Patent Application
20080137542
The present invention relates to a method for detecting abnormal network packets, and more particularly to a method applied to a packet distributing unit in a network for recording destination IP addresses, destination port numbers and network packet output time of network packets specifically outputted within a first time period and a second time period into a first data and a second data, and comparing the data obtained within the two different time periods to determine whether or not the data has the same output time, destination IP address and destination port number; if yes, then issuing a warning report.
As the electronic industry blooms and electronic products become indispensable to our life, various electronic products derived from the network technologies provide many breakthroughs to the development of science and technologies. With constant researches and advancements of the network products, the issue and consideration related to the network safety become increasingly important, particularly when the servers of many major corporations and organization are invaded or damaged by computer viruses, worms or Spyware (such as the Troy virus), or their confidential information and data are stolen via the Internet, and thus competitions among the major antivirus companies become very severe in the network safety market.
At present, major antivirus companies introduce different detection programs for the virus codes of different Spyware created by hackers, and these detection programs can scan Spyware, warn users about viruses, and delete viruses. In general, network management personnel will report to an antivirus company about any virus of Spyware occurred in their servers, and detection software with an appropriate solution will be developed. However, it is necessary to wait till the antivirus company to discover the brand new Spyware and develop antivirus codes for such Spyware before individual or corporate users can protect their data from being stolen, and irrecoverable damages may occur long before any protection measure can be taken place. Therefore, finding a method of detecting abnormal network packets, such that servers of corporations and organizations no longer have to wait passively for the break out of a brand new Spyware or virus, the discovery of such new Spyware or virus and appropriate actions for the Spyware or virus demands immediate attentions and feasible solutions.
In view of the foregoing shortcomings of the prior art, the inventor of the present invention based on years of experience and professional knowledge in the related field to conduct experiments and modifications, and finally invented a method for detecting abnormal network packets in accordance with the present invention, so as to block Spyware and prevent damages caused by Spyware.
Therefore, it is a primary objective of the present invention to provide a method for detecting abnormal network packets which is applied to a packet distributing unit in a network. The packet distributing unit exchanges a plurality of network packets with a plurality of network devices on an extranet and records destination IP addresses, destination port numbers and network packet output time of the network packets specifically outputted within a first time period and a second time period, into a first data and a second data every time before the packet distributing unit sends these specific output network packets out, and then the packet distributing unit compares these specific output network packets in different time periods to determine whether or not the data have the same output time, destination IP address and destination port number; if yes, then the packet distributing unit issues a warning report.
To make it easier for our examiner to understand the objective, technical characteristics and effects of the present invention, preferred embodiments will be described with accompanying drawings as follows:
Referring to
Referring to
Referring to
Step (201): If an event of an output network packet is occurred in a first time period, then the packet distributing unit 1 will record a TCP sequence number, a source IP address, a source port number, a destination IP address, a destination port number and an output time of the specific output network packet into the output packet data module 12 as a first data.
Step (202): If an event of an output network packet is occurred in a second time period, then the packet distributing unit 1 will record a TCP sequence number, a source IP address, a source port number, a destination IP address, a destination port number and an output time of the specific output network packet into the output packet data module 12 as a second data.
Step (203): An AND operation of the Boolean logic is used for comparing the destination IP addresses, destination port numbers and output time of the output network packets outputted within the first time period and the second time period to determine whether or not these network packets have the same destination IP address, destination port number and output time; if yes, then go to Step (204), or else end this procedure.
Step (204): Each network packet having the same destination IP address, destination port number and output time is defined as an abnormal network packet and recorded into an abnormal warning module 13.
Step (205): The abnormal warning module 13 shows a screen and displays the screen on a display device 30.
Due to coincidence or other reasons, it is very often to output network packets to the same network device 300 at the same time within two time periods. To avoid such coincidence or improve accuracy, the method of the present invention can use the data of output network packets recorded in three or more time periods for comparisons, and the comparison adopts an AND operation of the data recorded in different time periods.
Referring to
Step (301): The TCP sequence number, source IP address, source port number, destination IP address, destination port number and output time of a packet of the network packets recorded in the first and second time periods are compared, and the result (including the destination IP address, destination port number and output time) of the network packets computed by an AND operation is recorded into a temporary table 14 of the memory 10.
Step (302): If an event of an output network packet is occurred in a third time period, then the packet distributing unit 1 will output the destination IP address, destination port number and output time of the network packets into the output packet data module 12.
Step (303): The data of the temporary table 14 are compared with the destination IP address, destination port number and output time of the network packets recorded in the third time period to determine whether or not the network packets have the same destination IP address, destination port number and output time; if yes, then go to Step (304), or else end this procedure.
Step (304): The network packets having the same destination IP address, destination port number and output time are defined as abnormal network packets and recorded into the abnormal warning module 13.
Step (305): The abnormal warning module shows a screen and displays the screen on the display device 30.
In
Step (401): reading a TCP sequence number in a header for an external output network packet;
Step (402): reading a TCP sequence number in a header for another external output network packet;
Step (403): determining whether or not the TCP sequence numbers of the network packets are the same; if yes, then go to Step (404), or else go to Step (405);
Step (404): not recording the destination IP address, destination port number and output time of the network packets into the output packet data module 12.
Step (405): recording the destination IP address, destination port number and output time of the network packets into the output packet data module 12.
In
Step (601): obtaining a source IP address, a source port number, a destination IP address and a destination port number of a network packet;
Step (602): determining whether or not a destination IP address and a destination port number of the output network packet are in compliance with the data in the filter table 15; if yes, then go to Step (603), or else go to Step (604);
Step (603): not recording the destination IP address and the destination port number of the network packets into the output packet data module 12.
Step (604): recording the data of the network packets into the output packet data module 12.
Referring to
The present invention has been shown and described in detail, various modifications and improvements thereof will become readily apparent to those skilled in the art. Accordingly, the spirit and scope of the present invention is to be construed broadly and limited only by the appended claims and not by the foregoing specification.
