# US 10,122,748 B1 · Network protection system and threat correlation engine > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,748 B1 - Document ID: US10122748B1 - Status: Granted - Kind: B1 - Application number: 14/832,235 - Filed: 2015-08-21 - Granted: 2018-11-06 - Earliest claimed: 2015-08-21 - Assignees: InsCyt, LLC - Applicants: InsCyt, LLC - Inventors: Thomas J. Currie - Web page: https://patentgrep.com/patent/US10122748B1 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 16/955: using information identifiers, e.g. uniform resource locators [URL] - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 2463/144: Detection or countermeasures against botnets - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A network protection system and method for processing of network traffic between one or more networked devices. The network protection system may include the networked devices and a threat correlation device. The networked devices may operate as a monitoring agent and/or an interdiction agent. The threat correlation device may execute computer code for receiving information from the monitoring agent regarding an event recognized by the monitoring agent, retrieving an event score for the event from a risk scoring database based on an event type, a destination of the event, and a number of occurrences of the event, and updating a risk score by adding the event score to the risk score. When the risk score reaches a critical threshold, the threat correlation device may send instructions to the interdiction agent to take protective or defensive action against data traffic of that event type and from that aggressor. ## Claims ### Claim 1 A network protection system comprising: one or more networked devices configured to operate as at least one of a monitoring agent and an interdiction agent, wherein the monitoring agent comprises at least one of monitoring devices, event sensors, and monitoring software executable on the networked devices and configured to monitor data traffic and recognize events that are potential threats; and at least one threat correlation device communicably coupled with the networked devices, the threat correlation device comprising a processor and at least one memory storage device, the at least one processor configured to execute a computer program stored in the memory storage device, the computer program including: a code segment for receiving information from the monitoring agent regarding an event recognized by the monitoring agent; a code segment for retrieving an event score for the event from a risk scoring database based on at least one of an event type, a destination of the event, and a number of occurrences of the event; a code segment for updating a risk score stored in an aggressor threat database based upon the event score, wherein the risk score is associated with an aggressor and the event type; and a code segment for, when the risk score is at or above at least one threshold, sending instructions to the interdiction agent to take protective action or to execute a defensive response associated with at least one of the at least one threshold, data traffic of the event type and data traffic from the aggressor. ### Claim 2 (depends on 1) The network protection system of claim 1, further comprising a code segment for decrementing the risk score by a predetermined amount upon passage of a predetermined amount of time or upon experiencing a predetermined amount of data traffic. ### Claim 3 (depends on 1) The network protection system of claim 1, wherein updating the risk score includes adding the event score to the risk score and replacing the risk score in the aggressor threat database with a resulting sum. ### Claim 4 (depends on 1) The network protection system of claim 1, wherein the protective action or defensive response comprises at least one of: shunning all data traffic from the aggressor, shunning all data traffic of the event type, and shunning all data traffic that is both of the event type and from the aggressor. ### Claim 5 (depends on 1) The network protection system of claim 1, wherein the event comprises at least one of a network based event or a log data event. ### Claim 6 (depends on 1) The network protection system of claim 1, wherein the at least one threshold includes a plurality of thresholds corresponding to increasingly enhanced protective actions or defensive responses. ### Claim 7 (depends on 1) The network protection system of claim 1, wherein the risk scoring database stores a plurality of event types and a risk scoring matrix for each of the event types, wherein the risk scoring matrix comprises different event score values for different combinations of a number of destinations of the event, and a number of occurrences of the event. ### Claim 8 (depends on 1) The network protection system of claim 1, wherein the risk scoring database comprises values for a plurality of event types, wherein the values are based on risk probability calculations for each event type. ### Claim 9 (depends on 1) The network protection system of claim 1, further comprising a code segment for incrementing a count of a particular event type corresponding to the event recognized by the monitoring agent. ### Claim 10 (depends on 1) The network protection system of claim 1, wherein the information received from the monitoring agent regarding the event includes: an event identifier that identifies the event type, a monitoring agent identifier, a source address of the aggressor or a source of the event, a destination address identifying a target or destination of the event, and a count identifying a running total of a number of occurrences of the event. ### Claim 11 (depends on 1) The network protection system of claim 1, further comprising a code segment for whitelisting an aggressor in the aggressor threat database, prohibiting risk scores associated with the particular aggressor from being changed indefinitely or for a selected amount of time. ### Claim 12 A non-transitory computer-readable storage medium with an executable program stored thereon for processing of network traffic between one or more networked devices, wherein at least one of the networked devices is a monitoring agent configured to monitor data traffic and recognize aggressor events that are potential threats and another or a same one of the networked devices is an interdiction agent, wherein the program comprises: a code segment for receiving information from the monitoring agent regarding an event recognized by the monitoring agent; a code segment for retrieving an event score for the event from a risk scoring database by looking up a risk scoring matrix in the scoring database associated with an event type of the event and determining the event score from the risk scoring matrix based on a destination of the event and a number of occurrences of the event, wherein the risk scoring matrix comprises different event score values for different combinations of a number of destinations of the event and a number of occurrences of the event; a code segment for updating a risk score stored in an aggressor threat database by adding the event score to the risk score, wherein the risk score is associated in the aggressor threat database with the aggressor and the event type; and a code segment for, when the risk score is at or above a critical threshold, sending instructions to the interdiction agent to take protective action or to execute a defensive response associated with data traffic that is both of the event type and from the aggressor. ### Claim 13 (depends on 12) The non-transitory computer-readable storage medium of claim 12, further comprising a code segment for decrementing the risk score by a predetermined amount upon the passage of a predetermined amount of time or upon receiving a predetermined amount of data traffic. ### Claim 14 (depends on 12) The non-transitory computer-readable storage medium of claim 12, further comprising a code segment for whitelisting an aggressor in the aggressor threat database, prohibiting risk scores associated with the particular aggressor from being changed indefinitely or for a selected amount of time. ### Claim 15 (depends on 12) The non-transitory computer-readable storage medium of claim 12, wherein the event scores stored in the risk scoring database are associated with risk probability calculations for each event type. ### Claim 16 (depends on 12) The non-transitory computer-readable storage medium of claim 12, further comprising a code segment for incrementing a count associated with the event type upon receiving the event recognized by the monitoring agent. ### Claim 17 (depends on 12) The non-transitory computer-readable storage medium of claim 12, wherein the information received from the monitoring agent regarding the event includes: an event identifier that identifies the event type, a monitoring agent identifier, a source address of the aggressor or a source of the event, a destination address identifying a target or destination of the event, and a count identifying a running total of a number of occurrences of the event. ### Claim 18 A computer-implemented method for processing of network traffic between one or more networked devices, wherein at least one of the networked devices is a monitoring agent configured to monitor data traffic and recognize aggressor events that are potential threats and another or a same one of the networked devices is an interdiction agent, wherein the method comprises: receiving, with a processor of a threat correlation device, information from the monitoring agent regarding an event recognized by the monitoring agent; retrieving, with the processor, an event score for the event from a risk scoring database by looking up a risk scoring matrix in the scoring database associated with an event type of the event and determining the event score from the risk scoring matrix based on a destination of the event and a number of occurrences of the event, wherein the risk scoring matrix comprises different event score values for different combinations of a number of destinations of the event and a number of occurrences of the event; updating, with the processor, a risk score stored in an aggressor threat database by adding the event score to the risk score, wherein the risk score is associated in the aggressor threat database with the aggressor and the event type; decrementing the risk score by a predetermined amount upon the passage of a predetermined amount of time or upon receiving a predetermined amount of data traffic; and sending, when the risk score is at or above a critical threshold, instructions from the processor to the interdiction agent to take protective action or to execute a defensive response associated with data traffic that is both of the event type and from the aggressor. ### Claim 19 (depends on 18) The method of claim 18, further comprising incrementing, with the processor, a count associated with the event type upon receiving the event recognized by the monitoring agent. ### Claim 20 (depends on 18) The method of claim 18, wherein the information received from the monitoring agent regarding the event includes: an event identifier that identifies the event type, a monitoring agent identifier, a source address of the aggressor or a source of the event, a destination address identifying a target or destination of the event, and a count identifying a running total of a number of occurrences of the event.