# US 10,484,418 B2 · Systems and methods for updating security policies for network traffic > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,418 B2 - Document ID: US10484418B2 - Status: Granted - Kind: B2 - Application number: 15/606,468 - Filed: 2017-05-26 - Published: 2018-11-29 - Granted: 2019-11-19 - Earliest claimed: 2017-05-26 - Assignees: ShieldX Networks, Inc. - Applicants: ShieldX Networks, Inc. - Inventors: Ratinder Paul Singh Ahuja; Manuel Nedbal - Web page: https://patentgrep.com/patent/US10484418B2 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/105: {Multiple levels of security} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and apparatuses enable updating security policies in response to detecting attack activity or security threats. In an embodiment, security microservices detect attack activity sent between resources within an internal network. In response, the security microservices correlate the attack activity to externally accessible resources that were the initial entry point for the attack activity to the internal network. Based on this correlation, the security microservices update security policies bi-directionally to prevent the spread of future attack activity in the internal network between resources at a same level in the internal network and between resources at different levels in the internal network. ## Claims ### Claim 1 A computer-implemented method to update a security policy, the method comprising: monitoring network traffic using a plurality of microservices; detecting that the monitored network traffic indicates activity directed to a first externally accessible resource at a first level of resources in an internal network, the activity directed from a second externally accessible resource at the first level of resources in the internal network, the first and second externally accessible resources reachable via an interface configured to receive the network traffic from outside the internal network; in response to detecting the network traffic indicates the activity directed to the first externally accessible resource at the first level of resources in the internal network, correlating the activity with the second externally accessible resource; determining internally accessible resources at a second level of resources in the internal network associated with the second externally accessible resource at the first level of resources in the internal network, the internally accessible resources not reachable directly from an external network; updating a security policy associated with the internally accessible resources, the security policy regarding communications from externally accessible resources at the first level of resources in the internal network to the internally accessible resources at the second level of resources in the internal network; and applying the updated security policy to subsequent network traffic directed to the internally accessible resources. ### Claim 2 (depends on 1) The method of claim 1, wherein monitoring the network traffic using the plurality of microservices comprises: intercepting the network traffic directed to the first externally accessible resource at an interface microservice associated with a security microservice prior to the network traffic being received by the first externally accessible resource. ### Claim 3 (depends on 1) The method of claim 1, wherein detecting that the monitored network traffic indicates the activity directed to the first externally accessible resource at the first level of resources in the internal network comprises: determining that the activity directed to the first externally accessible resource violates a security policy for communications from a first resource at the first level of resources in the internal network to a second resource at the first level of resources in the internal network. ### Claim 4 (depends on 1) The method of claim 1, wherein correlating the activity with an externally accessible resource comprises: traversing a path of the activity through the internal network to determine the externally accessible resource interfacing with the external network; and indicating the determined externally accessible resource is in a compromised state. ### Claim 5 (depends on 1) The method of claim 1, further comprising: updating the security policy associated with the externally accessible resources, the security policy regarding communications between externally accessible resources. ### Claim 6 (depends on 1) The method of claim 1, wherein applying the updated security policy comprises one or both of configuring a new security microservice and reconfiguring an existing security microservice. ### Claim 7 One or more non-transitory computer-readable storage media storing instructions which, when executed by one or more hardware processors, cause performance of a method to update a security policy, the method comprising: monitoring network traffic using a plurality of microservices; detecting that the monitored network traffic indicates activity directed to a first externally accessible resource at a first level of resources in an internal network, the activity directed from a second externally accessible resource at the first level of resources in the internal network, the first and second externally accessible resources reachable via an interface configured to receive the network traffic from outside the internal network; in response to detecting the network traffic indicates the activity directed to the first externally accessible resource at the first level of resources in the internal network, correlating the activity with the second externally accessible resource; determining internally accessible resources at a second level of resources in the internal network associated with the second externally accessible resource at the first level of resources in the internal network, the internally accessible resources not reachable directly from an external network; updating the security policy associated with the internally accessible resources, the security policy regarding communications from externally accessible resources at the first level of resources in the internal network to the internally accessible resources at the second level of resources in the internal network; and applying the updated security policy to subsequent network traffic directed to the internally accessible resources. ### Claim 8 (depends on 7) The one or more non-transitory computer-readable storage media of claim 7, wherein monitoring the network traffic using the plurality of microservices comprises: intercepting the network traffic directed to the first externally accessible resource at an interface microservice associated with a security microservice prior to the network traffic being received by the first externally accessible resource. ### Claim 9 (depends on 7) The one or more non-transitory computer-readable storage media of claim 7, wherein detecting that the monitored network traffic indicates the activity directed to the first externally accessible resource at the first level of resources in the internal network comprises: determining that the activity directed to the first externally accessible resource violates a security policy for communications from a first resource at the first level of resources in the internal network to a second resource at the first level of resources in the internal network. ### Claim 10 (depends on 7) The one or more non-transitory computer-readable storage media of claim 7, wherein correlating the activity with an externally accessible resource comprises: traversing a path of the activity through the internal network to determine the externally accessible resource interfacing with the external network; and indicating the determined externally accessible resource is in a compromised state. ### Claim 11 (depends on 7) The one or more non-transitory computer-readable storage media of claim 7, further comprising: updating the security policy associated with the externally accessible resources, the security policy regarding communications between the externally accessible resources. ### Claim 12 (depends on 7) The one or more non-transitory computer-readable storage media of claim 7, wherein applying the updated security policy comprises one or both of configuring a new security microservice and reconfiguring an existing security microservice. ### Claim 13 An apparatus, comprising: one or more hardware processors; memory coupled to the one or more hardware processors, the memory storing instructions which, when executed by the one or more hardware processors, causes the apparatus to: monitor network traffic using a plurality of microservices; detect that the monitored network traffic indicates activity directed to a first externally accessible resource at a first level of resources in an internal network, the activity directed from a second externally accessible resource at the first level of resources in the internal network, the first and second externally accessible resources reachable via an interface configured to receive the network traffic from outside the internal network; in response to detecting the network traffic indicates the activity directed to the first externally accessible resource at the first level of resources in the internal network, correlate the activity with the second externally accessible resource; determine internally accessible resources at a second level of resources in the internal network associated with the second externally accessible resource at the first level of resources in the internal network, the internally accessible resources not reachable directly from an external network; update a security policy associated with the internally accessible resources, the security policy regarding communications from externally accessible resources at the first level of resources in the internal network to the internally accessible resources at the second level of resources in the internal network; and apply the updated security policy to subsequent network traffic directed to the internally accessible resources. ### Claim 14 A computer-implemented method to update a security policy, the method comprising: monitoring network traffic using a plurality of microservices; detecting that the monitored network traffic indicates activity directed to an internally accessible resource at a second level of resources in an internal network, the activity directed from an externally accessible resource at a first level of resources in the internal network, the internally accessible resource not reachable directly from an external network; in response to detecting the network traffic indicates the activity directed to the internally accessible resource, correlating the activity with the externally accessible resource; determining externally accessible resources at the first level of resources in the internal network associated with the internally accessible resource at the second level of resources in the internal network, the externally accessible resources reachable via an interface configured to receive the network traffic from outside the internal network; updating the security policy associated with the externally accessible resources, the security policy regarding communications between externally accessible resources; and applying the updated security policy to subsequent network traffic directed to the externally accessible resources. ### Claim 15 (depends on 14) The method of claim 14, wherein monitoring the network traffic using the plurality of microservices comprises: intercepting the network traffic directed to the internally accessible resource at an interface microservice associated with a security microservice prior to the network traffic being received by the internally accessible resource. ### Claim 16 (depends on 14) The method of claim 14, wherein detecting that the monitored network traffic indicates the activity directed to the internally accessible resource at the second level of resources in the internal network comprising: determining that the activity directed to the internally accessible resource violates a security policy for communications from a first resource at the first level of resources in the internal network to a second resource at the second level of resources in the internal network. ### Claim 17 (depends on 14) The method of claim 14, wherein correlating the activity with the externally accessible resource comprises: traversing a path of the activity through the internal network to determine the externally accessible resource interfacing with the external network; and indicating the determined externally accessible resource is in a compromised state. ### Claim 18 (depends on 14) The method of claim 14, further comprising: updating the security policy associated with internally accessible resources, the security policy regarding communications from the externally accessible resources to the internally accessible resources. ### Claim 19 (depends on 14) The method of claim 14, wherein applying the updated security policy comprises one or both of configuring a new security microservice and reconfiguring an existing security microservice. ### Claim 20 One or more non-transitory computer-readable storage media storing instructions which, when executed by one or more hardware processors, cause performance of a method to update a security policy, the method comprising: monitoring network traffic using a plurality of microservices; detecting that the monitored network traffic indicates activity directed to an internally accessible resource at a second level of resources in an internal network, the activity directed from an externally accessible resource at a first level of resources in the internal network, the internally accessible resource not reachable directly from an external network; in response to detecting the network traffic indicates the activity directed to the internally accessible resource, correlating the activity with the externally accessible resource; determining externally accessible resources at the first level of resources in the internal network associated with the internally accessible resource at the second level of resources in the internal network, the externally accessible resources reachable via an interface configured to receive the network traffic from outside the internal network; updating the security policy associated with the externally accessible resources, the security policy regarding communications between externally accessible resources; and applying the updated security policy to subsequent network traffic directed to the externally accessible resources. ### Claim 21 (depends on 20) The one or more non-transitory computer-readable storage media of claim 20, wherein monitoring the network traffic using the plurality of microservices comprises: intercepting the network traffic directed to the internally accessible resource at an interface microservice associated with a security microservice prior to the network traffic being received by the internally accessible resource. ### Claim 22 (depends on 20) The one or more non-transitory computer-readable storage media of claim 20, wherein detecting that the monitored network traffic indicates the activity directed to the internally accessible resource at the second level of resources in the internal network comprising: determining that the activity directed to the internally accessible resource violates a security policy for communications from a first resource at the first level of resources in the internal network to a second resource at the second level of resources in the internal network. ### Claim 23 (depends on 20) The one or more non-transitory computer-readable storage media of claim 20, wherein correlating the activity with the externally accessible resource comprises: traversing a path of the activity through the internal network to determine the externally accessible resource interfacing with the external network; and indicating the determined externally accessible resource is in a compromised state. ### Claim 24 (depends on 20) The one or more non-transitory computer-readable storage media of claim 20, further comprising: updating the security policy associated with internally accessible resources, the security policy regarding communications from the externally accessible resources to the internally accessible resources. ### Claim 25 (depends on 20) The one or more non-transitory computer-readable storage media of claim 20, wherein applying the updated security policy comprises one or both of configuring a new security microservice and reconfiguring an existing security microservice. ### Claim 26 An apparatus, comprising: one or more hardware processors; memory coupled to the one or more hardware processors, the memory storing instructions which, when executed by the one or more hardware processors, causes the apparatus to: monitor network traffic using a plurality of microservices; detect that the monitored network traffic indicates activity directed to an internally accessible resource at a second level of resources in an internal network, the activity directed from an externally accessible resource at a first level of resources in the internal network, the internally accessible resource not reachable directly from an external network; in response to detecting the network traffic indicates the activity directed to the internally accessible resource, correlate the activity with the externally accessible resource; determine externally accessible resources at the first level of resources in the internal network associated with the internally accessible resource at the second level of resources in the internal network, the externally accessible resources reachable via an interface configured to receive the network traffic from outside the internal network; update a security policy associated with the externally accessible resources, the security policy regarding communications between externally accessible resources; and apply the updated security policy to subsequent network traffic directed to the externally accessible resources.