IDENTIFYING MALICIOUS DEVICES WITHIN A COMPUTER NETWORK

摘要

This disclosure describes techniques for proactively identifying possible attackers based on a profile of a device. For example, a device includes one or more processors and network interface cards to receive, from a remote device, network traffic directed to one or more computing devices protected by the device, determine, based on content of the network traffic, a first set of data points for the device, send a response to the remote device to ascertain a second set of data points for the device, and receive, from the remote device, at least a portion of the second set of data points. The device also includes a security module operable by the processors to determine a maliciousness rating, and selectively manage, based on the maliciousness rating, additional network traffic directed to the one or more computing devices protected by the security device and received from the remote device.

主权项

1. A method comprising:
receiving, by a security device, from a device, network traffic directed to one or more computing devices protected by the security device; determining, based on content of the network traffic, a first set of data points for the device, the first set of data points specifying characteristics of a software application executing at the device; sending, by the security device, a response to the device to ascertain a second set of data points for the device, the second set of data points including characteristics of an operating environment provided by and local to the device; receiving, by the security device and from the device, at least a portion of the second set of data points; determining whether the received portion of the second set of data points and the first set of data points include inconsistent information; and responsive to determining that the received portion of the second set of data points and the first set of data points include inconsistent information, managing additional network traffic directed to the one or more computing devices protected by the security device and received from the device.