Michael John Mcdaniels

US Patent:

7469418, Dec 23, 2008

Filed:

Oct 1, 2003

Appl. No.:

10/676637

Inventors:

Mark L. Wilkinson - Austin TX, US
Ronald J. Miller - Kyle TX, US
Michael J. McDaniels - Hutto TX, US

Assignee:

Mirage Networks, Inc. - Austin TX

International Classification:

G06F 11/00

US Classification:

726 22, 726 23, 726 24, 713188, 713189, 709223, 709224

Abstract:

A system, method, and computer-readable medium for deterring network incursion by formulating appropriate responses to attacks. Once an attack is detected, the system may respond in such a manner as to imitate a network device. The system may respond in a manner that provides a high cost to pursue further communication with the system. For example, the system may respond to TCP syn requests and window probes with messages indicating small packet and window sizes. As such, attempts to send packets to the system have a high network and processing cost. An attacking computer running multiple threads may ultimately slow or be disabled as a result of the receiving the responses and attempting to continue to communicate with the system.

US Patent:

7506360, Mar 17, 2009

Filed:

Oct 1, 2003

Appl. No.:

10/676541

Inventors:

Mark L. Wilkinson - Austin TX, US
Ronald J. Miller - Kyle TX, US
Michael J. McDaniels - Hutto TX, US

Assignee:

Mirage Networks, Inc. - Austin TX

International Classification:

H04L 9/32

US Classification:

726 3, 726 22, 726 23, 726 24, 709223, 709224, 709225

Abstract:

A system and method for tracking communication for determining device states. Communication between devices is observed and a respective state of at least one device is inferred. The inference is formed without directly communicating with the device. Various states of the devices include unknown, used, unfulfilled, virtual, omitted, and automatic. The respective state of a device is unknown when the observation shows that the device fails to respond to communication. The respective state of the device is unfulfilled when an ARP request comprising a destination address for the device is observed, and the device does not respond to the ARP request prior to expiration of a time limit. The respective state of a device is determined to be virtual when the observation shows that the device received a packet when its respective state was unfulfilled, and the device did not send a reply to the packet within a time limit.

US Patent:

8260961, Sep 4, 2012

Filed:

Oct 1, 2003

Appl. No.:

10/676505

Inventors:

Mark L. Wilkinson - Austin TX, US
Ronald J. Miller - Kyle TX, US
Michael J. McDaniels - Hutto TX, US

Assignee:

Trustwave Holdings, Inc. - Chicago IL

International Classification:

G06F 15/16
G06F 15/173
G06F 12/16

US Classification:

709245, 709223, 726 26

Abstract:

A system and method for managing logical and physical address state lifecycles. A state of unknown can be assigned to an address when the state has not been assigned. The state of the address is changed when communication is targeted to the address. The state can be changed to unfulfilled when the communication includes an address resolution protocol request sent to a device having the address when a time limit for a response to the address resolution protocol request has not expired. The state can be changed to virtual when the communication is received at the address when the state of the address is unfulfilled, and a time limit for responding to the communication expires before a response is sent. The state can be changed to unknown when the state of the address is not unknown, and the address does not participate in the communication within a time limit.

US Patent:

20130311676, Nov 21, 2013

Filed:

Sep 4, 2012

Appl. No.:

13/603388

Inventors:

Mark L. Wilkinson - Austin TX, US
Ronald J. Miller - Kyle TX, US
Michael J. McDaniels - Hutto TX, US

International Classification:

H04L 29/12

US Classification:

709245

Abstract:

A system and method for managing logical and physical address state lifecycles. A state of unknown can be assigned to an address when the state has not been assigned. The state of the address is changed when communication is targeted to the address. The state can be changed to unfulfilled when the communication includes an address resolution protocol request sent to a device having the address when a time limit for a response to the address resolution protocol request has not expired. The state can be changed to virtual when the communication is received at the address when the state of the address is unfulfilled, and a time limit for responding to the communication expires before a response is sent. The state can be changed to unknown when the state of the address is not unknown, and the address does not participate in the communication within a time limit.