Patent Application
20140259167
1. Field of the Invention
The present invention relates to a system and method for detecting prohibited behaviors in a computer network or device thereof. More particularly, the present invention relates to a system and method for generating a list of prohibited behaviors and a list of corrective actions mapped to the prohibited behaviors that, in connection with monitoring conditions, aid in the detection and avoidance of unwanted behavior of users, processes and applications in a communications network or in a device thereof.
2. Description of the Related Art
Enterprises often employ communications networks in order to facilitate communications between and among employees. Related-art enterprise networks are, for example, a collection of hardware devices interconnected by communication channels that allow sharing of resources and information among members of the enterprise. Various types of enterprise networks may include any of a Local Area Network (LAN), a workgroup network, a client-server network, an Intranet, an Extranet, and the like. Mobile devices are commonly incorporated into these enterprise networks.
In related-art networks, security concerns often arise from the unauthorized behavior of a user, a process, or an application running on a network device or combination thereof. Such unauthorized use can result in unwanted loss, damage, and/or divulging of enterprise information. Several types of security measures exist to combat the problem of unauthorized activities occurring within an enterprise network. Often, these security measures use comparative historical data (e.g., the normal or expected behavior of an application) in order to detect any intrusion to the network, or to detect whether any unauthorized behavior is occurring. Alternatively, related-art security measures may use list(s) of static information (e.g., types of signatures, permissions, or the like) that, if present in an application or process, prohibit that application from executing or from continuing to operate.
More particularly, present systems and methods exist for using a statistical analysis of the differences between the normal behavior of, and the current behavior of, a program in order to detect unauthorized activity. Similarly, a behavioral analysis for each of a plurality of processes associated with a processing system can be performed, whereby a protect phase is started for the process when a deviation from normal behavior is detected. Likewise, systems and methods exist which involve receiving a behavior profile associated with an application from a developer, or the like, and determining, if a current operation of the application is not in conformity with the profile, to issue a message to that effect.
Also in existence are systems and methods of protecting a system from attack by monitoring processes, identifying behavior and attributes of the processes, grouping the processes into sets based on commonalities of attributes, and generating behavior control descriptions for each process set.
Referring to
Additionally, there exist methods which detect, by using heuristics, unknown malicious code on a host computer system whereby a virus signature is created on local computer and a blacklist is updated with the virus signature of the malicious code. Further detection and remediation of the malicious code can then be achieved without requiring subsequent execution of the malicious code.
Referring to
Thereafter, at step 240, a check is performed to determine if a blacklist includes the malicious code identifier for the malicious code detected in step 220. If the blacklist includes the correct identifier, control flow returns to step 220. If blacklist does not include a malicious code identifier for the malicious code detected, step 250 is entered whereby a malicious code identifier is created. With the created malicious code identifier, the blacklist is updated at step 260, and a notification is provided at step 270. The process terminated.
Disadvantages of the foregoing related-art techniques include that they are not scalable in view of the multitude of new applications becoming available to consumers of mobile technology. That is, since the above systems and methods are based on an application “profile” or on a static list of items associated with an unwanted attribute of an application or process which needs to be updated regularly, they are impractical. Moreover, such profiles are based on behavior that is derived offline, which requires a controlled environment.
An additional disadvantage of related-art techniques is that present blacklists are merely derived from a list of known malicious applications. This is problematic since a blacklist may also need to include a non-malicious application. For example, a network administrator may desire to blacklist an application that is simply undesirable, or that performs an action that is not malicious. In such a case, the techniques of the related art which operate by using signatures of malicious applications will not work. Additionally, the related art fails to address the situation in which an unwanted or prohibited behavior is performed by more than one single application. That is, an undesirable or unwanted behavior may occur as a result of multiple applications, processes, devices, and/or users working together. Moreover, the related-art techniques may only flag or penalize an application which performs the final step of a particular unwanted or prohibited behavior. At present there is no technique for flagging or penalizing other applications, processes, devices and/or users that use or work in concert with the application that performs the unwanted action.
Therefore, a need exists for a system and method which monitors a communications network for prohibited behavior, identifies users, applications and processes involved in prohibited behavior and applies corrective action to one or more of the users, applications and processes to prevent future prohibited behavior.
The above information is presented as background information only to assist with an understanding of the present disclosure. No determination has been made, and no assertion is made, as to whether any of the above might be applicable as prior art with regard to the present invention.
Aspects of the present invention are to address at least the above-mentioned problems and/or disadvantages and to provide at least the advantages described below. Accordingly, an aspect of the present invention is to provide a system and method which monitors a communications network for prohibited behavior, identifies users, applications and processes involved in prohibited behavior and applies corrective action to one or more of the users, applications and processes to prevent future prohibited behavior.
In accordance with an aspect of the present invention, a method for detecting behavior in a network device is provided. The method includes generating a list of one or more prohibited behaviors, generating a list of one or more corrective actions, mapping each of the one or more prohibited behaviors to at least one of the one or more corrective actions, identifying one or more of a user, a process or an application involved in a prohibited behavior, and applying, to the one or more of the user, the process or the application involved in the prohibited behavior, the at least one of the one or more corrective actions mapped to the prohibited behavior performed.
In accordance with an aspect of the present invention, a network system comprising a plurality of interconnected devices capable of detecting behavior in a network device is provided. The system includes at least one network device configured to accept a list of one or more prohibited behaviors, to accept a list of one or more corrective actions, to map each of the one or more prohibited actions to at least one of the one or more corrective actions, to identify one or more of a user, a process or an application involved in a prohibited behavior, and to apply, to the one or more of the user, the process or the application involved in the prohibited behavior, the at least one of the one or more corrective actions mapped to the prohibited behavior performed.
Other aspects, advantages, and salient features of the invention will become apparent to those skilled in the art from the following detailed description, which, taken in conjunction with the annexed drawings, discloses exemplary embodiments of the invention.
The above and other aspects, features, and advantages of certain exemplary embodiments of the present invention will be more apparent from the following description taken in conjunction with the accompanying drawings, in which:
Throughout the drawings, it should be noted that like reference numbers are used to depict the same or similar elements, features, and structures.
The following description with reference to the accompanying drawings is provided to assist in a comprehensive understanding of exemplary embodiments of the invention as defined by the claims and their equivalents. It includes various specific details to assist in that understanding but these are to be regarded as merely exemplary. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the invention. In addition, descriptions of well-known functions and constructions may be omitted for clarity and conciseness.
The terms and words used in the following description and claims are not limited to the bibliographical meanings, but, are merely used by the inventor to enable a clear and consistent understanding of the invention. Accordingly, it should be apparent to those skilled in the art that the following description of exemplary embodiments of the present invention is provided for illustration purpose only and not for the purpose of limiting the invention as defined by the appended claims and their equivalents.
It is to be understood that the singular forms “a,” “an,” and “the” include plural referents unless the context clearly dictates otherwise. Thus, for example, reference to “a component surface” includes reference to one or more of such surfaces.
By the term “substantially” it is meant that the recited characteristic, parameter, or value need not be achieved exactly, but that deviations or variations, including for example, tolerances, measurement error, measurement accuracy limitations and other factors known to those of skill in the art, may occur in amounts that do not preclude the effect the characteristic was intended to provide.
Exemplary embodiments of the present invention include a system and method for generating a list of prohibited behaviors and a list of corrective actions mapped to the prohibited behaviors that, in connection with monitoring conditions, aid in the detection and avoidance of unwanted behavior of users, processes and applications in a computer or communications network, or in a device thereof. The list of prohibited behaviors may be generated, for example, by a network administrator or a device end user. A prohibited behavior may be one or more actions performed by any user or module of the network system, such as a process or an application. A prohibited behavior may also be one or more actions performed by more than one, or any combination of, a system module, a process, an application or a user. A corrective action may be, for example, one or more actions to be performed when the prohibited behavior occurs. Corrective actions are not limited herein, and may include one or more of, or any combination of, blacklisting the application, blocking the behavior or application, logging the behavior or application, and the like. A monitoring condition can be any criteria devised for monitoring the network to determine if a prohibited behavior or application occurs. Monitoring conditions are not limited herein, and may include monitoring based on time, based on location, based on user, or the like, including any combination thereof. Monitoring conditions may likewise be generated by, for example, a network administrator.
In exemplary embodiments of the present invention, once the monitoring conditions are satisfied, the network begins monitoring for the particular prohibited behavior(s). If a prohibited behavior is detected, the corrective action mapped to the prohibited behavior is performed. In exemplary embodiments, the corrective action may be performed by any one of, or by any combination of, network modules, processes, applications and/or users involved in the prohibited behavior. Exemplary corrective actions may be determined, in whole or in part, based on whether the module, process, application or user is the cause or trigger of the prohibited behavior, or whether such module, process, application or user is an intermediary component of, or is involved in the final performance of, the prohibited behavior. The network may further maintain a list of steps which lead to a prohibited behavior, and may accordingly detect the involvement of other applications. That is, exemplary embodiments of the present invention include dynamic, real-time behavior based monitoring.
Referring to
At step 320, a network administrator, a user of a desktop workstation, a user of a network mobile device, or the like, generates a list of corrective actions. A corrective action may include “blacklisting” an application, blocking the behavior of an application, logging the behavior of an application, or the like, including any combination thereof. The term “blacklisting” herein is not limited, and may alternatively be used to describe any number of corrective actions, such as disabling an application or process, uninstalling an application, informing a user or network server of a prohibited behavior of a network device (e.g., a mobile device), revoking specific permissions or signatures, or blocking specific functions of a user or application, logging actions which were performed or attempted to be performed by a user, process or application (e.g., timestamp, application name, application IDentifier (ID), information about the application in an application manifest, etc.), and the like.
At step 330, a network administrator, a user of a desktop workstation, a user of a network mobile device, or the like, maps the items on the list of prohibited behavior to the items on the list of corrective actions. In exemplary embodiments, a given prohibited action may be mapped to one or more corrective actions and vice-versa. Likewise, a prohibited behavior may be mapped to a same or different corrective action(s) than that mapped to any other prohibited behavior and vice-versa. Many corrective actions may be performed when a single prohibited behavior occurs. Additionally, more than one, or a combination of prohibited behaviors may be mapped to trigger one or more corrective actions.
At step 340, a network administrator, a user of a desktop workstation, a user of a network mobile device, or the like, configures a set of monitoring conditions. A monitoring condition can be any criteria devised for how to monitor the network to determine if a prohibited behavior or application occurs. In exemplary embodiments, monitoring conditions are not limited, and may include monitoring based on time, based on location, based on user, or the like, including any combination thereof. Specific examples of monitoring conditions may be, for example, monitoring all mobile devices and desktop workstations from 8 am to 7 pm daily, or monitoring a subset of mobile devices only when those mobile devices are in London, England.
At step 350, the network determines if a monitoring condition has been satisfied. For example, if a monitoring condition is set to monitor the network during certain hours of the day, then that monitoring condition is satisfied when that designated time of day occurs. If the monitoring condition has not been satisfied, monitoring of step 350 continues. In contrast, if the monitoring condition has been satisfied, the process proceeds to step 360 in order to determine whether a prohibited behavior is occurring.
At step 360, the network monitors all users, devices, modules and combinations thereof in the network in order to determine if a prohibited behavior, or designated combination thereof, is occurring. If it is determined that a prohibited behavior is not occurring, the network returns to step 350 to continue monitoring. In contrast, if a prohibited behavior is detected, the network proceeds to step 370 in order to perform the corrective action(s) mapped to the detected prohibited behavior(s).
Referring to
The mobile device 400 may include a first application (App 1) 410 and a second application (App 2) 412. App 1 may be, for example, a text messaging application. In operation, App 1410 may be determined by the system behavior monitoring module 408, during a monitoring session, to be engaging in a prohibited behavior. For example, App 1 may be sending SMS content without being directed to do so by the user. In this case, the system behavior monitoring module 408 detects the unauthorized SMS message 414 and accesses a list of the corrective actions 404 in order to determine which corrective action is mapped to the prohibited behavior of sending the unauthorized SMS message 414. The system behavior monitoring module 408 determines that the removal of SMS permission 416 is the relevant mapped corrective action and causes removal of SMS permission 416 from the instant messaging application.
In operation, App 2412 may also be in operation on the mobile device 400. App 2412 may be, for example, an application that includes a detailed list of business contacts, each contact including personal information or information that may be otherwise desired to be kept confidential. The user may, for example, attempt to upload the personal contact list to an unauthorized server 490 that user licenses for personal use. In this case, the system behavior monitoring module 408 detects a prohibited behavior 418 and accesses the list of the corrective actions 404 in order to determine which corrective action is mapped to the prohibited behavior of uploading personal data to an unauthorized server 420. The system behavior monitoring module 408 determines that the disabling of the responsible application 482 is the relevant mapped corrective action and causes the disabling of App 2412.
Referring to
In
Referring to
Referring to
Referring to
Referring to
The server 610 may be a conventional Local Area Network (LAN) server, e.g., having one or more processors, Random Access Memory (RAM), and storage means, such as an array of hard disks. The processing capacity and memory of the server are configured to run several applications concurrently. The router 620 may be a conventional router that connects the communications network 600 to the internet. The switch 630 may be a conventional switch and serve as a controller to enable the networked devices to communicate efficiently, share and allocate resources. The data center 640 may be of any suitable configuration that, for example, houses necessary computer systems and associated components, such as telecommunications and storage systems, and may include redundant or backup power supplies, redundant storage devices, redundant data communications connections, network security devices, and the like. The modem 650 may be a conventional modem that, for example, modulates and demodulates an analog carrier signal to encode digital information. The personal computers 660 and the mobile devices 670 may each be, e.g., any type of handheld, tablet, desktop, or other communications or computing device, many of which are widely available and well known in the art.
The network of the present invention is not limited to the exemplary embodiments described herein and may include, for example, any architecture and related computational infrastructure such that a user or network administrator is able to input, at any of various network nodes (e.g., a server, a workstation or a mobile device), each or any of a list of prohibited behaviors, a list of corrective actions, a map linking prohibited behaviors to corrective actions, and/or monitoring conditions as are all described herein. Therefore, for example, if a monitoring condition is set which relies on the position of a controlled device in the network, the network architecture and related computational infrastructure must be able accommodate the monitoring condition. Thus, it must be assumed that certain hardware and software are included in exemplary embodiments of the present invention, e.g., hardware and software such that a desired list of prohibited behaviors can be mapped to a desired list of corrective actions and that the network can monitor for the prohibited action(s) and perform any necessary corrective action. A variety of architectures may be suitable and are known in the art. For example, each of U.S. Patent Application Publication No. 2004/0143740 and No. 2005/0086500, and U.S. Pat. No. 8,225,405 describe related system architecture, elements of which may variously and optionally be included herein.
In exemplary embodiments, the number of network components and devices is not limited. For example, the network may include a plurality of components and devices in addition to those shown in
Types of networks considered suitable in the present invention are not limited to the exemplary embodiments described herein, and may include any of a LAN, a Metropolitan Area Network (MAN), a Wide Area Network (WAN), a Global Area Network (GAN), a Personal Area Network (PAN), workgroup networks, client-server networks, an Intranet, an Extranet and the like. A LAN may be a small computer network usually set up within a single building. A MAN may be a network that covers a metropolitan or a municipality area. A WAN may be a network which covers a large geographical area, such as a country or a continent. A PAN may be a network for a single person. A GAN may be a network with global coverage. Workgroup networks may include a set of desktop computers that can interconnect with each other without a specific weight on a particular computer or piece of hardware. Any of the aforementioned networks may also use a combination of different technologies, such as satellite communications, Bluetooth, Wi-Fi, Wireless Broadband (Wi-Bro), and the like.
Referring to
According to exemplary embodiments of the present invention, the mobile device 700 may be configured to transfer data to and/or communicate with at least one device (e.g., a mobile device) over the network of
The storage unit 720 can store user data, and the like, as well as a program which performs operating functions according to an exemplary embodiment of the present invention. For example, the storage unit 720 may store a program for controlling general operation of the mobile device 700, an Operating System (OS) which boots the mobile device 700, and an application program for performing other optional functions such as a camera function, a sound replay function, an image or video replay function, a Bluetooth or Near Field Communication (NFC) function, and the like.
Further, the storage unit 720 may store user data generated according to a user of the mobile device, such as, for example, a text message, a game file, a music file, a movie file, and the like. In particular, the storage unit 720 according to exemplary embodiments of the present invention may store a table which stores a mapping of data that may be transferred with devices to which the data may be transferred. For example, the storage unit 720 may store a list of prohibited behaviors, a list of corrective actions that is mapped to the prohibited behaviors and/or a list of monitoring conditions accessible to the controller 710, the system behavior monitoring module 770, and the like.
The Bluetooth unit 750 may be configured for communicating with another device via Bluetooth. According to exemplary embodiments of the present invention, the Bluetooth unit 750 may be configured to automatically pair with another device. For example, the Bluetooth unit 750 may pair the mobile device 700 with another Bluetooth enabled device when the mobile device 700 is brought into close proximity with the other Bluetooth-enabled device. The Bluetooth unit 750 communicates connection data with the other NFC-enabled device during the pairing process. The Bluetooth pairing may be used separate from or in connection with the network of
The communication unit 760 is configured for communicating with other devices and network components. For example, the communication unit 760 may be configured to communicate via the network of
The input unit 740 may include input keys and function keys for receiving user input. For example, the input unit 740 may include input keys and function keys for receiving an input of numbers or various sets of letter information, setting various functions, and controlling functions of the mobile device 700. For example, the input unit 740 may include a calling key for requesting a voice call, a video call request key for requesting a video call, a termination key for requesting termination of a voice call or a video call, a volume key for adjusting output volume of an audio signal, a direction key, and the like. In particular, the input unit 740 according to exemplary embodiments of the present invention may transmit to the controller 710 signals related to selection of data to transfer and/or selection of devices to which the data may be transferred. Such an input unit 740 may be formed by one or a combination of input means such as a touch pad, a touch screen, a button-type key pad, a joystick, a wheel key, and the like.
The display unit 730 displays information inputted by the user or information to be provided to the user as well as various menus of the mobile device 700. For example, the display unit 730 may provide various screens according to the user of the mobile device 700, such as an idle screen, a message writing screen, a calling screen, and the like. In particular, the display unit 730 according to exemplary embodiments of the present invention can display a menu. The menu may include a list of functions relating to the transfer of data across devices. For example, the menu may include a list including a function corresponding to copying data to a device, pasting data from a device, cutting data and pasting such data to a device, and the like. The menu may be displayed to enable a user to select data to be transferred and/or to select a device to which the data may be transferred. For example, the display unit 730 may display an interface which the user may manipulate or otherwise enter inputs via a touch screen to enter selection of the data that may be transferred or selection of devices to which the data may be transferred. The display unit 730 can be formed as a Liquid Crystal Display (LCD), an Organic Light Emitting Diode (OLED), an Active Matrix Organic Light Emitting Diode (AMOLED), and the like. However, the present invention is not limited to these examples. Further, the display unit 730 can perform the function of the input unit 740 if the display unit 730 is formed as a touch screen.
According to exemplary embodiments of the present invention, the mobile device comprises at least one controller. The controller 710 may be configured to operatively control the mobile device 700. For example, the controller 710 may control operation of the various components or units included in the mobile device 700. The controller 710 may transmit a signal to the various components included in the mobile device 700 and control a signal flow between internal blocks of the mobile device 700. In particular, the controller 710 according to exemplary embodiments of the present invention can control selection of data to that may be transferred, selection of at least one device to which the data may be transferred, receipt of an indication of transfer from the device to which the data may be transferred, receipt of confirmation of transfer of the data to the other device, association of data that may be transferred with a device to which the data may be transferred, copy of data to a clipboard for aggregating data that may be transferred, deletion of the data associated with a cutting function after the mobile device 700 has confirmed that the pasting of the data to another mobile device is complete or abandoned (e.g., either explicitly by a user of the mobile device 700 or the other mobile device, or via a timeout), and registration of data to be copied to a clipboard with an identifier associated with a corresponding device to which the data may be transferred. According to exemplary embodiments of the present invention, the controller 710 may be configured to control the transfer of some data such as, for example, metadata, to the recipient mobile device before the recipient mobile device confirms the transfer of the data. Data that may be transferred before the recipient mobile device confirms the transfer of data may include, for example, a file name, a first few words of text, file or data size, the originating device name, and the like. A user of the recipient mobile device may view and select which data to proceed with transferring based at least in part on the data transferred before confirmation of the transfer of data. For example, the data transferred before confirmation of the transfer of data may be used to enable a user to make a more informed decision as to which data to paste to the recipient device.
According to exemplary embodiments of the present invention, the mobile device may optionally comprise a system behavior monitoring module 770. The system behavior monitoring module 770 may be configured to operate in conjunction with the at least one of the controller 710 and the storage unit 720 in accordance with configurations and methods known in the art, as are otherwise described herein, and which are incorporated herein by reference
While the invention has been shown and described with reference to certain exemplary embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims and their equivalents.
