US 11,706,233 B2
Detecting injection attacks using passive network monitoring
Benjamin Thomas Higgins, Shoreline, WA (US); Jesse Abraham Rothstein, Seattle, WA (US); Xue Jun Wu, Seattle, WA (US); Michael Kerber Krause Montague, Lake Forest Park, WA (US); and Kevin Michael Seguin, Seattle, WA (US)
Assigned to ExtraHop Networks, Inc., Seattle, WA (US)
Filed by ExtraHop Networks, Inc., Seattle, WA (US)
Filed on Mar. 26, 2021, as Appl. No. 17/214,555.
Application 17/214,555 is a continuation of application No. 16/424,387, filed on May 28, 2019, granted, now 10,965,702.
Prior Publication US 2022/0021694 A1, Jan. 20, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/32 (2006.01); H04L 9/40 (2022.01); H04L 43/0876 (2022.01)
CPC H04L 63/1425 (2013.01) [H04L 43/0876 (2013.01); H04L 63/1433 (2013.01); H04L 63/1466 (2013.01)] 17 Claims
OG exemplary drawing
 
1. A method for monitoring network traffic using one or more network computers, comprising:
determining one or more requests as suspicious that are provided to a server in a monitored network based on one or more characteristics of the one or more provided requests, wherein correlation information is determined for the one or more suspicious requests;
employing one or more characteristics of one or more dependent actions performed by the server to provide other correlation information for the one or more dependent actions, wherein the one or more dependent actions are evaluated for association with anomalous activity based on the correlation information and the other correlation information, wherein the anomalous activity comprises, an injection attack based on malformed information included in the one or more suspicious requests that is associated with one or more malformed shell instruction, malformed command instruction, or malformed inter-process communication associated with the one or more dependent actions;
determining the other malformed information that is included in the one or more dependent actions based on an association with the malformed information that is included in the one or more suspicious request;
employing one or more characteristics of the one or more suspicious requests to provide one or more correlations associated with the one or more suspicious requests;
providing the evaluation of the one or more dependent actions for anomalous activity based on the one or more correlations associated with the one or more suspicious requests; and
providing one or more reports that include information associated with the anomalous activity by the server and the one or more other servers in the monitored network.