US 10,764,318 B1Granted

Detection failure monitoring system

AssigneeUnited States Automobile Association (USAA)

InventorsRobert Jason Neel, Neelsen Cyrus

Life of this patent

Estimating the term…

Loading patent…

Abstract

The present disclosure relates generally to improved systems and methods for ensuring continued network security in a data network. More specifically, present embodiments are directed to detecting and responding to the failure of a security detection module employed for network security in the data network. A detection failure monitoring system may detect that a security detection module has failed by executing a number of test cases simulating conditions that should be flagged by the security detection module. To that end, when the detection failure monitoring system determines that a security detection module did not flag a condition produced by an executed test case, the detection failure monitoring system may implement a response to address the failed security detection module. Accordingly, the systems and techniques provided herein may maintain network security with improved granularity and robustness.

Claims20

Dependent claims

A network security system implemented in a data network, comprising:

one or more databases comprising information associated with a security detection module, wherein the information comprises a history of one or more revisions to the security detection module;
a non-transitory, machine-readable medium;
and
one or more processors configured to execute instructions stored in the non-transitory, machine-readable media to perform operations comprising:
generating a test case based on the information associated with the security detection module, wherein the security detection module is configured to flag a condition associated with execution of the test case;
executing the test case;
determining whether the security detection module has flagged the condition associated with the execution of the test case;
and
in response to determining that the security detection module failed to flag the condition associated with the execution of the test case:
modifying the security detection module based on the history of the one or more revisions to the security detection module;
and
updating the history of the one or more revisions to the security detection module based on modification of the security detection module made by the one or more processors.

9 more elements

A method for testing network security in a data network, wherein the network security comprises a security detection module, comprising:

retrieving, using one or more processors, a test case profile associated with a test case from one or more databases comprising information associated with a security detection module, wherein the information comprises a history of one or more revisions to the security detection module;
executing, using the one or more processors, the test case based on the test case profile, wherein the security detection module is configured to flag a condition associated with execution of the test case;
determining, using the one or more processors, a failure of the security detection module to flag the condition associated with the execution of the test case;
and
in response to determining the failure:
modifying, using the one or more processors, the security detection module based on the history of the one or more revisions to the security detection module;
and
updating, using the one or more processors, the history of the one or more revisions to the security detection module based on modification of the security detection module made by the one or more processors.

5 more elements

A tangible, non-transitory, computer-readable medium, comprising computer-readable instructions that, when executed by one or more network security processors of a data network, cause the one or more network security processors to:

generate a test case based on a security detection module profile associated with a security detection module and stored in one or more databases, wherein the security detection module is configured to flag a condition associated with execution of the test case;
execute the test case based on a test case profile associated with the test case and stored in the one or more databases;
determine whether the security detection module has flagged the condition associated with the execution of the test case;
in response to determining that the security detection module has failed to flag the condition associated with the execution of the test case, retrieve a response profile associated with a response from the one or more databases based on the security detection module profile, the test case profile, or a combination thereof;
implement the response based on the response profile, wherein the response is configured to correct a cause of the security detection module failing to flag the condition associated with the execution of the test case;
and
in response to determining that the security detection module has flagged the condition associated with the test case, halt execution of the test case.

4 more elements

Dependencies are inferred from the claim text.