# US 10,313,367 B2 · Method and system for network access control based on traffic monitoring and vulnerability detection using process related information > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,367 B2 - Document ID: US10313367B2 - Status: Granted - Kind: B2 - Application number: 15/527,783 - Filed: 2015-12-18 - Published: 2017-11-23 - Granted: 2019-06-04 - Earliest claimed: 2014-12-18 - Assignees: Sophos Limited - Applicants: Sophos Limited - Inventors: Jimit Hareshkumar Mahadevia; Shalvi D. Dave; Bhushan H. Trivedi - Web page: https://patentgrep.com/patent/US10313367B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/554: {involving event detection and direct action} - H04L 63/0263: {Rule management} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Disclosed are various embodiments of method and system for network access control. The method may involve traffic monitoring and vulnerability detection using process information. The system may analyze the vulnerability as a process malfunctioning where preventive action focuses on process blocking as opposed to host blocking, which can lead to improved performance and productivity of a network. Techniques may use process related information, connection information, and network packet information for network control. The information may be matched against a plurality of signatures to identify and detect a known vulnerability in network activities. On the basis of a match, a verification report may be established. Techniques may further check whether a verification report is applicable to a process associated with a network packet and allow or block the process running on the host based in the report. ## Claims ### Claim 1 A system for network access control based on traffic monitoring and vulnerability detection using process related information, the system comprising: computer executable code embodied in a non-transitory computer readable medium that, when executing one or more processors provide a plurality of process intercepting units, a pattern matching unit, and an intrusion prevention unit, a plurality of devices for receiving at least one connection request from a process running on a host, each of the plurality of devices comprising a process intercepting unit of the plurality of process intercepting units configured for extracting the process related information and forwarding information including one or more of process related information, connection information, and network packet information, the pattern matching unit configured for receiving the information from the process intercepting unit and forwarding the information; and the intrusion prevention unit configured for receiving the information from the pattern matching unit, the intrusion prevention unit including a processing unit and a database, the database including a plurality of signatures defining a set of rules to detect attacks or intrusive activities on a network that can occur through the process, the plurality of signatures prepared based on information relating to the process, the intrusion prevention unit further configured to verify the information from the pattern matching unit against the plurality of signatures stored in the database to identify and detect a known vulnerability in network activities, establish a verification report based on the known vulnerability, and send the verification report to the pattern matching unit, wherein the pattern matching unit is further configured to receive the verification report from the intrusion prevention unit, verify whether the verification report is applicable to the process associated with network packet by matching a first signature identification code in the verification report with a second signature identification code stored in an application process information database, and send an authorization decision to the process intercepting unit regarding allowing continuing or blocking of the connection request from the process running on the host. ### Claim 2 (depends on 1) The system of claim 1 wherein the process related information includes a process name and a process version. ### Claim 3 (depends on 1) The system of claim 1 wherein the each of the plurality of signatures includes a unique signature identification code. ### Claim 4 (depends on 1) The system of claim 1 wherein the first signature identification code in the verification report includes a unique signature identification code. ### Claim 5 (depends on 4) The system of claim 4 wherein the application process information database stores a unique signature identification code, a signature name, an applicable process name, and an applicable process version for each of a plurality of application processes. ### Claim 6 (depends on 1) The system of claim 1 wherein the process intercepting unit of one of the plurality of devices is further configured for disallowing only the process and not the host for communication if the authorization decision indicates a matching of the first signature identification code mentioned in the verification report with the second signature identification code stored in an application process information database. ### Claim 7 (depends on 1) The system of claim 1 wherein the pattern matching unit is deployed in an inline mode. ### Claim 8 (depends on 1) The system of claim 1 wherein the pattern matching unit is deployed in an out of band mode. ### Claim 9 A method for network access control based on traffic monitoring and vulnerability detection using process related information, the method comprising: receiving, by a device, at least one connection request from a process running on a host; extracting, by a process intercepting unit of the device, process related information; forwarding, by the process intercepting unit to a pattern matching unit, information including one or more of process related information, connection information, and network packet information; receiving, by the pattern matching unit, the information from the process intercepting unit and forwarding the to an intrusion prevention unit; receiving, by the intrusion prevention unit, the information from the pattern matching unit; verifying, by the intrusion prevention unit, the information against a plurality of signatures stored in a database of the intrusion prevention unit to identify and detect a known vulnerability in network activity; establishing, by the intrusion prevention unit, a verification report based on verification of the information against the plurality of signatures; sending, by the intrusion prevention unit, the verification report to the pattern matching unit; receiving, by the pattern matching unit, the verification report from the intrusion prevention unit; verifying, by the pattern matching unit, whether the verification report is applicable to the process associated with a network packet by matching a first signature identification code in the verification report with a second signature identification code stored in an application process information database; and sending, by the pattern matching unit, an authorization decision to the process intercepting unit regarding continuing or blocking of the connection request from the process running on the host. ### Claim 10 (depends on 9) The method of claim 9 wherein the process related information includes a process name and a process version. ### Claim 11 (depends on 9) The method of claim 9 wherein the one of the plurality of signatures defines a set of rules to detect attacks or intrusive activities on a network that can occur through the process, and wherein the one of the plurality of signatures is prepared based on information relating to the process. ### Claim 12 (depends on 11) The method of claim 11 wherein each of the plurality of signatures includes a unique signature identification code. ### Claim 13 (depends on 12) The method of claim 12 wherein the first signature identification code in the verification report includes a unique signature identification code. ### Claim 14 (depends on 12) The method of claim 12 wherein the application process information database contains a unique signature identification code, a signature name, an applicable process name, and an applicable process version for each of a plurality of application processes. ### Claim 15 (depends on 14) The method of claim 14 further comprising disallowance, by the process intercepting unit, of the process and not the host for communication, if an authorization decision indicates matching of the first signature identification code mentioned in the verification report with the second signature identification code stored in the application process information database. ### Claim 16 (depends on 9) The method of claim 9 wherein the pattern matching unit is deployed in an inline mode. ### Claim 17 (depends on 9) The method of claim 9 wherein the pattern matching unit is deployed in an out of band mode.