US 8413238

Patent Overview — US 8,413,238 B1

Title: "Monitoring darknet access to identify malicious activity"

Patent number / type: US 8,413,238 B1 (granted patent).

Application: US 12/176,912.

Inventors: Michael Sutton.

Assignee: Zscaler, Inc. (original assignee); an earlier assignment to SafeChannel Inc. is recorded. Per the operating rules, no ownership-transfer analysis is offered.

Key dates (as listed):

• Prior art date: 2008-07-21
• Filing date: 2008-07-21
• Publication/grant date: 2013-04-02
• Legal status: Active, adjusted expiration 2030-08-26 (status is an assumption per the source, not a legal conclusion).

Purpose / plain-language scope: The disclosure addresses identifying malicious activity by watching for access attempts to darknet addresses — IP addresses that are unassigned or unused. Darknet traffic is described as arising from roughly three causes: accident/mistake, backscatter, and malicious scanning, with automated scanning by malicious code supplying most such traffic; malicious code commonly selects target addresses randomly and does not avoid darknets.

One described method (a stated aspect of the subject matter) includes: identifying a list of darknet addresses; monitoring communications originating from a protected network; comparing destination addresses of those communications against the darknet list; and, on a match, providing notification of potential malicious activity originating from the protected network. The system may be implemented as an overlay network (a distributed security system) with content processing nodes serving as an access layer, plus authority nodes that distribute policy and threat data — including "known darknet IP address ranges." The text notes that inspecting all enterprise traffic this way allows identifying traffic destined for darknet space without having to acquire darknet addresses themselves, thereby avoiding possible violation of a regional Internet registry's rules.

Classifications noted: G06F21/00, G06F21/82, G06F21/85; H04L63/1408, H04L63/1416, H04L63/1441, H04L63/0227; H04L2463/144 (botnets).

Source: https://patents.google.com/patent/US8413238/en

What the excerpt does not establish: It does not provide the full claims, complete specification, or drawing contents (figures are referenced only by caption), and does not establish any litigation, validity determination, or prior-art analysis. Details of omitted text cannot be confirmed from the supplied excerpt.