Persistent host determination

Abstract

A system comprises a security manager to scan a network for host instances representing hosts on the network at that time, and record characteristics of the host instances in a host record. The security manager subsequently scans the network for host instances in order to identify persistent hosts. A host profiling module takes snapshots of the network to generate host instances based on characteristics such as an IP address, a NetBIOS name, a DNS name, a MAC address. A host matching module correlates host instances from different snapshots using weighted rules (predetermined or customized) to discriminate between multiple potential matching host instances. Also, security logic makes security decisions based on data including persistent host information.

Description

CROSS-REFERENCES TO RELATED APPLICATIONS

This application is related to U.S. patent application Ser. No. 10/456,837, filed Jun. 6, 2003, which is a continuation-in-part of: U.S. patent application Ser. No. 09/757,963, filed Jan. 10, 2001, U.S. patent application Ser. No. 09/757,872, filed Jan. 10, 2001, and U.S. patent application Ser. No. 09/648,211, filed Aug. 25, 2000. The related applications are incorporated herein by reference.

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates generally to computer networks and, more specifically, to identifying a host through changes in the configuration of a dynamic network.

2. Description of the Related Art

Network security systems need an accurate snapshot of a network in order to provide optimal protection. Some devices on the network are configured to use static Internet Protocol (IP) addresses, allowing the network security system to easily track those devices. For example, a record or log of host characteristics, vulnerabilities, past attacks, and the like can be consistently associated with a device having a given address.

However, some networks and devices are configured to use dynamic IP addresses, which can cause the device to be disassociate from its record or log. Using techniques such as Dynamic Host Configuration Protocol (DHCP), a DHCP server can dynamically assign IP addresses on an as-needed basis from a pool. As a result, fewer IP addresses are needed. On the other hand, the network security system is unable to leverage off previously gathered information concerning a device that is not new to the network, but has merely been assigned a different IP address. Reassignment of IP addresses is not uncommon, occurring as a result of, for example, rebooting either the network security system or a device, physically unplugging a device from the network, manual configuration, and the like.

Problematically, the network security system performance is degraded in a dynamic network as it no longer has an accurate snapshot of the network. For example, if the device record contains a list of vulnerabilities present on the device, but the network security system is unable to retrieve this information because the address of the device has changed, the device may not be protected against those vulnerabilities. Nor is a network administrator able to make informed security decisions.

Additionally, self-identification of devices is unreliable and can further degrade performance. One way for a device to self-identify is through a service banner. However, hackers can easily compromise and edit service banners to misidentify the device. Furthermore, service banners often contain insufficient information concerning, for example, application version numbers and patch levels.

Therefore, what is needed is a robust network security system capable of persistently identifying a device through changes on a dynamic network. Furthermore, a network security system should be capable of providing the same level of security to a dynamic network as it does to a static network.

BRIEF SUMMARY OF THE INVENTION

The present invention meets these needs with systems, methods, and computer program products for persistent host recognition in a network application such as a security system. In one embodiment, the system comprises a security manager to scan a network for host instances representing hosts on the network at that time, and record characteristics of the host instances in a host record. In another embodiment, the security manager scans the network for host instances in order to identify persistent hosts based on the host records. Advantageously, this technique allows a security system to provide the same level of security to a dynamic network as to a static network.

In one embodiment, the security manager comprises a host profiling module. The host profiling module takes snapshots of the network to generate host instances based on characteristics such as IP addresses, NetBIOS names, DNS names, MAC addresses, and the like. Host instances can include persistent (or previously existing) hosts and/or new hosts. Another embodiment of the host profiling module determines additional characteristics such as an operating system running on the host including the version and/or patch level, and network service applications running on the host including version and/or patch levels. The host profiling module can profile hosts by interrogating the host with data packets and analyzing responses to the data packets for inferential information. Thus, the system is able to reliably gather information about a host for matching.

In another embodiment, the security manager comprises a host matching module. The host matching module correlates host instances from different snapshots. The host matching module can use weighted rules (predetermined or customized) to discriminate between multiple potential matching host instances. For example, a matching NetBIOS name might have significantly more influence than a matching IP address, especially when the two characteristics are inconsistent. When the network reconfigures hosts, for example through dynamically reassigning IP addresses, the security manager is able to correlate a host to its existing host record. The host record can contain, for example, a security policy, vulnerability information, unique host characteristics, and the like.

In yet another embodiment, the security manager comprises security logic. The security logic makes security decisions based on data including persistent host information. For example, a network administrator can view charts that summarize host security configurations of the network. In another example, an intrusion detection system can monitor network traffic based on vulnerability information. In still another example, the security logic can manage a host's ability to access the network, i.e., configure network switches to block or allow packet exchanges with outside networks.

The features and advantages described in this summary and the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the art in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram illustrating a network security system for persistent host determination according to one embodiment of the present invention.

FIG. 2 is a block diagram illustrating of a host determination module according to one embodiment of the present invention.

FIG. 3 is a flow chart illustrating a method for persistent host determination according to one embodiment of the present invention.

FIG. 4 is a flow chart illustrating a method for determining persistent hosts by correlating host instances according to one embodiment of the present invention.

FIG. 5 illustrates exemplary results from host matching in a summary view according to one embodiment of the present invention.

The figures depict embodiments of the present invention for purposes of illustration only. One skilled in the art will readily recognize from the following discussion that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles of the invention described herein.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

Systems, methods, and computer program products for persistent host recognition in a network application such as a security system are disclosed. Some embodiments of the system are set forth in FIGS. 1-2, and some embodiments of the method operating therein are set forth in FIGS. 3-5. The accompanying description is for the purpose of providing a thorough explanation with numerous specific details. Of course, the field of computer networking is such that many different variations of the illustrated and described features of the invention are possible. Those skilled in the art will thus undoubtedly appreciate that the invention can be practiced without some specific details described below, and indeed will see that many other variations and embodiments of the invention can be practiced while still satisfying its teachings and spirit. Accordingly, the present invention should not be understood as being limited to the specific implementations described below, but only by the claims that follow.

The processes, features, or functions of the present invention can be implemented by program instructions that execute in an appropriate computing device. The program instructions can be distributed on a computer readable medium, within a semiconductor device, or through a public network. Program instructions can be in any appropriate form, such as source code, object code, or scripts.

FIG. 1 is a block diagram illustrating a network security system 100 for persistent host determination according to one embodiment of the present invention. The system 100 comprises a security manager 110 and a DHCP server 120, both coupled to hosts 130a-b (collectively referred to hereafter as 130) through a network 195. Although the system is described herein as operating in a data network communicating through the IP protocol, one or ordinary skill in the art will recognize that the system 100 can also operate in networks using other protocols and/or technologies.

The security manager 110 provides network security functions to the hosts 130 such as vulnerability analysis, intrusion detection, and the like. The security manager 110 further comprises a host determination module 112 and a security logic module 114. Generally, the host determination module 112 uses host characteristics to match host instances from snapshots of the network with records of persistent hosts. The security logic 114 can access information from the host determination module 114 to make security decisions. For example, the security logic 114 can check network traffic for vulnerabilities of a particular persistent host, based on the persistent host's current network address. In another example, a network administrator can view charts that summarize host security configurations of the network. Of course the described ‘modules’ are only exemplary groupings of functionality. Consequently, alternate groupings of functionality within the scope of the present invention are contemplated, such as a security manager 110 distributed around the network 195, or having multiple instances executing on hosts 130.

FIG. 2 is a more detailed block diagram of the host determination module 112 according to one embodiment of the present invention. The host determination module 112 comprises an I/O module 210 to discover host instances on the network by, for example, polling network addresses and/or ports, receiving self-identification messages from hosts, and the like.

In one embodiment, the host determination module 112 comprises a host profiling module 220 to determine characteristics of the discovered hosts 130. The host profiling module 112 receives host characteristics such as IP address, NetBIOS names, DNS names, MAC addresses, and the like. Another embodiment of the host profiling module 112 interrogates the hosts 130 to determine different and/or additional characteristics such as operating systems running on the hosts including the versions and/or patch levels, and applications running on the hosts including versions and/or patch levels. The records manager 240 stores host records identifying the hosts and containing the host characteristics. A host record can also contain, for example, a security policy, vulnerability information, unique host characteristics, and the like.

In one embodiment, the host determination module 112 comprises a host matching module 230. The host matching module 230 correlates a host 130 currently being scanned to a record of a previously scanned host 130, if possible. The host matching module 230 can use weighted rules to discriminate between multiple potential matches. When the network experiences change, for example through dynamically assigned IP addresses, the system 100 is able to correlate a host 130 to its existing host record stored in the records manager 240. If the host 130 does not correlate with an existing host record, one embodiment of the host determination module 230 creates a new host record.

Referring again to FIG. 1, the hosts 130 communicate with each other and with other hosts on outside networks. A host 130 may be a computer, computer peripheral, telephone, or any other device able to connect to the network. The hosts 130 have characteristics such as a network address, open ports, and executing software such as an operating system and applications. The operating systems and applications can be an original release, or also comprise an updated version or patch. These updates can change the actions of the security logic 114 such as which vulnerabilities to associate with the host 130.

Still referring to FIG. 1, the DHCP server 120 dynamically assigns IP addresses to hosts 130 that connect to the network on an as-needed basis. Some hosts 130 can be connected to the network and have a LAN sub-network address, but do not need an IP address because these hosts 130 are not communicating outside of a private network. At the time that one of the hosts 130 desires outside communication, it can contact the DHCP server 120 for an IP address for this purpose. When outside communication has concluded, either deliberately by relinquishing the IP address, or through a fault such as a host crash, the IP address can be used by a different host 130. The DHCP server 120 may be a computer, server blade, or any other device able to manager network addresses. In other embodiments, the system 100 comprises another component that dynamically configures the network 195, such as an address pool manager, a resource pool manager, a hardware pool manager, and the like.

FIG. 3 is a flow chart illustrating a method 300 for persistent host determination according to one embodiment of the present invention. Host determination continues while the network 195 is configured as a dynamic network 310. The host profiling module 220 takes 320 a snapshot of the network 195 to generate host instances. In one embodiment, the profiling module 220 detects host characteristics such as IP addresses, NetBIOS names, DNS names, MAC addresses, running applications (which can include the versions and/or patch levels of the applications), and operating systems (which can also include the versions and/or patch levels) in the snapshots. The snapshots can be gathered automatically by exchanging data with the hosts 130 and/or from information manually provided by a network administrator or other entity.

In one embodiment, the profiling module 220 interrogates the hosts 130 to inferentially determine the operating systems and/or network service applications running on the hosts. This network-based profiling makes independent determinations rather than relying on the host 130 to self-identify through a banner or other often unreliable methods. The profiling module 220 can examine OSI (Open Systems Interconnection) layer 5, layer 6 and/or layer 7 aspects of the host 130 to determine running applications and other characteristics of the host 130. For example, telnet applications typically run on port 23. Responsive to port 23 being open, the profiling module 220 attempts to open a telnet session on the port and sends general or application-specific command line instructions to the telnet application. The profiling module 130 examines responses to the instructions that are unique to a type of telnet application. The profiling module 130 can further examine the telnet application for responses that are unique to a version and/or patch level of that particular application.

In one embodiment, the profiling module 220 examines layer 3 and/or layer 4 aspects of the host 130 for responses to anomalous data packets to determine an operating system and other characteristics of the host 130. Anomalous data packets are nonconforming relative to RFC (Request For Comment) protocols promulgated by the Internet Engineering Task Force. The host 130 typically responds to conforming data packets with conforming responses. By contrast, the host 130 may have unique responses to anomalous data packets since such responses are not standardized. The profiling module 130 examines responses to determine the operating system, and its version and/or patch level. The inferential process is described in further detail in commonly-owned U.S. patent application Ser. No. 10/456,837.

The host matching module 230 determines 330 persistent hosts by correlating host instances detected in the snapshot with host records. A flow chart in FIG. 4 illustrates an exemplary method 330 of determining persistent hosts according to one embodiment of the present invention. A new snapshot by the host profiling module 220 triggers 410 this process. For example, the host profiling module 220 can populate a new database row of host instances for the network 195. The host matching module 230 receives 420 host correlation settings that specify how to correlate host instances with host records. These settings can be specific to the network 195. Exemplary host correlation settings include an association threshold, a creation threshold, a set of weighted rules, and the like. Note that a host 130 can also be part of separate networks having different host correlation settings. As a result, the host 130 may be determined to be a persistent host in a first network, and determined to be a new host in a second network.

To determine which new host instances match previous host instances as indicated by the host records, the host matching module 230 calculates 430 a host correlation metric. In one embodiment, this calculation uses weighted rules so that reliable characteristics have a greater influence. A sum of the weighted rules can operate as a fuzzy match function to categorize a new host instance into a state such as a positively established host (or persistent host), a negatively established host (or new host), or an ambiguously established host.

More specifically, one embodiment of the host matching module 230 categorizes the sum of weighted rules based on thresholds. If the sum exceeds an association threshold 440, the new host instance is considered a persistent host 445 and can be associated with the record of its previous host instance. If the sum falls fellow a creation threshold 450, the new host instance is considered a new host 455 and a new host record is created in one embodiment. Otherwise, the new host instance is considered an ambiguous host 465. In one embodiment, ambiguous hosts can be retested, for example, based on a subsequent snapshot against subsequent host instances. Also, ambiguous hosts can be retested responsive to a change in rule weightings. The host matching module 230 can use generalized rule weights or customized rule weights.

FIG. 5 illustrates exemplary results from host matching in a summary view 500 according to one embodiment of the present invention. In FIG. 5, the host matching module 230 organizes a database of host instances 1-15 from network 10.0.0.0/24 in a tabular format that can be displayed through a user interface to the network administrator. Each row 515, 525, 535, 545 represents a separate snapshot (or audit), and each column 510, 520, 530, 540 represents a persistent host.

According to the examplary summary view 500, the persistent host having NetBIOS name HYDROGEN was located at sub-network address 10.0.0.1 for the first two snapshots 515, 525, but changed to sub-network address 10.0.0.2 before the third snapshot 535, and again changed to sub-network address 10.0.0.3 before the fourth snapshot 545. However, during each snapshot, the persistent host maintained its NetBIOS name. Similarly, persistent hosts HELIUM, LITHIUM, and BERYLLIUM also maintained consistent NetBIOS names. In this configuration, the network administrator can more heavily weight NetBIOS matching rules since they are a reliable aspect of the 10.0.0.0/24 network. In another embodiment, the NetBIOS name is not consistent. For example, HYDROGEN can be assigned its NetBIOS name just prior to the fourth snapshot 545, causing the host matching module 230 to rely on other characteristics such as applications identified on the host 130.

Referring again to FIG. 3, the host matching module 230 links 340 host records from the records manager 240 to persistent hosts detected in the snapshot. As a result, in the security application example, the security manager 110 can use the security logic 114 to make security decisions based on the current snapshot of persistent hosts. For example, a network administrator can view charts that summarize host security configurations of the network. In another example, an intrusion detection system can monitor network traffic based on vulnerability information. In still another example, the security logic can manage a host's ability to access the network, i.e., configure network switches to block or allow packet exchanges with outside networks.

Claims

1. A method for identifying persistent hosts in a dynamically configured network, comprising: establishing a plurality of records, each record stored on a storage medium and describing one or more characteristics of a persistent host on the network and one or more detected vulnerabilities of the persistent host, wherein the persistent host corresponds to a previously observed host instance on the network;receiving a snapshot of the network having at least one currently existing host instance for an unknown host on the network, the unknown host having a dynamically assigned IP address assigned on an as-needed basis from a Dynamic Host Configuration Protocol (DHCP) server;matching one or more characteristics of the currently existing host instance to the characteristics of a persistent host described in at least one of the records;identifying the unknown host associated with the currently existing host instance to be the persistent host described by the matching record;retrieving from the matching record one or more of the detected vulnerabilities of the persistent host corresponding to the currently existing host instances; andapplying one or more security decisions for the currently existing host instance based on the retrieved detected vulnerabilities of the persistent host corresponding to the currently existing host instance.

2. The method of claim 1, wherein the host instance describes at least one host characteristic from a group consisting of: an IP address, a NetBIOS name, a DNS name, and a MAC address.

3. The method of claim 1, wherein receiving a snapshot comprises: detecting an update to a database, the database describing the plurality of hosts on the network.

4. The method of claim 1, wherein the matching comprises: selecting from among a plurality of correlation rules responsive to the network.

5. The method of claim 1, wherein the matching comprises: calculating a host correlation metric representative of a probability that the host described by the host instance in the snapshot matches the persistent host described by the at least one record.

6. The method of claim 1, wherein the matching comprises: calculating a host correlation metric using weighted rules, each weighted rule specifying a potentially-matching attribute of the record and the host instance and a weight defining an influence of the rule.

7. The method of claim 1, further comprising: categorizing the host instance as a new host on the network.

8. The method of claim 7, further comprising: creating a host record describing the new host as a persistent host.

9. The method of claim 1, wherein the establishing comprises: establishing vulnerability information in the record, the vulnerability information describing vulnerabilities of the persistent host to network-based attacks.

10. The method of claim 1, wherein the one or more characteristics of a persistent host on the network include application information.

11. The method of claim 1, wherein the matching is performed using weighted rules, the weighted rules including rules that favor matching NetBIOS names over matching IP addresses.

12. The method of claim 1, wherein the receiving the snapshot comprises interrogating the unknown host to inferentially determine one or more of an operating system or application running on the unknown host.

13. The method of claim 12, wherein the interrogating is performed by: sending instructions or data packets at one or more layers of the open systems interconnection (OSI) model; andexamining responses sent by the unknown known responsive to the instructions or data packets.

14. The method of claim 12, wherein the interrogating comprises: sending anomalous data packets to the unknown host, the anomalous data packets being nonconforming relative to a request for comment (RFC) protocol; anddetermining an operating system running on the unknown host from the responses sent by the unknown host responsive to the anomalous data packets.

15. A system for identifying persistent hosts in a dynamically configured network, comprising: a computer processor; anda storage memory containing software modules thereon, the software modules comprising:a records manager module for storing a plurality of records each describing one or more characteristics of a persistent host on the network and one or more detected vulnerabilities of the persistent host, wherein the persistent host corresponds to a previously observed host instance on the network;a host profiling module for receiving a snapshot of the network having at least one currently existing host instance for an unknown host on the network, the unknown host having an IP address dynamically assigned from a Dynamic Host Configuration Protocol (DHCP) server;a host matching module for matching one or more characteristics of the currently existing host instance to the characteristics of a persistent host described in at least one of the records and for identifying the unknown host associated with the currently existing host instance to be the persistent host described by the matching record; anda security manager module for retrieving from the matching record one or more of the detected vulnerabilities of the persistent host corresponding to the currently existing host instance and applying the one or more security decisions for the currently existing host instance based on the retrieved detected vulnerabilities of the persistent host corresponding to the currently existing host instance.

16. The system of claim 15, wherein the host instance describes at least one host characteristic from a group consisting of: an IP address, a NetBIOS name, a DNS name, and a MAC address.

17. The system of claim 15, wherein the host profiling module is adapted to receive a snapshot responsive to an update to a database, the database describing the plurality of hosts on the network.

18. The system of claim 15, wherein the host matching module is adapted to select from among a plurality of correlation rules responsive to the network.

19. The system of claim 15, wherein the host matching module is adapted to calculate a host correlation metric representative of a probability that the host described by the host instance in the snapshot matches the persistent host described by the at least one record.

20. The system of claim 15, wherein the host matching module is adapted to calculate a host correlation metric using weighted rules, each weighted rule specifying a potentially-matching attribute of the record and the host instance and a weight defining an influence of the rule.

21. The system of claim 15, wherein the host matching module is adapted to categorize the host instance as a new host on the network.

22. The system of claim 21, wherein the records manager module is adapted to create a host record describing the new host as a persistent host.

23. The system of claim 15, wherein the records manager module is adapted to store vulnerability information in the record, the vulnerability information describing vulnerabilities of the persistent host to network-based attacks.

24. The system of claim 15, wherein the one or more characteristics of a persistent host on the network include application information.

25. A non-transitory computer program product comprising a computer-readable medium having embodied thereon computer program logic for identifying persistent hosts in a dynamically configured network, comprising: a records manager module for storing a plurality of records each describing one or more characteristics of a persistent host on the network and one or more detected vulnerabilities of the persistent host, wherein the persistent host corresponds to a previously observed host instance on the network;a host profiling module for receiving a snapshot of the network having at least one currently existing host instance for an unknown host on the network, the unknown host having a dynamically assigned IP address assigned on an as-needed basis from a Dynamic Host Configuration Protocol (DHCP) server;a host matching module for matching one or more characteristics of the currently existing host instance to the characteristics of a persistent host described in at least one of the records and for identifying the unknown host associated with the currently existing host instance to be the persistent host described by the matching record; anda security manager module for retrieving from the matching record one or more of the detected vulnerabilities of the persistent host corresponding to the currently existing host instance and applying the one or more security decisions for the currently existing host instance based on the retrieved detected vulnerabilities of the persistent host corresponding to the currently existing host instance.

26. The computer program product of claim 25, wherein the host instance describes at least one host characteristic from a group consisting of: an IP address, a NetBIOS name, a DNS name, and a MAC address.

27. The computer program product of claim 25, wherein the host profiling module is adapted to receive a snapshot responsive to an update to a database, the database describing the plurality of hosts on the network.

28. The computer program product of claim 25, wherein the host matching module is adapted to select from among a plurality of correlation rules responsive to the network.

29. The computer program product of claim 25, wherein the host matching module is adapted to calculate a host correlation metric representative of a probability that the host described by the host instance in the snapshot matches the persistent host described by the at least one record.

30. The computer program product of claim 25, wherein the host matching module is adapted to calculate a host correlation metric using weighted rules, each weighted rule specifying a potentially-matching attribute of the record and the host instance and a weight defining an influence of the rule.

31. The computer program product of claim 25, wherein the host matching module is adapted to categorize the host instance as a new host on the network.

32. The computer program product of claim 31, wherein the records manager module is adapted to create a host record describing the new host as a persistent host.

33. The computer program product of claim 25, wherein the records manager module is adapted to store vulnerability information in the record, the vulnerability information describing vulnerabilities of the persistent host to network-based attacks.

34. The computer program product of claim 25, wherein the one or more characteristics of a persistent host on the network include application information.