# US 10,313,363 B2 · Proactive intrusion protection system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,363 B2 - Document ID: US10313363B2 - Status: Granted - Kind: B2 - Application number: 14/950,956 - Filed: 2015-11-24 - Published: 2017-05-25 - Granted: 2019-06-04 - Earliest claimed: 2015-11-24 - Assignees: Bank of America Corporation - Applicants: Bank of America Corporation - Inventors: Manu J. Kurian; David N. Hillis - Web page: https://patentgrep.com/patent/US10313363B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04M 3/38: Graded-service arrangements, i.e. some subscribers prevented from establishing certain connections (queuing arrangements H04Q3/64) - H04M 3/42102: {Making use of the called party identifier} - H04M 7/0078: {Security; Fraud detection; Fraud prevention} - H04L 63/168: {above the transport layer} - H04M 3/365: {Load metering of control unit} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08) ## Abstract A system for proactive intrusion protection comprises a memory operable to store data identifying a plurality of compromising entities, comprising at least one of a device identifier or a contact identifier, and a processor communicatively coupled to the memory and operable to receive, from a remote application associated with a remote device and with the system, information regarding a destination of the outgoing communication. The processor is further operable to determine an entity associated with the destination of the outgoing communication and to determine that the entity associated with the destination matches at least one of the plurality of compromising entities based on comparing the data identifying the plurality of compromising entities and the entity associated with the destination of the outgoing communication. Furthermore, the processor is operable to send to the remote application, before the outgoing communication is sent, a signal configured to block the outgoing communication. ## Claims ### Claim 1 A system, comprising: a memory operable to store: data identifying a plurality of compromising entities, where the data comprises at least one of a device identifier or a contact identifier; and a processor communicatively coupled to the memory and operable to: receive, from a remote application associated with a remote device and with the system, information regarding a pending outgoing communication, where the information comprises a MAC address associated with a destination of the outgoing communication; determine that an entity associated with the destination of the outgoing communication matches at least one of the plurality of compromising entities based, at least in part, on comparing: MAC addresses associated with the plurality of compromising entities; and the MAC address associated with the destination of the outgoing communication; and in response to determining that the entity associated with the destination of the outgoing communication matches at least one of the plurality of compromising entities, determine that the remote device is potentially compromised; send, to the remote application associated with the system, and before the outgoing communication is sent, a signal configured to block the outgoing communication, wherein the signal is further configured to: block a plurality of future communications sent from the remote device in response to determining that the remote device is potentially compromised; and disable one or more features of the remote device. ### Claim 2 (depends on 1) The system of claim 1, wherein the information is received as part of a communication formatted to be protected by at least one of SSL (secure sockets layer) and tokenization. ### Claim 3 (depends on 1) The system of claim 1, wherein the signal is sent as part of a communication formatted to be protected by at least one of SSL (secure sockets layer) and tokenization. ### Claim 4 (depends on 1) The system of claim 1, wherein the processor receives an authentication message confirming that the signal was received by a legitimate application. ### Claim 5 (depends on 1) The system of claim 1, wherein: at least some of the information regarding the destination of the outgoing communication comprises a phone number; and the entity associated with the destination of the outgoing communication is determined, based at least in part, on comparing: the phone number; and the data identifying a plurality of compromising entities, where the data comprises a plurality of phone numbers. ### Claim 6 (depends on 1) The system of claim 1, wherein the signal comprises instructions for the remote application to block the outgoing communication. ### Claim 7 (depends on 1) The system of claim 1, further comprising: a rules engine, where a rule of the rules engine must be satisfied before the signal may be sent; and wherein the processor is further operable to: determine that a rule associated with the rules engine applies, where the rule holds that only signals associated with threats above a threshold level of severity may be sent; and determine that the signal is associated with a threat above the threshold level of severity. ### Claim 8 A system, comprising: a memory operable to store: data identifying a plurality of compromising entities, where the data comprises at least one of a device identifier or a contact identifier; and a processor communicatively coupled to the memory and operable to: receive, from a remote application associated with a remote device and with the system, information regarding a pending outgoing communication, where the information comprises a MAC address associated with a destination of the outgoing communication; determine that an entity associated with the destination of the outgoing communication matches at least one of the plurality of compromising entities based, at least in part, on comparing: MAC addresses associated with the plurality of compromising entities; and the MAC address associated with the destination of the outgoing communication; and in response to determining that the entity associated with the destination of the outgoing communication matches at least one of the plurality of compromising entities, determine that the remote device is potentially compromised; send, to the remote application associated with the system, and before the outgoing communication is sent, an alert indicating that the destination of the outgoing communication matches a compromising entity; and send, to the remote application associated with the system, and before the outgoing communication is sent, a signal to: block a plurality of future communications sent from the remote device in response to determining that the remote device is potentially compromised; and disable one or more features of the remote device. ### Claim 9 (depends on 8) The system of claim 8, wherein the information is received as part of a communication formatted to be protected by at least one of one of SSL (secure sockets layer) and tokenization. ### Claim 10 (depends on 8) The system of claim 8, wherein the alert is sent as part of a communication formatted to be protected by at least one of one of SSL (secure sockets layer) and tokenization. ### Claim 11 (depends on 8) The system of claim 8, wherein the processor receives an authentication message confirming that the alert was received by a legitimate application. ### Claim 12 (depends on 8) The system of claim 8, wherein: at least some of the information regarding the destination of the outgoing communication comprises a phone number; and the entity associated with the destination of the outgoing communication is determined, based at least in part, on comparing: the phone number; and the data identifying a plurality of compromising entities, where the data comprises a plurality of phone numbers. ### Claim 13 (depends on 8) The system of claim 8, wherein the alert comprises instructions for the remote application to generate a second alert on the remote device. ### Claim 14 (depends on 8) The system of claim 8, further comprising: a rules engine, where a rule of the rules engine must be satisfied before the alert may be sent; and wherein the processor is further operable to: determine that a rule associated with the rules engine applies, where the rule holds that only alerts associated with threats above a threshold level of severity may be sent; and determine that the alert is associated with a threat above the threshold level of severity. ### Claim 15 A method, comprising: storing data identifying a plurality of compromising entities, where the data comprises at least one of a device identifier or a contact identifier; receiving, from a remote application associated with a remote device, information regarding a pending outgoing communication, where the information comprises a MAC address associated with a destination of the outgoing communication; determining that an entity associated with the destination of the outgoing communication matches at least one of the plurality of compromising entities based, at least in part, on comparing: MAC addresses associated with the plurality of compromising entities; and the MAC address associated with the destination of the outgoing communication; and in response to determining that the entity associated with the destination of the outgoing communication matches at least one of the plurality of compromising entities, determining that the remote device is potentially compromised; sending to the remote application associated with the remote device, and before the outgoing communication is sent, a signal configured to: block the outgoing communication, wherein the signal is further configured to block a plurality of future communications sent from the remote device in response to determining that the remote device is potentially compromised; and disable one or more features of the remote device. ### Claim 16 (depends on 15) The method of claim 15, wherein the information is received as part of a communication formatted to be protected by at least one of one of SSL (secure sockets layer) and tokenization. ### Claim 17 (depends on 15) The method of claim 15, wherein the signal is sent as part of a communication formatted to be protected by at least one of one of SSL (secure sockets layer) and tokenization. ### Claim 18 (depends on 15) The method of claim 15, further comprising: receiving an authentication message confirming that the signal was received by a legitimate application. ### Claim 19 (depends on 15) The method of claim 15, wherein the signal comprises instructions for the remote application to block the outgoing communication. ### Claim 20 (depends on 15) The method of claim 15, further comprising: storing a rules engine, where a rule of the rules engine must be satisfied before the signal may be sent; determine that a rule associated with the rules engine applies, where the rule holds that only signals associated with threats above a threshold level of severity may be sent; and determine that the signal is associated with a threat above the threshold level of severity.