US20230362131A1 - Systems and methods for monitoring and securing networks using a shared buffer - Google Patents
Systems and methods for monitoring and securing networks using a shared buffer Download PDFInfo
- Publication number
- US20230362131A1 US20230362131A1 US18/351,626 US202318351626A US2023362131A1 US 20230362131 A1 US20230362131 A1 US 20230362131A1 US 202318351626 A US202318351626 A US 202318351626A US 2023362131 A1 US2023362131 A1 US 2023362131A1
- Authority
- US
- United States
- Prior art keywords
- data packet
- processing engine
- pointer
- shared buffer
- packet
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 106
- 239000000872 buffer Substances 0.000 title claims abstract description 71
- 238000012544 monitoring process Methods 0.000 title description 6
- 238000012545 processing Methods 0.000 claims abstract description 116
- 238000013500 data storage Methods 0.000 claims description 2
- 230000008569 process Effects 0.000 description 73
- 239000003795 chemical substances by application Substances 0.000 description 37
- 238000004458 analytical method Methods 0.000 description 31
- 230000009471 action Effects 0.000 description 18
- 238000007726 management method Methods 0.000 description 11
- 238000001514 detection method Methods 0.000 description 10
- 238000004891 communication Methods 0.000 description 9
- 230000015654 memory Effects 0.000 description 6
- 230000004913 activation Effects 0.000 description 4
- 238000010586 diagram Methods 0.000 description 4
- 230000000116 mitigating effect Effects 0.000 description 4
- 238000003860 storage Methods 0.000 description 4
- 230000010354 integration Effects 0.000 description 3
- 230000003287 optical effect Effects 0.000 description 3
- 238000009826 distribution Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000008520 organization Effects 0.000 description 2
- 230000002776 aggregation Effects 0.000 description 1
- 238000004220 aggregation Methods 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 238000007796 conventional method Methods 0.000 description 1
- 230000008030 elimination Effects 0.000 description 1
- 238000003379 elimination reaction Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000002708 enhancing effect Effects 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 238000004374 forensic analysis Methods 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 238000002347 injection Methods 0.000 description 1
- 239000007924 injection Substances 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
- H04L63/0245—Filtering by information in the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
- H04L45/42—Centralised routing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L45/00—Routing or path finding of packets in data switching networks
- H04L45/74—Address processing for routing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1425—Traffic logging, e.g. anomaly detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L49/00—Packet switching elements
- H04L49/90—Buffering arrangements
- H04L49/901—Buffering arrangements using storage descriptor, e.g. read or write pointers
Definitions
- the present disclosure relates to systems and methods of monitoring and securing a network and, more particularly, to systems and methods of using a shared buffer and pointers for analyzing network traffic.
- Embodiments of the present disclosure include systems and methods for monitoring and securing a network.
- a computer-implemented method for securing a network comprising one or more network nodes connecting a plurality of network connected devices of the network.
- the computer-implemented method may include: receiving a plurality of data packets at a network node of the network; temporarily storing the received data packets in a shared buffer of the network node; receiving a first request transmitted by a first processing engine to access a first temporarily stored data packet; establishing a connection with the first processing engine; generating a first pointer to the first temporarily stored data packet; enabling the first processing engine to use the generated first pointer to access the first temporarily stored data packet; receiving a second request transmitted by a second processing engine to access the first temporarily stored data packet; establishing a connection with the second processing engine; generating a second pointer to the first temporarily stored data packet, the second pointer being different from the first pointer while pointing to the same first temporarily stored data packet; and enabling the second processing engine to use the generated second pointer to access the first temporarily stored data packet.
- a network node of a network including one or more network nodes connecting a plurality of network connected devices of the network.
- the network node may include: a data storage device storing processor-readable instructions; and a processor configured to execute the instructions to perform a method.
- the method may include: receiving a plurality of data packets at a network node of the network; temporarily storing the received data packets in a shared buffer of the network node; receiving a first request transmitted by a first processing engine to access a first temporarily stored data packet; establishing a connection with the first processing engine; generating a first pointer to the first temporarily stored data packet; enabling the first processing engine to use the generated first pointer to access the first temporarily stored data packet; receiving a second request transmitted by a second processing engine to access the first temporarily stored data packet; establishing a connection with the second processing engine; generating a second pointer to the first temporarily stored data packet, the second pointer being different from the first pointer while pointing to the same first temporarily stored data packet; and enabling the second processing engine to use the generated second pointer to access the first temporarily stored data packet.
- a network node of a network including one or more network nodes connecting a plurality of network connected devices of the network.
- the network node may include non-transitory computer-readable medium containing instructions that, when executed by a processor, cause the processor to perform a method.
- the method may include: receiving a plurality of data packets at a network node of the network; temporarily storing the received data packets in a shared buffer of the network node; receiving a first request transmitted by a first processing engine to access a first temporarily stored data packet; establishing a connection with the first processing engine; generating a first pointer to the first temporarily stored data packet; enabling the first processing engine to use the generated first pointer to access the first temporarily stored data packet; receiving a second request transmitted by a second processing engine to access the first temporarily stored data packet; establishing a connection with the second processing engine; generating a second pointer to the first temporarily stored data packet, the second pointer being different from the first pointer while pointing to the same first temporarily stored data packet; and enabling the second processing engine to use the generated second pointer to access the first temporarily stored data packet.
- FIG. 1 depicts a schematic diagram illustrating an example of a computer network and environment within which the computer systems and methods disclosed herein are implemented according to some embodiments of the present disclosure.
- FIG. 2 depicts a schematic diagram illustrating an example of a computer network and environment within which the computer systems and methods disclosed herein are implemented according to some embodiments of the present disclosure.
- FIG. 3 depicts an exemplary network node according to embodiments of the present disclosure.
- FIG. 4 depicts an exemplary network node according to embodiments of the present disclosure.
- FIG. 5 depicts an exemplary method for securing a network comprising one or more network nodes connected a plurality of network connected devices of the network, according to exemplary embodiments of the present disclosure.
- the present disclosure is directed to systems and methods for software defined packet coordination.
- software defined packet coordination refers to any desired techniques for monitoring packets of a network, e.g., analyzing individual packets within network traffic to detect security threats, in accordance to the embodiments disclosed herein.
- the present disclosure is directed to the use of a circular buffer to temporarily store packets passing through the network to allow multiple parallel security processes to access and analyze the same packet, without copying, duplicating, or backing up copies of the packet.
- a packet temporarily stored in the circular buffer may be accessible via one or more pointers, and each security process may be assigned a separate pointer to access and analyze the same temporarily stored packet without the need to copy the packet for each security process.
- systems for software defined coordination may include the following components as will be described in further detail below: one or more shared buffers configured to store incoming network packets, software pipes created on top of the shared buffers that may allow the buffer to be accessed as shared memory across multiple processes, multiple pointers that may allow each process to access the buffers, and a controller (also referred to as a packet coordinator) configured to coordinate the aforementioned components.
- a controller also referred to as a packet coordinator
- the packet coordinator may be configured to coordinate the one or more buffers, the software pipes, and the multiple pointers such that multiple separate processes may access the same data packet without the need to copy the data packet for each process.
- the one or more shared buffers may be configured to store incoming data packets such that the packet coordinator may coordinate access to the stored data packets.
- the one or more shared buffers may be shared circular packet buffers.
- the packet coordinator may be configured to establish one or more software pipes such that a process may utilize a software pipe to access a pointer which may point to a packet in a shared buffer.
- a software pipe may be referred to as a temporary software connection, for example, a temporary connection between a process and a shared buffer.
- Each stored packet in the one or more shared buffers may become accessible via a shared pointer.
- shared pointers may refer to more than two pointers pointing to a same stored data packet.
- a first process may be assigned a first pointer, e.g., by the packet coordinator, that points to a stored data packet and a second process may be assigned a second pointer, e.g., by the packet coordinator, that also points to the same stored data packet.
- the first and second pointers each “share” the same stored data packet.
- both the first and second pointers may be referred to as first and second shared pointers, respectively.
- software defined packet coordination may allow multiple processes to access the same data packet and simultaneously analyze the same data packet, e.g., perform a security analysis of the same data packet, without contention.
- Some advantages provided by the embodiments disclosed herein may include: (1) elimination of the need to generate a copy of a data packet, thereby avoiding unnecessary memory usage and the enhancing performance; (2) coordination of access by multiple processes to the same packet to prevent concurrency; and (3) allowing of any process to take or initiate action over a stored packet and/or session without causing disruption and invalid pointers to other processes still analyzing the same packet and/or session.
- FIG. 1 shows a block diagram of a computer network and environment (hereinafter referred to as system 100 ) for implementing embodiments of the present disclosure, or aspects thereof.
- System 100 may include one or more network nodes 102 A- 102 D, one or more endpoints 104 A- 104 D, one or more agent nodes 106 A- 106 B, and one or more controllers 108 .
- one or more switches, firewall modules, routers, and/or router-switch processors may interconnect the aforementioned network nodes 102 A- 102 D, endpoints 104 A- 104 D, agent nodes 106 A- 106 B, and/or controllers 108 .
- the network nodes 102 A- 102 D, endpoints 104 A- 104 D, agent nodes 106 A- 106 B, and/or controllers 108 may be connected to the internet 110 through the one or more switches, firewall modules, routers, and/or router-switch processors. It is understood that the system 100 may include less than or more than the number of network nodes, endpoints, agent nodes, and/or controllers depicted in the FIG. 1 in other embodiments.
- the one or more network nodes 102 A- 102 D may form a distributed control plane.
- the controller 108 may be configured to manage the distributed control plane.
- the controller 108 may manage the distributed control plane by alerting, automating, and/or implementing workflow integrations for the network nodes 102 A- 102 D.
- the controller 108 may be referred to as a policy decision point for the system 100 .
- policies such as automation and/or workflow integrations for the one or more network nodes 102 A- 102 D may be determined by the controller 108 .
- any combination of the one or more network nodes 102 A- 102 D may comprise the controller 108 .
- the one or more network nodes 102 A- 102 D may be configured to provide visibility to a network associated with each respective network node 102 A- 102 D and enforce predetermined policies, e.g., automation and/or workflow integrations.
- network nodes 102 A- 102 D may provide connection reports, e.g., to the controller 108 , to provide such visibility.
- the controller 108 may update policies for the one or more network nodes 102 A- 102 D based on such reports.
- a network node 102 A may provide access to a perimeter network including DMZ services, such as, web servers, mail servers, FTP servers, VoIP servers, and the like.
- DMZ services may refer to a perimeter network that may be a physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted network such as the Internet.
- network node 102 A may provide visibility to the perimeter network and enforce predetermined polices for the perimeter network.
- a network node 102 B, 102 D may provide access to an internal network Local Area Network (LAN), such as a database workgroup, user workgroup, port, VLAN, application, network services, and the like.
- LAN Local Area Network
- network node 102 B, 102 D may provide visibility to the internal LAN and enforce predetermined policies for the internal network LAN.
- network node 102 B, 102 D may transmit information including processes, users, and/or files associated with each respective network.
- a network node 102 C may be associated with (e.g., provide access to) cloud networks such as an object storage service (e.g., S3 bucket).
- object storage service e.g., S3 bucket
- network node 102 C may provide visibility to the cloud network and enforce predetermined policies for the cloud network.
- a network node 102 D may communicate with one or more agent nodes 106 A- 106 B associated with one or more endpoints 104 C- 104 D.
- the one or more endpoints 104 C- 104 D may include one or more network connected devices according to some embodiments.
- a network connected device may refer to any physical device connected to a network whether local or remote, as well as any virtual devices and/or virtual services (e.g., micro-services) running on such devices included in the network or remote from the network.
- a network connected device may include any computing device, e.g., server, a mobile device, a desktop computer, a payment terminal with a computer chip, etc. or any other device or service in communication with the network.
- the network node 102 D may obtain information regarding the one or more endpoints 104 C- 104 D via the one or more agent nodes 106 A- 106 B, as will be described in further detail below.
- Agent nodes 106 A- 106 B may provide visibility regarding each associated endpoint 104 C- 104 D and may also enforce predetermined policies for the endpoints 104 C- 104 D.
- an agent node 106 A- 106 B may comprise a browser plugin, a process memory-dumper, plugin framework, etc.
- a browser plugin may be configured to detect malicious URLs inside encrypted connections.
- a process memory-dumper may be configured to inspect and capture in-memory and running processes. The process memory-dumper may be further configured to automate connection to a controller 108 for disassembly and forensic analysis.
- plugin framework may provide extensions for additional host-based detection, deception and mitigation capabilities via SQL query (e.g., OSQuery).
- Agent nodes 106 A- 106 B may be configured to query any software, e.g., installed on an endpoint 104 C- 104 D, without requiring the software to be running.
- agent nodes 106 A- 106 B may detect vulnerable software across an organization, e.g., system 100 , thereby providing useful information for asset inventory and compliance.
- the agent nodes 106 A- 106 B may query for and determine vulnerable versions of a web browser.
- agent nodes 106 A- 106 B may be configured to query any active processes and related connections.
- the agent nodes 106 A- 106 B may query for a specific open port.
- the agent nodes 106 A- 106 B may query for any open remote ports.
- the agent nodes 106 A- 106 B may be configured to query active users and associated processes and connections. For example, the agent nodes 106 A- 106 B may query user executed specific process and retrieve the process path. As another example, the agent nodes 106 A- 106 B may query file-less processes with remote connections. In some embodiments, the agent nodes 106 A- 106 B may perform queries on any connected devices.
- FIG. 2 shows a block diagram of a computer network and environment (hereinafter referred to as system 200 ) for implementing embodiments of the present disclosure, or aspects thereof.
- the system 200 may comprise a management plane 210 including a controller 208 , a first zone proxy 212 A, a second zone proxy 212 B, security information and event management system (SIEM) 214 , security operations workflow management system 215 , intelligence scoring system 216 , and openflow controller 218 .
- SIEM 214 may be configured to aggregate and/or view security logs and alerts.
- Security operations workflow management system 215 may be configured to coordinate threat mitigation based on certain triggers, e.g., such as certain detected threats, and invoke changes in the system 200 to mitigate the threat and/or reflect the coordinated threat mitigation.
- Intelligence scoring system 216 may be configured to aggregate information associated with identified and/or potential threats, e.g., information provided by external systems and/or information based on threats detected and mitigated by the system 200 , and determine scores for threats relevant to system 200 .
- an openflow controller 218 may be configured to use the OpenFlow protocol to connect and configured network devices, e.g., one or more switches, firewall modules, routers, and/or router-switch processors as depicted in FIG. 1 , to determine optimal paths for network traffic.
- System 200 may further comprise one or more data plane zones 220 A- 220 B. As shown in FIG. 2 , each data plane zone 220 A- 220 B may include a network node 202 A- 202 B, an endpoint 204 A- 204 B, an agent node 206 A- 206 B, and an agent controller 214 A- 214 B. An agent controller 214 A- 214 B may be configured to communicate with a zone proxy 212 A- 212 B and manage one or more associated agent node 206 A- 206 B, as will be described in further detail below.
- SDN software-defined network
- the controller 108 may manage each data plane zone 220 A- 220 B via a dedicated proxy 212 A- 212 B as shown in FIG. 2 . It is understood that there may be less than or more than two data plane zones in other embodiments.
- Cross domain communications e.g., communications between the management plane 210 and the data plane zones 220 A- 220 B, may be performed via the proxy 212 A- 212 B and each dedicated data plane zone 220 A- 220 B, e.g., network node 202 A- 202 B and/or agent controller 214 A- 214 B. Accordingly, zone-specific actions may be defined by the management plane 210 and dynamically managed throughout the system 200 .
- management plane 210 communications may include policy, intelligence, distribution, and/or monitoring and/or statistics.
- the controller 208 may transmit information including logging, events, and/or alerts to the SIEM 214 .
- the controller 208 may perform workflow orchestration based on the security operations workflow system 215 .
- the controller 208 may obtain threat scores from the intelligence scoring system 216 .
- the controller 208 may communicate with the openflow controller 218 to determine optimal paths for network traffic.
- management plane 210 communications may be encrypted.
- data plane communications may include communication between the agent controller 214 A- 214 B and the agent node 206 A- 206 B.
- An agent controller 214 A may be configured to manage one or more agent nodes 206 A within data plane zone 220 A.
- the agent controller 214 A may be configured to provide configuration management to agent node 206 A and transmit image distribution and log aggregation information from the agent node 206 to the management plane 210 via zone proxy 212 A.
- data plane zone 220 A may include two or more agent nodes each associated with a separate endpoint in other embodiments. In such embodiments, the agent controller 214 A may be configured to manage the two or more agent nodes in data plane zone 220 A.
- FIG. 3 depicts a network node 300 , according to some embodiments.
- the network node 300 may include a packet processing engine 310 and a processing analysis engine 320 , according to some embodiments. While only one processing analysis engine 320 is depicted in FIG. 3 , it is understood that the network node 300 may include two or more processing analysis engines in other embodiments.
- the packet processing engine 310 may be deployed inline to a network.
- the packet processing engine 310 may receive ingress data packets, e.g., IPv4 and/or IPv6 data packets.
- the packet processing engine 310 may include a traffic merge component 312 in which the received data packets may be temporarily stored.
- the packet processing engine 310 may forward each received data packet to the processing analysis engine 320 .
- the packet processing engine 310 may include a traffic replica component 314 configured to generate a replica of each temporarily stored data packet.
- the traffic replica component 314 may be configured to generate a pointer for each temporarily stored data packet.
- the traffic replica component 314 may share the generated pointers with the processing analysis engine 320 , thereby enabling the processing analysis engine 320 to use the generated pointers to access the stored data packets.
- Some embodiments of the traffic merge component 312 and the traffic replica component 314 e.g., shared buffer 402 and packet coordinator 404 , respectively, are depicted in and described below with reference to FIG. 4 .
- the packet processing engine 310 may further include a traffic basic filter component 315 configured to check if one or more attributes associated with the temporarily stored data packets match predetermined attributes.
- the predetermined attributes may include a source, destination IP, port, protocol, etc.
- the predetermined attributes may be associated with data packets, sessions, and/or data flow that may be malicious, e.g., C2 and/or exfiltration malware. If attributes associated with one or more data packets do not match predetermined attributes, the one or more data packets may be forwarded to the intended destination via a switching component 318 .
- an Packet Processing Unit (PPU) engine component 316 may be configured to perform a dynamic action on the one or more data packets, a session associated with the one or more data packets, and/or a data flow associated with the one or more data packets.
- the PPU engine component 316 may comprise a micro-program that includes an activation rule and micro-compiled code that is executed if the activation rule matches.
- the micro-compiled code may be executed to respond to, copy, drop, route, and/or modify the one or more data packets.
- the PPU engine component 316 may further include state and memory useful for subsequent re-execution of the micro-program.
- the micro-program may further include executing a program, one or more data packets, a session, and/or a data flow based on the one or more data packets.
- the micro-program may comprise of both states and instructions.
- the one or more data packets may be transparently routed to a deception server.
- a deception server may be referred to a server that acts like a legitimate server for the purpose of gathering information about a malicious actor and/or entity (also referred to collectively as “adversary”) including what the adversary is trying to exploit and where the adversary is trying to gather information from.
- the deception server may be utilized to detect SQL injection attempts.
- the one or more data packets may reflect un-allowed traffic to bad domains. In such embodiments, the one or more data packets may be detected and redirected without detection by an adversary. In some embodiments, the one or more data packets may reflect encrypted malware. In such embodiments, the threat may be mitigated by dropping the one or more data packets.
- the packet processing engine 310 may communicate such performed dynamic actions to the controller 308 and/or one or more network nodes 330 A- 330 C.
- the controller 308 and/or the one or more network nodes 330 A- 330 C may dynamically detect and mitigate similar data packets based on the communication.
- the processing analysis engine 320 may include a traffic replica receiver 322 configured to receive replicas of the temporarily stored data packets for a deep analysis of the data packets.
- the data packet replicas may be utilized by the detection module 324 , which may include an event detection module 328 and one or more event handler modules 326 A- 326 C.
- the detection module 328 may be configured for a deep analysis of sessions, file extractions, intelligence correlation, and many other similar higher-level data signals analysis performed across multiple packet contexts including network and endpoint information.
- the event detection module 328 may be configured to detect predetermined protocols and/or malware.
- intelligence correlation may refer to identifying attributes associated with detected IPs, domains, C2s, and behaviors and utilizing such identified attributes to detect similar associated threats in other environments.
- Each detected protocol and/or malware may be referred to as an event, and the event handler modules 326 A- 326 C may be configured to perform an analysis of an event.
- an event handler module 326 A may obtain information from an agent node 306 regarding an associated endpoint.
- the agent node 406 may provide visibility to a process, user information associated with executing the process, network and/or file state on the endpoint, and/or ownership of files such that the information gained by that visibility may be used by the event handler module 326 A for detection and coordination with the packet processing engine 310 .
- the event handler module 326 A may query for information, run scans for malware on demand, and/or collect process images.
- Each of the event handler modules 326 A- 326 C may be configured to detect predetermined protocols and/or obtain PPUs based on mitigation and detection macro-logic.
- the event handler modules 326 A- 326 C may obtain and/or generate micro-programs that include an activation rule and micro-compiled code that may be executed if the activation rule matches.
- the event handler modules 326 A- 326 C may deploy such micro-programs to the packet processing engine 310 (e.g., traffic basic filter component 315 , PPU engine component 316 , and/or switching component 318 ).
- the controller 308 may receive messages from the packet processing engine 310 , the agent node 306 , and the processing analysis engine 320 such that those messages may be processed, organized and redistributed to other connected components, such as other network nodes 330 A- 330 C, based on predetermined policies. For example, the controller 308 may perform a security analysis of the network including the network node 300 , log the analysis, and/or perform and protocol or malware analysis based on the received messages.
- the received messages may include endpoint process data obtained from the agent node 406 , network metadata, associated PPUs, etc.
- FIG. 4 depicts a network node 400 , according to some embodiments.
- the network node 400 may include a packet processing engine 410 and a processing analysis engine 420 , according to some embodiments. While only one deep engine 420 is depicted in FIG. 4 , it is understood that the network node 400 may include two or more processing analysis engines in other embodiments.
- the packet processing engine 410 may include one or more shared buffers 402 , a packet coordinator 404 , and a packet processing action engine 406 , according to some embodiments. As described above with reference to FIG. 3 , the packet processing engine 410 may be deployed inline to a network. The packet processing engine 410 may receive ingress data packet, e.g., IPv4 and/or Ipv6 data packets. In some embodiments, the received data packets may be temporarily stored in the one or more shared buffers 402 . In some embodiments, the one or more shared buffers 402 may include one or more circular packet buffers. The use of circular packet buffers maintains optimal performances while continuously receiving ingress data packets.
- ingress data packet e.g., IPv4 and/or Ipv6 data packets.
- the received data packets may be temporarily stored in the one or more shared buffers 402 .
- the one or more shared buffers 402 may include one or more circular packet buffers. The use of circular packet buffers maintains optimal performances
- the processing analysis engine 420 may include one or more processes 422 A- 422 N that may request access to packets temporarily stored in the shared buffers 402 to, for example, analyze the incoming packets. It should be understood that the one or more processes 422 A- 422 N may be located in one or more processing analysis engines in other embodiments. For example, processes 422 A and 422 B may be located in the processing analysis engine 420 , and a separate process may be located in a separate processing analysis engine. It should be further understood that the separate processing analysis engine may be located in the network node 400 or a separate network node.
- one or more processes of a separate processing analysis engine of the network node 400 and/or a separate network node may request access to packets temporarily stored, e.g., packets 412 A- 412 N, in the shared buffers 402 .
- the one or more processes 422 A- 422 N may include one or more event handler modules 326 A- 326 C, event detection modules 328 , and/or detection modules 324 , as described above with reference to FIG. 3 .
- the packet coordinator 404 may coordinate requests from multiple separate processes, e.g., processes 422 A- 422 N, to access the same temporarily stored packet without the need to copy the packet for each process.
- the packet coordinator 404 may generate a software pipe between each of the requesting processes 422 A- 422 N and the shared buffer 402 such that the shared buffer 402 may be accessed as shared memory across multiple processes 422 A- 422 N. That is, the packet coordinator 404 may establish temporary connections between each requesting process 422 A- 422 N and the shared buffer 402 such that the requesting processes 422 A- 422 N may access packets temporarily stored, e.g., packets 412 A- 412 N, in the shared buffer 402 .
- the requesting processes 422 A- 422 N may each access a same temporarily stored packet simultaneously or in any order.
- the requesting processes 422 A- 422 N may access temporarily stored packets in the shared buffer 402 via respective software pipes and one or more shared pointers.
- the requesting processes 422 A- 422 N may use each respective software pipe to access one or more shared pointers, each of which point to a packet temporarily stored in the shared buffer 402 , as will be described in further detail below.
- the packet coordinator 404 may generate a shared pointer pointing to a temporarily stored packet for each process, e.g., processes 422 A- 422 N, requesting access to the temporarily stored packet. For example, the packet coordinator 404 may generate a first shared pointer pointing a packet temporarily stored, e.g., packet 412 A, in the shared buffer 402 upon receiving a request from a first process, e.g., process 422 A, to access the temporarily stored packet 412 A.
- the first shared pointer may be assigned to process 422 A, and the assigned first shared pointer may be transmitted and/or otherwise shared with the process 422 A such that the process 422 A may use the first shared pointer to access the temporarily stored packet 412 A.
- the packet coordinator 404 may generate a second shared pointer pointing to the same temporarily stored packet 412 A in the shared buffer 402 upon receiving a request from a second process, e.g., process 422 B, to access the same temporarily stored packet 412 A.
- the second shared pointer may be assigned to process 422 B, and the assigned second shared pointer may be transmitted and/or otherwise shared with the process 422 B such that the process 422 B may use the second shared pointer to access the same temporarily stored packet 412 A.
- more than two shared pointers may be generated, where each shared pointer may be assigned to a separate process and points to the same packet. Similarly, it should also be understood that more than one shared pointer may be generated for a specific process.
- the specific process may transmit two or more requests to access two or more temporarily stored packets.
- the packet coordinator 404 may generate a shared pointer corresponding to each request, such that the specific process may use each respective shared pointer to access the corresponding packet temporarily stored in the shared buffer 402 .
- the one or more processes 422 A- 422 N may be enabled to access a same packet temporarily stored in the shared buffer 402 and perform analysis, e.g., security analysis, of the packet without contention.
- a process may determine that an action must be taken over the temporarily stored packet (hereinafter referred to as “identified packet”) based on the performed analysis.
- the identified packet may be determined to be part of a security threat to a network.
- the process may dynamically transmit a request to the packet coordinator 404 to take the appropriate action on the identified packet.
- the process may transmit a message to the packet coordinator 404 to drop the identified packet and/or a session associated with the identified packet such that there are no concurrent actions taken over the identified packet by other processes.
- such actions may be performed effectively and efficiently, especially in instances in which many processes (or multiple instances of the same process) request access to each temporarily stored packet.
- the action may be performed by the packet coordinator 404 and/or the packet processing action engine 406 .
- the packet processing engine 406 may comprise the PPU engine component 316 as described above with reference to FIG. 3 . Accordingly, packet processing action engine 406 may be configured to perform a dynamic action on the identified packet, a session associated with the identified data packet, and/or a data flow associated with the identified data packet. For example, the packet processing action engine 406 may respond to, copy, drop, route, and/or modify the identified data packet, as described in further detail above with reference to FIG. 3 . It should be understood that any combination of the packet coordinator 404 and the packet processing action engine 406 may be configured to perform the functions of the PPU engine component 316 in some embodiments.
- information regarding the performed action may be transmitted to a controller 408 , e.g., controllers 108 , 208 , 308 as described above with reference to FIGS. 1 - 3 , the processes 422 A- 422 N, and/or other network nodes.
- the controller 408 may monitor and/or analyze network traffic associated with the network node 400 based on such received information.
- one or more of the processes 422 A- 422 N, the packet coordinator 404 , and/or the packet processing action engine 406 may transmit information regarding a current status of each respective component and associated data packet 412 A- 412 N.
- the controller 408 may monitor and/or analyze network traffic associated with the network node 400 based on this information.
- the controller 408 may be configured to control (e.g., perform actions) network traffic associated with the network node 400 based on the information received from the aforementioned components. That is, the network traffic directed to, directed from, and/or currently stored in the network node 400 may be controlled from a single point, e.g., the controller 408 .
- FIG. 5 depicts an exemplary method 500 for securing a network comprising one or more network nodes connecting a plurality of network connected devices of the network according to some embodiments.
- the method 500 may begin with step 502 in which a plurality of data packets may be received at a network node of the network.
- the received data packets may be temporarily stored in a shared buffer of the network node.
- the shared buffer may be a shared circular buffer.
- a first request transmitted by a first processing engine to access a first temporarily stored data packet may be received.
- a connection may be established with the first processing engine.
- a first pointer to the first temporarily stored data packet may be generated.
- the first processing engine may be enabled to use the generated first pointer to access the first temporarily stored data packet.
- a second request transmitted by a second processing engine to access the first temporarily stored data packet may be received.
- a connection with the second processing engine may be established.
- a second pointer to the first temporarily stored data packet may be generated, where the second pointer is different from the first pointer while pointing to the same first temporarily stored data packet.
- the second processing engine may be enabled to use the generated second pointer to access the first temporarily stored data packet.
- process 500 may include a further step in which a message regarding the first temporarily stored data packet may be received from the first processing engine and/or the second processing engine.
- the first temporarily stored data packet may be processed based on the received message, wherein processing the first temporarily stored data packet may include dropping the first data packet from the buffer, routing from the buffer, and/or modifying the data packet.
- the first processing engine, the second processing engine, and/or a controller may be notified regarding the processed first temporarily stored data packet.
- process 500 may include a further step in which a third request transmitted by a third processing engine to access the first temporarily stored data packet.
- a connection with the third processing engine may be established.
- a third pointer to the first temporarily stored data packet may be generated. The third pointer may be different from the first and second pointer while pointing to the same first temporarily stored data packet.
- the third processing engine may be enabled to use the generated third pointer to access the first temporarily stored data packet.
- the network node may include the first processing engine. In some embodiments, the network node may include the shared buffer and a remote network node may include the second processing engine.
- Storage type media include any or all of the tangible memory of the computers, processors or the like, or associated modules thereof, such as various semiconductor memories, tape drives, disk drives and the like, which may provide non-transitory storage at any time for the software programming. All or portions of the software may at times be communicated through the Internet or various other telecommunication networks.
- Such communications may enable loading of the software from one computer or processor into another, for example, from a management server or host computer of the mobile communication network into the computer platform of a server and/or from a server to the mobile device.
- another type of media that may bear the software elements includes optical, electrical and electromagnetic waves, such as used across physical interfaces between local devices, through wired and optical landline networks and over various air-links.
- the physical elements that carry such waves, such as wired or wireless links, optical links, or the like, also may be considered as media bearing the software.
- terms such as computer or machine “readable medium” refer to any medium that participates in providing instructions to a processor for execution.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
- The present disclosure relates to systems and methods of monitoring and securing a network and, more particularly, to systems and methods of using a shared buffer and pointers for analyzing network traffic.
- Analysis of network traffic often involves multiple tools to observe the same data packet and/or session and using such tools to correlate context across multiple data sources. Conventional methods and systems for network traffic analysis achieve this by copying network traffic across multiple tools which considerably reduces performance. For example, a network packet may be copied across multiple buffers to allow different tools and/or processes to access the same network packet at the same time. Accordingly, such methods and systems for network traffic analysis are not effective or operable in higher scale network environments.
- Therefore, there is a need for systems and methods monitoring and securing a network that achieve higher performance and efficiency in network traffic analysis.
- Embodiments of the present disclosure include systems and methods for monitoring and securing a network.
- According to certain embodiments, a computer-implemented method for securing a network comprising one or more network nodes connecting a plurality of network connected devices of the network is disclosed. The computer-implemented method may include: receiving a plurality of data packets at a network node of the network; temporarily storing the received data packets in a shared buffer of the network node; receiving a first request transmitted by a first processing engine to access a first temporarily stored data packet; establishing a connection with the first processing engine; generating a first pointer to the first temporarily stored data packet; enabling the first processing engine to use the generated first pointer to access the first temporarily stored data packet; receiving a second request transmitted by a second processing engine to access the first temporarily stored data packet; establishing a connection with the second processing engine; generating a second pointer to the first temporarily stored data packet, the second pointer being different from the first pointer while pointing to the same first temporarily stored data packet; and enabling the second processing engine to use the generated second pointer to access the first temporarily stored data packet.
- In accordance with another embodiment, a network node of a network including one or more network nodes connecting a plurality of network connected devices of the network is disclosed. The network node may include: a data storage device storing processor-readable instructions; and a processor configured to execute the instructions to perform a method. The method may include: receiving a plurality of data packets at a network node of the network; temporarily storing the received data packets in a shared buffer of the network node; receiving a first request transmitted by a first processing engine to access a first temporarily stored data packet; establishing a connection with the first processing engine; generating a first pointer to the first temporarily stored data packet; enabling the first processing engine to use the generated first pointer to access the first temporarily stored data packet; receiving a second request transmitted by a second processing engine to access the first temporarily stored data packet; establishing a connection with the second processing engine; generating a second pointer to the first temporarily stored data packet, the second pointer being different from the first pointer while pointing to the same first temporarily stored data packet; and enabling the second processing engine to use the generated second pointer to access the first temporarily stored data packet.
- In accordance with another embodiment, a network node of a network including one or more network nodes connecting a plurality of network connected devices of the network is disclosed. The network node may include non-transitory computer-readable medium containing instructions that, when executed by a processor, cause the processor to perform a method. The method may include: receiving a plurality of data packets at a network node of the network; temporarily storing the received data packets in a shared buffer of the network node; receiving a first request transmitted by a first processing engine to access a first temporarily stored data packet; establishing a connection with the first processing engine; generating a first pointer to the first temporarily stored data packet; enabling the first processing engine to use the generated first pointer to access the first temporarily stored data packet; receiving a second request transmitted by a second processing engine to access the first temporarily stored data packet; establishing a connection with the second processing engine; generating a second pointer to the first temporarily stored data packet, the second pointer being different from the first pointer while pointing to the same first temporarily stored data packet; and enabling the second processing engine to use the generated second pointer to access the first temporarily stored data packet.
- The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate various exemplary embodiments and together with the description, serve to explain the principles of the disclosed embodiments.
-
FIG. 1 depicts a schematic diagram illustrating an example of a computer network and environment within which the computer systems and methods disclosed herein are implemented according to some embodiments of the present disclosure. -
FIG. 2 depicts a schematic diagram illustrating an example of a computer network and environment within which the computer systems and methods disclosed herein are implemented according to some embodiments of the present disclosure. -
FIG. 3 depicts an exemplary network node according to embodiments of the present disclosure. -
FIG. 4 depicts an exemplary network node according to embodiments of the present disclosure. -
FIG. 5 depicts an exemplary method for securing a network comprising one or more network nodes connected a plurality of network connected devices of the network, according to exemplary embodiments of the present disclosure. - Reference will now be made in detail to the exemplary embodiments of the disclosure, examples of which are illustrated in the accompanying drawings. Wherever possible, the same reference numbers will be used throughout the drawings to refer to the same or like parts.
- The present disclosure is directed to systems and methods for software defined packet coordination. In the context of the current disclosure, “software defined packet coordination” refers to any desired techniques for monitoring packets of a network, e.g., analyzing individual packets within network traffic to detect security threats, in accordance to the embodiments disclosed herein. In particular, the present disclosure is directed to the use of a circular buffer to temporarily store packets passing through the network to allow multiple parallel security processes to access and analyze the same packet, without copying, duplicating, or backing up copies of the packet. For example, a packet temporarily stored in the circular buffer may be accessible via one or more pointers, and each security process may be assigned a separate pointer to access and analyze the same temporarily stored packet without the need to copy the packet for each security process.
- In some embodiments, systems for software defined coordination may include the following components as will be described in further detail below: one or more shared buffers configured to store incoming network packets, software pipes created on top of the shared buffers that may allow the buffer to be accessed as shared memory across multiple processes, multiple pointers that may allow each process to access the buffers, and a controller (also referred to as a packet coordinator) configured to coordinate the aforementioned components.
- In some embodiments, the packet coordinator may be configured to coordinate the one or more buffers, the software pipes, and the multiple pointers such that multiple separate processes may access the same data packet without the need to copy the data packet for each process. In some embodiments, the one or more shared buffers may be configured to store incoming data packets such that the packet coordinator may coordinate access to the stored data packets. In some embodiments, the one or more shared buffers may be shared circular packet buffers. In some embodiments, the packet coordinator may be configured to establish one or more software pipes such that a process may utilize a software pipe to access a pointer which may point to a packet in a shared buffer. In the context of the current disclosure, a software pipe may be referred to as a temporary software connection, for example, a temporary connection between a process and a shared buffer. Each stored packet in the one or more shared buffers may become accessible via a shared pointer. In the context of the current disclosure, shared pointers may refer to more than two pointers pointing to a same stored data packet. For example, a first process may be assigned a first pointer, e.g., by the packet coordinator, that points to a stored data packet and a second process may be assigned a second pointer, e.g., by the packet coordinator, that also points to the same stored data packet. Accordingly, the first and second pointers each “share” the same stored data packet. Hence, both the first and second pointers may be referred to as first and second shared pointers, respectively.
- As will be described in further detail below, software defined packet coordination may allow multiple processes to access the same data packet and simultaneously analyze the same data packet, e.g., perform a security analysis of the same data packet, without contention.
- Some advantages provided by the embodiments disclosed herein may include: (1) elimination of the need to generate a copy of a data packet, thereby avoiding unnecessary memory usage and the enhancing performance; (2) coordination of access by multiple processes to the same packet to prevent concurrency; and (3) allowing of any process to take or initiate action over a stored packet and/or session without causing disruption and invalid pointers to other processes still analyzing the same packet and/or session.
- Turning now to the figures,
FIG. 1 shows a block diagram of a computer network and environment (hereinafter referred to as system 100) for implementing embodiments of the present disclosure, or aspects thereof.System 100 may include one ormore network nodes 102A-102D, one ormore endpoints 104A-104D, one ormore agent nodes 106A-106B, and one ormore controllers 108. As shown inFIG. 1 , one or more switches, firewall modules, routers, and/or router-switch processors may interconnect theaforementioned network nodes 102A-102D,endpoints 104A-104D,agent nodes 106A-106B, and/orcontrollers 108. Thenetwork nodes 102A-102D,endpoints 104A-104D,agent nodes 106A-106B, and/orcontrollers 108 may be connected to theinternet 110 through the one or more switches, firewall modules, routers, and/or router-switch processors. It is understood that thesystem 100 may include less than or more than the number of network nodes, endpoints, agent nodes, and/or controllers depicted in theFIG. 1 in other embodiments. - The one or
more network nodes 102A-102D may form a distributed control plane. Thecontroller 108 may be configured to manage the distributed control plane. In some embodiments, thecontroller 108 may manage the distributed control plane by alerting, automating, and/or implementing workflow integrations for thenetwork nodes 102A-102D. Accordingly, thecontroller 108 may be referred to as a policy decision point for thesystem 100. For example, policies such as automation and/or workflow integrations for the one ormore network nodes 102A-102D may be determined by thecontroller 108. In some embodiments, any combination of the one ormore network nodes 102A-102D may comprise thecontroller 108. - The one or
more network nodes 102A-102D may be configured to provide visibility to a network associated with eachrespective network node 102A-102D and enforce predetermined policies, e.g., automation and/or workflow integrations. For example,network nodes 102A-102D may provide connection reports, e.g., to thecontroller 108, to provide such visibility. In some embodiments, thecontroller 108 may update policies for the one ormore network nodes 102A-102D based on such reports. - In some embodiments, a
network node 102A may provide access to a perimeter network including DMZ services, such as, web servers, mail servers, FTP servers, VoIP servers, and the like. In the context of the current disclosure, DMZ services (demilitarized zone services) may refer to a perimeter network that may be a physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted network such as the Internet. In such embodiments,network node 102A may provide visibility to the perimeter network and enforce predetermined polices for the perimeter network. In some embodiments, anetwork node network node network node network node 102C may be associated with (e.g., provide access to) cloud networks such as an object storage service (e.g., S3 bucket). In such embodiments,network node 102C may provide visibility to the cloud network and enforce predetermined policies for the cloud network. - In some embodiments, a
network node 102D may communicate with one ormore agent nodes 106A-106B associated with one ormore endpoints 104C-104D. The one ormore endpoints 104C-104D may include one or more network connected devices according to some embodiments. In the context of the current disclosure, a network connected device may refer to any physical device connected to a network whether local or remote, as well as any virtual devices and/or virtual services (e.g., micro-services) running on such devices included in the network or remote from the network. For example, a network connected device may include any computing device, e.g., server, a mobile device, a desktop computer, a payment terminal with a computer chip, etc. or any other device or service in communication with the network. Thenetwork node 102D may obtain information regarding the one ormore endpoints 104C-104D via the one ormore agent nodes 106A-106B, as will be described in further detail below. -
Agent nodes 106A-106B may provide visibility regarding each associatedendpoint 104C-104D and may also enforce predetermined policies for theendpoints 104C-104D. In some embodiments, anagent node 106A-106B may comprise a browser plugin, a process memory-dumper, plugin framework, etc. For example, a browser plugin may be configured to detect malicious URLs inside encrypted connections. As another example, a process memory-dumper may be configured to inspect and capture in-memory and running processes. The process memory-dumper may be further configured to automate connection to acontroller 108 for disassembly and forensic analysis. As yet another example, plugin framework may provide extensions for additional host-based detection, deception and mitigation capabilities via SQL query (e.g., OSQuery). -
Agent nodes 106A-106B may be configured to query any software, e.g., installed on anendpoint 104C-104D, without requiring the software to be running. In some embodiments,agent nodes 106A-106B may detect vulnerable software across an organization, e.g.,system 100, thereby providing useful information for asset inventory and compliance. For example, theagent nodes 106A-106B may query for and determine vulnerable versions of a web browser. In some embodiments,agent nodes 106A-106B may be configured to query any active processes and related connections. For example, theagent nodes 106A-106B may query for a specific open port. As another example, theagent nodes 106A-106B may query for any open remote ports. Theagent nodes 106A-106B may be configured to query active users and associated processes and connections. For example, theagent nodes 106A-106B may query user executed specific process and retrieve the process path. As another example, theagent nodes 106A-106B may query file-less processes with remote connections. In some embodiments, theagent nodes 106A-106B may perform queries on any connected devices. -
FIG. 2 shows a block diagram of a computer network and environment (hereinafter referred to as system 200) for implementing embodiments of the present disclosure, or aspects thereof. As shown inFIG. 2 , thesystem 200 may comprise amanagement plane 210 including acontroller 208, afirst zone proxy 212A, asecond zone proxy 212B, security information and event management system (SIEM) 214, security operationsworkflow management system 215,intelligence scoring system 216, andopenflow controller 218.SIEM 214 may be configured to aggregate and/or view security logs and alerts. Security operationsworkflow management system 215 may be configured to coordinate threat mitigation based on certain triggers, e.g., such as certain detected threats, and invoke changes in thesystem 200 to mitigate the threat and/or reflect the coordinated threat mitigation.Intelligence scoring system 216 may be configured to aggregate information associated with identified and/or potential threats, e.g., information provided by external systems and/or information based on threats detected and mitigated by thesystem 200, and determine scores for threats relevant tosystem 200. In some embodiments, anopenflow controller 218 may be configured to use the OpenFlow protocol to connect and configured network devices, e.g., one or more switches, firewall modules, routers, and/or router-switch processors as depicted inFIG. 1 , to determine optimal paths for network traffic. It is understood that theopenflow controller 218 may be any appropriate software-defined network (SDN) controller in some embodiments.System 200 may further comprise one or moredata plane zones 220A-220B. As shown inFIG. 2 , eachdata plane zone 220A-220B may include anetwork node 202A-202B, anendpoint 204A-204B, anagent node 206A-206B, and anagent controller 214A-214B. Anagent controller 214A-214B may be configured to communicate with azone proxy 212A-212B and manage one or more associatedagent node 206A-206B, as will be described in further detail below. - The
controller 108 may manage eachdata plane zone 220A-220B via adedicated proxy 212A-212B as shown inFIG. 2 . It is understood that there may be less than or more than two data plane zones in other embodiments. Cross domain communications, e.g., communications between themanagement plane 210 and thedata plane zones 220A-220B, may be performed via the proxy 212A-212B and each dedicateddata plane zone 220A-220B, e.g.,network node 202A-202B and/oragent controller 214A-214B. Accordingly, zone-specific actions may be defined by themanagement plane 210 and dynamically managed throughout thesystem 200. - In some embodiments,
management plane 210 communications may include policy, intelligence, distribution, and/or monitoring and/or statistics. For example, thecontroller 208 may transmit information including logging, events, and/or alerts to theSIEM 214. As another example, thecontroller 208 may perform workflow orchestration based on the securityoperations workflow system 215. As another example, thecontroller 208 may obtain threat scores from theintelligence scoring system 216. As yet another example, thecontroller 208 may communicate with theopenflow controller 218 to determine optimal paths for network traffic. In some embodiments,management plane 210 communications may be encrypted. - In some embodiments, data plane communications may include communication between the
agent controller 214A-214B and theagent node 206A-206B. Anagent controller 214A may be configured to manage one ormore agent nodes 206A withindata plane zone 220A. Theagent controller 214A may be configured to provide configuration management toagent node 206A and transmit image distribution and log aggregation information from the agent node 206 to themanagement plane 210 viazone proxy 212A. It is understood thatdata plane zone 220A may include two or more agent nodes each associated with a separate endpoint in other embodiments. In such embodiments, theagent controller 214A may be configured to manage the two or more agent nodes indata plane zone 220A. -
FIG. 3 depicts anetwork node 300, according to some embodiments. Thenetwork node 300 may include apacket processing engine 310 and aprocessing analysis engine 320, according to some embodiments. While only oneprocessing analysis engine 320 is depicted inFIG. 3 , it is understood that thenetwork node 300 may include two or more processing analysis engines in other embodiments. - In some embodiments, the
packet processing engine 310 may be deployed inline to a network. Thepacket processing engine 310 may receive ingress data packets, e.g., IPv4 and/or IPv6 data packets. In some embodiments, thepacket processing engine 310 may include atraffic merge component 312 in which the received data packets may be temporarily stored. Thepacket processing engine 310 may forward each received data packet to theprocessing analysis engine 320. Thepacket processing engine 310 may include atraffic replica component 314 configured to generate a replica of each temporarily stored data packet. In some embodiments, thetraffic replica component 314 may be configured to generate a pointer for each temporarily stored data packet. In such embodiments, thetraffic replica component 314 may share the generated pointers with theprocessing analysis engine 320, thereby enabling theprocessing analysis engine 320 to use the generated pointers to access the stored data packets. Some embodiments of thetraffic merge component 312 and thetraffic replica component 314, e.g., sharedbuffer 402 andpacket coordinator 404, respectively, are depicted in and described below with reference toFIG. 4 . - The
packet processing engine 310 may further include a trafficbasic filter component 315 configured to check if one or more attributes associated with the temporarily stored data packets match predetermined attributes. For example, the predetermined attributes may include a source, destination IP, port, protocol, etc. In some embodiments, the predetermined attributes may be associated with data packets, sessions, and/or data flow that may be malicious, e.g., C2 and/or exfiltration malware. If attributes associated with one or more data packets do not match predetermined attributes, the one or more data packets may be forwarded to the intended destination via aswitching component 318. - If attributes associated with the temporarily stored one or more data packets matches the predetermined attributes, an Packet Processing Unit (PPU)
engine component 316 may be configured to perform a dynamic action on the one or more data packets, a session associated with the one or more data packets, and/or a data flow associated with the one or more data packets. In some embodiments, thePPU engine component 316 may comprise a micro-program that includes an activation rule and micro-compiled code that is executed if the activation rule matches. In some embodiments, the micro-compiled code may be executed to respond to, copy, drop, route, and/or modify the one or more data packets. In some embodiments, thePPU engine component 316 may further include state and memory useful for subsequent re-execution of the micro-program. The micro-program may further include executing a program, one or more data packets, a session, and/or a data flow based on the one or more data packets. The micro-program may comprise of both states and instructions. In some embodiments, the one or more data packets may be transparently routed to a deception server. In the context of the current disclosure, a deception server may be referred to a server that acts like a legitimate server for the purpose of gathering information about a malicious actor and/or entity (also referred to collectively as “adversary”) including what the adversary is trying to exploit and where the adversary is trying to gather information from. For example, the deception server may be utilized to detect SQL injection attempts. In some embodiments, the one or more data packets may reflect un-allowed traffic to bad domains. In such embodiments, the one or more data packets may be detected and redirected without detection by an adversary. In some embodiments, the one or more data packets may reflect encrypted malware. In such embodiments, the threat may be mitigated by dropping the one or more data packets. - The
packet processing engine 310 may communicate such performed dynamic actions to thecontroller 308 and/or one ormore network nodes 330A-330C. In such embodiments, thecontroller 308 and/or the one ormore network nodes 330A-330C may dynamically detect and mitigate similar data packets based on the communication. - The
processing analysis engine 320 may include atraffic replica receiver 322 configured to receive replicas of the temporarily stored data packets for a deep analysis of the data packets. The data packet replicas may be utilized by thedetection module 324, which may include an event detection module 328 and one or moreevent handler modules 326A-326C. The detection module 328 may be configured for a deep analysis of sessions, file extractions, intelligence correlation, and many other similar higher-level data signals analysis performed across multiple packet contexts including network and endpoint information. For example, the event detection module 328 may be configured to detect predetermined protocols and/or malware. In the context of the current disclosure, intelligence correlation may refer to identifying attributes associated with detected IPs, domains, C2s, and behaviors and utilizing such identified attributes to detect similar associated threats in other environments. Each detected protocol and/or malware may be referred to as an event, and theevent handler modules 326A-326C may be configured to perform an analysis of an event. In some embodiments, anevent handler module 326A may obtain information from anagent node 306 regarding an associated endpoint. Theagent node 406 may provide visibility to a process, user information associated with executing the process, network and/or file state on the endpoint, and/or ownership of files such that the information gained by that visibility may be used by theevent handler module 326A for detection and coordination with thepacket processing engine 310. For example, theevent handler module 326A may query for information, run scans for malware on demand, and/or collect process images. Each of theevent handler modules 326A-326C may be configured to detect predetermined protocols and/or obtain PPUs based on mitigation and detection macro-logic. For example, theevent handler modules 326A-326C may obtain and/or generate micro-programs that include an activation rule and micro-compiled code that may be executed if the activation rule matches. Theevent handler modules 326A-326C may deploy such micro-programs to the packet processing engine 310 (e.g., trafficbasic filter component 315,PPU engine component 316, and/or switching component 318). - In some embodiments, the
controller 308 may receive messages from thepacket processing engine 310, theagent node 306, and theprocessing analysis engine 320 such that those messages may be processed, organized and redistributed to other connected components, such asother network nodes 330A-330C, based on predetermined policies. For example, thecontroller 308 may perform a security analysis of the network including thenetwork node 300, log the analysis, and/or perform and protocol or malware analysis based on the received messages. In some embodiments, the received messages may include endpoint process data obtained from theagent node 406, network metadata, associated PPUs, etc. -
FIG. 4 depicts anetwork node 400, according to some embodiments. Thenetwork node 400 may include apacket processing engine 410 and aprocessing analysis engine 420, according to some embodiments. While only onedeep engine 420 is depicted inFIG. 4 , it is understood that thenetwork node 400 may include two or more processing analysis engines in other embodiments. - The
packet processing engine 410 may include one or more sharedbuffers 402, apacket coordinator 404, and a packetprocessing action engine 406, according to some embodiments. As described above with reference toFIG. 3 , thepacket processing engine 410 may be deployed inline to a network. Thepacket processing engine 410 may receive ingress data packet, e.g., IPv4 and/or Ipv6 data packets. In some embodiments, the received data packets may be temporarily stored in the one or more sharedbuffers 402. In some embodiments, the one or more sharedbuffers 402 may include one or more circular packet buffers. The use of circular packet buffers maintains optimal performances while continuously receiving ingress data packets. Theprocessing analysis engine 420 may include one ormore processes 422A-422N that may request access to packets temporarily stored in the sharedbuffers 402 to, for example, analyze the incoming packets. It should be understood that the one ormore processes 422A-422N may be located in one or more processing analysis engines in other embodiments. For example, processes 422A and 422B may be located in theprocessing analysis engine 420, and a separate process may be located in a separate processing analysis engine. It should be further understood that the separate processing analysis engine may be located in thenetwork node 400 or a separate network node. That is, one or more processes of a separate processing analysis engine of thenetwork node 400 and/or a separate network node may request access to packets temporarily stored, e.g.,packets 412A-412N, in the shared buffers 402. In some embodiments, the one ormore processes 422A-422N may include one or moreevent handler modules 326A-326C, event detection modules 328, and/ordetection modules 324, as described above with reference toFIG. 3 . - The
packet coordinator 404 may coordinate requests from multiple separate processes, e.g., processes 422A-422N, to access the same temporarily stored packet without the need to copy the packet for each process. In some embodiments, thepacket coordinator 404 may generate a software pipe between each of the requestingprocesses 422A-422N and the sharedbuffer 402 such that the sharedbuffer 402 may be accessed as shared memory acrossmultiple processes 422A-422N. That is, thepacket coordinator 404 may establish temporary connections between each requestingprocess 422A-422N and the sharedbuffer 402 such that the requestingprocesses 422A-422N may access packets temporarily stored, e.g.,packets 412A-412N, in the sharedbuffer 402. Accordingly, the requestingprocesses 422A-422N may each access a same temporarily stored packet simultaneously or in any order. In some embodiments, the requestingprocesses 422A-422N may access temporarily stored packets in the sharedbuffer 402 via respective software pipes and one or more shared pointers. In such embodiments, the requestingprocesses 422A-422N may use each respective software pipe to access one or more shared pointers, each of which point to a packet temporarily stored in the sharedbuffer 402, as will be described in further detail below. - The
packet coordinator 404 may generate a shared pointer pointing to a temporarily stored packet for each process, e.g., processes 422A-422N, requesting access to the temporarily stored packet. For example, thepacket coordinator 404 may generate a first shared pointer pointing a packet temporarily stored, e.g.,packet 412A, in the sharedbuffer 402 upon receiving a request from a first process, e.g.,process 422A, to access the temporarily storedpacket 412A. The first shared pointer may be assigned to process 422A, and the assigned first shared pointer may be transmitted and/or otherwise shared with theprocess 422A such that theprocess 422A may use the first shared pointer to access the temporarily storedpacket 412A. Thepacket coordinator 404 may generate a second shared pointer pointing to the same temporarily storedpacket 412A in the sharedbuffer 402 upon receiving a request from a second process, e.g.,process 422B, to access the same temporarily storedpacket 412A. Similarly, the second shared pointer may be assigned to process 422B, and the assigned second shared pointer may be transmitted and/or otherwise shared with theprocess 422B such that theprocess 422B may use the second shared pointer to access the same temporarily storedpacket 412A. It is understood that more than two shared pointers may be generated, where each shared pointer may be assigned to a separate process and points to the same packet. Similarly, it should also be understood that more than one shared pointer may be generated for a specific process. For example, the specific process may transmit two or more requests to access two or more temporarily stored packets. In such instances, thepacket coordinator 404 may generate a shared pointer corresponding to each request, such that the specific process may use each respective shared pointer to access the corresponding packet temporarily stored in the sharedbuffer 402. - Accordingly, the one or
more processes 422A-422N may be enabled to access a same packet temporarily stored in the sharedbuffer 402 and perform analysis, e.g., security analysis, of the packet without contention. In some embodiments, a process may determine that an action must be taken over the temporarily stored packet (hereinafter referred to as “identified packet”) based on the performed analysis. For example, the identified packet may be determined to be part of a security threat to a network. In such embodiments, the process may dynamically transmit a request to thepacket coordinator 404 to take the appropriate action on the identified packet. For example, the process may transmit a message to thepacket coordinator 404 to drop the identified packet and/or a session associated with the identified packet such that there are no concurrent actions taken over the identified packet by other processes. As there is just the identified packet temporarily stored in the sharedbuffer 402 and no copies of the identified packet, such actions may be performed effectively and efficiently, especially in instances in which many processes (or multiple instances of the same process) request access to each temporarily stored packet. - In some embodiments, the action may be performed by the
packet coordinator 404 and/or the packetprocessing action engine 406. In some embodiments, thepacket processing engine 406 may comprise thePPU engine component 316 as described above with reference toFIG. 3 . Accordingly, packetprocessing action engine 406 may be configured to perform a dynamic action on the identified packet, a session associated with the identified data packet, and/or a data flow associated with the identified data packet. For example, the packetprocessing action engine 406 may respond to, copy, drop, route, and/or modify the identified data packet, as described in further detail above with reference toFIG. 3 . It should be understood that any combination of thepacket coordinator 404 and the packetprocessing action engine 406 may be configured to perform the functions of thePPU engine component 316 in some embodiments. - In some embodiments, information regarding the performed action may be transmitted to a
controller 408, e.g.,controllers FIGS. 1-3 , theprocesses 422A-422N, and/or other network nodes. Thecontroller 408 may monitor and/or analyze network traffic associated with thenetwork node 400 based on such received information. In some embodiments, one or more of theprocesses 422A-422N, thepacket coordinator 404, and/or the packetprocessing action engine 406 may transmit information regarding a current status of each respective component and associateddata packet 412A-412N. Thecontroller 408 may monitor and/or analyze network traffic associated with thenetwork node 400 based on this information. In some embodiments, thecontroller 408 may be configured to control (e.g., perform actions) network traffic associated with thenetwork node 400 based on the information received from the aforementioned components. That is, the network traffic directed to, directed from, and/or currently stored in thenetwork node 400 may be controlled from a single point, e.g., thecontroller 408. -
FIG. 5 depicts anexemplary method 500 for securing a network comprising one or more network nodes connecting a plurality of network connected devices of the network according to some embodiments. Themethod 500 may begin withstep 502 in which a plurality of data packets may be received at a network node of the network. Instep 504, the received data packets may be temporarily stored in a shared buffer of the network node. In some embodiments, the shared buffer may be a shared circular buffer. - In
step 506, a first request transmitted by a first processing engine to access a first temporarily stored data packet may be received. Instep 508, a connection may be established with the first processing engine. Instep 510, a first pointer to the first temporarily stored data packet may be generated. Instep 512, the first processing engine may be enabled to use the generated first pointer to access the first temporarily stored data packet. - In
step 514, a second request transmitted by a second processing engine to access the first temporarily stored data packet may be received. Instep 516, a connection with the second processing engine may be established. Instep 518, a second pointer to the first temporarily stored data packet may be generated, where the second pointer is different from the first pointer while pointing to the same first temporarily stored data packet. Instep 520, the second processing engine may be enabled to use the generated second pointer to access the first temporarily stored data packet. - In some embodiments,
process 500 may include a further step in which a message regarding the first temporarily stored data packet may be received from the first processing engine and/or the second processing engine. In such embodiments, the first temporarily stored data packet may be processed based on the received message, wherein processing the first temporarily stored data packet may include dropping the first data packet from the buffer, routing from the buffer, and/or modifying the data packet. In some embodiments, the first processing engine, the second processing engine, and/or a controller may be notified regarding the processed first temporarily stored data packet. - In some embodiments,
process 500 may include a further step in which a third request transmitted by a third processing engine to access the first temporarily stored data packet. In some embodiments, a connection with the third processing engine may be established. In some embodiments, a third pointer to the first temporarily stored data packet may be generated. The third pointer may be different from the first and second pointer while pointing to the same first temporarily stored data packet. In some embodiments, the third processing engine may be enabled to use the generated third pointer to access the first temporarily stored data packet. - In some embodiments, the network node may include the first processing engine. In some embodiments, the network node may include the shared buffer and a remote network node may include the second processing engine.
- Program aspects of the technology may be thought of as “products” or “articles of manufacture” typically in the form of executable code and/or associated data that is carried on or embodied in a type of machine readable medium. “Storage” type media include any or all of the tangible memory of the computers, processors or the like, or associated modules thereof, such as various semiconductor memories, tape drives, disk drives and the like, which may provide non-transitory storage at any time for the software programming. All or portions of the software may at times be communicated through the Internet or various other telecommunication networks. Such communications, for example, may enable loading of the software from one computer or processor into another, for example, from a management server or host computer of the mobile communication network into the computer platform of a server and/or from a server to the mobile device. Thus, another type of media that may bear the software elements includes optical, electrical and electromagnetic waves, such as used across physical interfaces between local devices, through wired and optical landline networks and over various air-links. The physical elements that carry such waves, such as wired or wireless links, optical links, or the like, also may be considered as media bearing the software. As used herein, unless restricted to non-transitory, tangible “storage” media, terms such as computer or machine “readable medium” refer to any medium that participates in providing instructions to a processor for execution.
- The many features and advantages of the disclosure are apparent from the detailed specification, and thus, it is intended by the appended claims to cover all such features and advantages of the disclosure which fall within the true spirit and scope of the disclosure. Further, since numerous modifications and variations will readily occur to those skilled in the art, it is not desired to limit the disclosure to the exact construction and operation illustrated and described, and accordingly, all suitable modifications and equivalents may be resorted to, falling within the scope of the disclosure.
Claims (21)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US18/351,626 US20230362131A1 (en) | 2021-02-05 | 2023-07-13 | Systems and methods for monitoring and securing networks using a shared buffer |
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US17/168,392 US11196710B1 (en) | 2021-02-05 | 2021-02-05 | Systems and methods for monitoring and securing networks using a shared buffer |
US17/453,514 US11750564B2 (en) | 2021-02-05 | 2021-11-04 | Systems and methods for monitoring and securing networks using a shared buffer |
US18/351,626 US20230362131A1 (en) | 2021-02-05 | 2023-07-13 | Systems and methods for monitoring and securing networks using a shared buffer |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US17/453,514 Continuation US11750564B2 (en) | 2021-02-05 | 2021-11-04 | Systems and methods for monitoring and securing networks using a shared buffer |
Publications (1)
Publication Number | Publication Date |
---|---|
US20230362131A1 true US20230362131A1 (en) | 2023-11-09 |
Family
ID=78818873
Family Applications (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US17/168,392 Active US11196710B1 (en) | 2021-02-05 | 2021-02-05 | Systems and methods for monitoring and securing networks using a shared buffer |
US17/453,514 Active 2041-03-20 US11750564B2 (en) | 2021-02-05 | 2021-11-04 | Systems and methods for monitoring and securing networks using a shared buffer |
US18/351,626 Pending US20230362131A1 (en) | 2021-02-05 | 2023-07-13 | Systems and methods for monitoring and securing networks using a shared buffer |
Family Applications Before (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US17/168,392 Active US11196710B1 (en) | 2021-02-05 | 2021-02-05 | Systems and methods for monitoring and securing networks using a shared buffer |
US17/453,514 Active 2041-03-20 US11750564B2 (en) | 2021-02-05 | 2021-11-04 | Systems and methods for monitoring and securing networks using a shared buffer |
Country Status (2)
Country | Link |
---|---|
US (3) | US11196710B1 (en) |
WO (1) | WO2022170347A1 (en) |
Families Citing this family (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11658903B2 (en) * | 2021-04-06 | 2023-05-23 | Arista Networks, Inc. | Network device route programming |
US20230254225A1 (en) * | 2022-02-06 | 2023-08-10 | Arista Networks, Inc. | Generating hybrid network activity records |
Family Cites Families (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20030217184A1 (en) * | 2000-12-30 | 2003-11-20 | Govindan Nair | Method and apparatus for allocating buffers shared among protocol layers in a protocol stack |
US7484083B1 (en) * | 2005-10-07 | 2009-01-27 | American Megatrends, Inc. | Method, apparatus, and computer-readable medium for utilizing BIOS boot specification compliant devices within an extensible firmware interface environment |
GB2443005A (en) * | 2006-07-19 | 2008-04-23 | Chronicle Solutions | Analysing network traffic by decoding a wide variety of protocols (or object types) of each packet |
US20180212885A1 (en) * | 2017-01-20 | 2018-07-26 | Google Inc. | Device and method for scalable traffic shaping at a receiver with a time-indexed data structure |
-
2021
- 2021-02-05 US US17/168,392 patent/US11196710B1/en active Active
- 2021-11-04 US US17/453,514 patent/US11750564B2/en active Active
-
2022
- 2022-02-04 WO PCT/US2022/070525 patent/WO2022170347A1/en active Application Filing
-
2023
- 2023-07-13 US US18/351,626 patent/US20230362131A1/en active Pending
Also Published As
Publication number | Publication date |
---|---|
US11750564B2 (en) | 2023-09-05 |
US11196710B1 (en) | 2021-12-07 |
US20220255898A1 (en) | 2022-08-11 |
WO2022170347A1 (en) | 2022-08-11 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10701035B2 (en) | Distributed traffic management system and techniques | |
US11882141B1 (en) | Graph-based query composition for monitoring an environment | |
US10257227B1 (en) | Computer security threat correlation | |
US20230362131A1 (en) | Systems and methods for monitoring and securing networks using a shared buffer | |
CN107257332B (en) | Timing management in large firewall clusters | |
US10893065B2 (en) | Malware detection in distributed computer systems | |
US20220311791A1 (en) | Systems and methods for low latency stateful threat detection and mitigation | |
US11057415B1 (en) | Systems and methods for dynamic zone protection of networks | |
Esteves Verssimo et al. | Collaborative inter-domain stealthy port scan detection using esper complex event processing | |
Dash | Edge Based Network Attack Detection Using Pulsar |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STPP | Information on status: patent application and granting procedure in general |
Free format text: DOCKETED NEW CASE - READY FOR EXAMINATION |
|
AS | Assignment |
Owner name: MONROE CAPITAL MANAGEMENT ADVISORS, LLC, ILLINOIS Free format text: SECURITY INTEREST;ASSIGNORS:ZEROFOX, INC.;LOOKINGGLASS CYBER SOLUTIONS, LLC;IDENTITY THEFT GUARD SOLUTIONS, INC.;REEL/FRAME:067396/0304 Effective date: 20240513 |
|
AS | Assignment |
Owner name: LOOKINGGLASS CYBER SOLUTIONS, LLC, MARYLAND Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:STIFEL BANK;REEL/FRAME:067429/0361 Effective date: 20240513 |