comprising:
receiving a plurality of packets destined for an internal operating system;
storing each packet of the plurality of packets in a buffer;
selectively forwarding a copy of each packet of said plurality of packets to a virtual machine emulating said internal operating system;
monitoring performance of said virtual machine in processing the forwarded packets;
deleting a stored packet of the plurality of packets from the buffer upon a determination that said packet was stored in the buffer for a predetermined time period;
detecting a failure of said virtual machine;
analyzing said packets in said buffer and identifying a malicious packet from said buffer packets in response to detecting the failure of said virtual machine; and
creating a malicious packet signature based upon the identified malicious packet.

5. The method of claim 4 further comprising:
sending, by said virtual machine, a status report to said processor through a private network connection linking said virtual machine to said processor.

6. The method of claim 4 further comprising:
identifying at least one non-malicious packet; and
deleting each said non-malicious packet from said buffer.

7. The method of claim 4 further comprising:
recording execution of at least one of said defining, said storing, said deleting, said monitoring, and said analyzing in a memory.

8. The method of claim 1 further comprising:
upon a determination that said packet being compared does match any said signature, preventing said packet from being sent to said internal operating system.

9. The method of claim 1 further comprising:
sending at least one of said signatures in said intrusion prevention system to said internal operating system.

10. The method of claim 1 further comprising:
creating an access control list within said traffic analysis engine specifying packets not to be processed using said virtual machine.

11. A non-transitory machine-readable medium comprising machine readable instructions that when executed by a processor perform a method, the machine readable instructions to cause the processor to:
receive a plurality of packets destined for an internal operating system;
store the plurality of packets in a buffer;
forward a copy of each packet of said plurality of packets to a virtual machine emulating said internal operating system;
monitor performance of said virtual machine in processing the forwarded packets;
delete a packet of the plurality of packets from the buffer upon a determination that said packet was stored in the buffer for a predetermined time period;
detect a failure of said virtual machine; and
analyze said packets in said buffer and identify said malicious packet from said buffer packets in response to detecting the failure of said virtual machine; and
create a malicious packet signature based upon the identified malicious packet.

12. The non-transitory machine readable medium of claim 11 , wherein the machine readable instructions further comprise code to:
add said identified malicious packet signature to an intrusion prevention system.

13. A system for securing a network from vulnerability exploits, comprising:
a traffic analysis engine, the traffic analysis engine further comprising a processor and a non-transitory computer-readable medium, the non-transitory computer readable medium comprising code, which when executed by the processor, cause the traffic analysis engine to:
receive a plurality of packets destined for an internal operating system;
store each packet of the plurality of packets in a buffer;
selectively forward a copy of each said packet to a virtual machine emulating said internal operating system;
monitor performance of said virtual machine in processing the selectively forwarded packets;
delete a packet of the plurality of packets from the buffer upon a determination that said packet was stored in the buffer for a predetermined time period;
detect a failure of said virtual machine; and
analyze said packets in said buffer and identify said malicious packet from said buffer packets in response to detecting the failure of said virtual machine; and
create a malicious packet signature based upon the identified malicious packet.

14. The system of claim 13 further comprising:
an incoming network card to provide communication between said system and an external source; and
an outgoing network card to provide communication between said system and said internal operating system.

15. A method of securing a network from vulnerability exploits, comprising:
analyzing packets destined for an internal operating system and discarding any packets having a signature indicating a vulnerability exploit;
storing each packet of the packets in a buffer;
selectively forwarding a copy of each of the packets that do not have a signature indicating a vulnerability exploit to a virtual machine emulating said internal operating system;
monitoring performance of the virtual machine in processing the selectively forwarded packets;
deleting a stored packet from the buffer upon a determination that the stored packet was stored in the buffer for a predetermined time period;
detecting a failure of the virtual machine; and
analyzing the packets in the buffer and identifying a malicious packet from said buffer packets in response to a detected failure of the virtual machine; and
creating a new signature based on the identified malicious packet.

Assignees

• Todd Michael
• Koster Scott Robert
• Wong Patrick Choy Ming
• Hewlett Packard Entpr Dev Lp

Inventors

• Todd Michael
• Koster Scott Robert
• Wong Patrick Choy Ming

Classifications

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• G06F21/564

  by virus signature recognition · CPC title