# US 10,771,436 B2 · Dynamic whitelist management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,771,436 B2
- Document ID: US10771436B2
- Status: Granted
- Kind: B2
- Application number: 15/946,907
- Filed: 2018-04-06
- Published: 2019-10-10
- Granted: 2020-09-08
- Earliest claimed: 2018-04-06
- Assignees: Cisco Technology, Inc.
- Applicants: Cisco Technology, Inc.
- Inventors: Robert Thomas Taylor; M. David Hanes; Nikhil Sainath Kale; Ana Perić
- Web page: https://patentgrep.com/patent/US10771436B2

## CPC

- H04L 63/0281: {Proxies}
- H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)}
- G06N 20/00: Machine learning
- H04L 63/0245: {Filtering by information in the payload}
- H04L 63/0254: {Stateful filtering}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

In one example embodiment, a proxy for a network obtains a traffic flow. The proxy determines whether a security policy in a whitelist for the traffic flow is active. If it is determined that the security policy for the traffic flow is active, the proxy selectively decrypts the traffic flow to produce one or more traffic flow attributes and, based on the one or more traffic flow attributes, determines whether the traffic flow is potentially malicious.

## Claims

### Claim 1

A method comprising:
at a proxy for a network:
obtaining a traffic flow;
determining whether a security policy in a whitelist for the traffic flow is active; and
if it is determined that the security policy for the traffic flow is active:
selectively decrypting the traffic flow to produce one or more traffic flow attributes;
based on the one or more traffic flow attributes, determining whether the traffic flow is potentially malicious;
in response to determining that the traffic flow is potentially malicious, deactivating the security policy for the traffic flow; and
in response to deactivating the security policy for the traffic flow, decrypting one or more subsequent traffic flows.

### Claim 2 (depends on 1)

The method of claim 1, wherein selectively decrypting the traffic flow includes randomly or periodically decrypting the traffic flow.

### Claim 3 (depends on 1)

The method of claim 1, wherein selectively decrypting the traffic flow includes selectively decrypting the traffic flow based on a machine learning process.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
at the proxy:
if it is determined that the security policy for the traffic flow is active:
using the one or more traffic flow attributes to train a machine learning process for determining whether future traffic flows are potentially malicious.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
at the proxy:
if it is determined that the security policy for the traffic flow is inactive:
monitoring the traffic flow for anomalies to determine whether to selectively decrypt the traffic flow.

### Claim 6 (depends on 1)

The method of claim 1, wherein the traffic flow is an outbound traffic flow sent by a client in the network to an entity external to the network.

### Claim 7 (depends on 1)

The method of claim 1, wherein the one or more traffic flow attributes include a source port.

### Claim 8

An apparatus comprising:
a memory that stores whitelist data for a whitelist;
a network interface that enables network communication; and
one or more processors coupled to the memory and the network interface, wherein the one or more processors are configured to:
obtain a traffic flow;
determine whether a security policy in the whitelist for the traffic flow is active; and
if it is determined that the security policy for the traffic flow is active:
selectively decrypt the traffic flow to produce one or more traffic flow attributes;
based on the one or more traffic flow attributes, determine whether the traffic flow is potentially malicious;
in response to determining that the traffic flow is potentially malicious, deactivate the security policy for the traffic flow; and
in response to deactivating the security policy for the traffic flow, decrypt one or more subsequent traffic flows.

### Claim 9 (depends on 8)

The apparatus of claim 8, wherein the one or more processors are configured to selectively decrypt the traffic flow by randomly or periodically decrypting the traffic flow.

### Claim 10 (depends on 8)

The apparatus of claim 8, wherein the one or more processors are configured to selectively decrypt the traffic flow based on a machine learning process.

### Claim 11 (depends on 8)

The apparatus of claim 8, wherein the one or more processors are further configured to:
if it is determined that the security policy for the traffic flow is active:
use the one or more traffic flow attributes to train a machine learning process for determining whether future traffic flows are potentially malicious.

### Claim 12 (depends on 8)

The apparatus of claim 8, wherein the one or more processors are further configured to:
if it is determined that the security policy for the traffic flow is inactive:
monitor the traffic flow for anomalies to determine whether to selectively decrypt the traffic flow.

### Claim 13 (depends on 8)

The apparatus of claim 8, wherein the traffic flow is an outbound traffic flow sent by a client in a network to an entity external to the network.

### Claim 14 (depends on 8)

The apparatus of claim 8, wherein the one or more traffic flow attributes include a source port.

### Claim 15

One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor, cause the processor to:
obtain a traffic flow;
determine whether a security policy in a whitelist for the traffic flow is active; and
if it is determined that the security policy for the traffic flow is active:
selectively decrypt the traffic flow to produce one or more traffic flow attributes;
based on the one or more traffic flow attributes, determine whether the traffic flow is potentially malicious;
in response to determining that the traffic flow is potentially malicious, deactivate the security policy for the traffic flow; and
in response to deactivating the security policy for the traffic flow, decrypt one or more subsequent traffic flows.

### Claim 16 (depends on 15)

The one or more non-transitory computer readable storage media of claim 15, wherein the instructions that cause the processor to selectively decrypt the traffic flow include instructions that cause the processor to randomly or periodically decrypt the traffic flow.

### Claim 17 (depends on 15)

The one or more non-transitory computer readable storage media of claim 15, wherein the instructions that cause the processor to selectively decrypt the traffic flow include instructions that cause the processor to selectively decrypt the traffic flow based on a machine learning process.

### Claim 18 (depends on 15)

The one or more non-transitory computer readable storage media of claim 15, wherein the instructions further cause the processor to:
if it is determined that the security policy for the traffic flow is active:
use the one or more traffic flow attributes to train a machine learning process for determining whether future traffic flows are potentially malicious.

### Claim 19 (depends on 15)

The one or more non-transitory computer readable storage media of claim 15, wherein the instructions further cause the processor to:
if it is determined that the security policy for the traffic flow is inactive:
monitor the traffic flow for anomalies to determine whether to selectively decrypt the traffic flow.

### Claim 20 (depends on 15)

The one or more non-transitory computer readable storage media of claim 15, wherein the traffic flow is an outbound traffic flow sent by a client in a network to an entity external to the network.