Identifying malicious devices within a computer network

Abstract

This disclosure describes techniques for proactively identifying possible attackers based on a profile of a device. For example, a device includes one or more processors and network interface cards to receive, from a remote device, network traffic directed to one or more computing devices protected by the device, determine, based on content of the network traffic, a first set of data points for the device, send a response to the remote device to ascertain a second set of data points for the device, and receive, from the remote device, at least a portion of the second set of data points. The device also includes a security module operable by the processors to determine a maliciousness rating, and selectively manage, based on the maliciousness rating, additional network traffic directed to the one or more computing devices protected by the security device and received from the remote device.

Description

technical field [0001] The present disclosure relates to computing systems, and more particularly to computing system attack detection and prevention. Background technique [0002] There are an increasing number and complexity of cyber-attacks, especially those targeting web applications and servers, which involve high-value traffic. Insecure applications and servers can result in customer loss, financial loss, reputational damage and legal conflicts. In an attempt to detect cyberattacks from a group of attackers, for example, companies can use attack signatures. However, attack signatures are reactive in that they only block attacks that trigger an existing signature, and in some instances, after the attacker has already done some damage. Additionally, an attacker may alter network traffic such that the attacker's traffic no longer matches the signature, thereby failing the signature and preventing the security device from blocking the attack. Contents of the invention ...

AI Technical Summary

Problems solved by technology

However, attack signatures are reactive in that they only block attacks that trigger an existing signature, and in some instances, after the attacker has already done some damage

Additionally, an attacker could alter network traffic such that the attacker's traffic no longer matches the signature, thereby failing the signature and preventing the security device from blocking the attack

Images