Importance

Loading Importance Indicators...

Abstract

Devices and methods are provided to ascertain an existence of tunneling activity through a network firewall. According to one methodology, a set of norms is established for network traffic and a series of data packets transmitted through the firewall are monitored. Data packet attributes are analyzed to determine an absence or an existence of tunneling activity based on whether the attributes conform to the norms. A device is also provided in the form of a detector which is situated behind a network firewall and incorporates a data capture component for passively monitoring network traffic through the firewall and for producing detection data, and a data analysis component for comparing the detection data to a set of network traffic norms that are characteristic of an absence of tunneling activity. Tunneling activity potentially exists if the detection data fails to conform to any one of the set of norms.

Loading the Abstract Image...

First Claim