# US 10,771,484 B2 · Integrated network intrusion detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,484 B2 - Document ID: US10771484B2 - Status: Granted - Kind: B2 - Application number: 15/982,318 - Filed: 2018-05-17 - Published: 2019-04-25 - Granted: 2020-09-08 - Earliest claimed: 2002-02-01 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Satyendra Yadav - Web page: https://patentgrep.com/patent/US10771484B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Intrusion preludes may be detected (including detection using fabricated responses to blocked network requests), and particular sources of network communications may be singled out for greater scrutiny, by performing intrusion analysis on packets blocked by a firewall. An integrated intrusion detection system uses an end-node firewall that is dynamically controlled using invoked-application information and a network policy. The system may use various alert levels to trigger heightened monitoring states, alerts sent to a security operation center, and/or logging of network activity for later forensic analysis. The system may monitor network traffic to block traffic that violates the network policy, monitor blocked traffic to detect an intrusion prelude, and monitor traffic from a potential intruder when an intrusion prelude is detected. The system also may track behavior of applications using the network policy to identify abnormal application behavior, and monitor traffic from an abnormally behaving application to identify an intrusion. ## Claims ### Claim 1 One or more non-transitory machine-readable media comprising a plurality of instructions stored thereon that, when executed, causes a compute device to: identify an application associated with a network flow; analyze communication statistics for network traffic associated with the application; configure, based on the statistical analysis of network traffic associated with the application, an application-specific network policy associated with the application, wherein the application-specific network policy includes one or more application-specific rules, wherein to configure, based on the statistical analysis of network traffic associated with the application, the application-specific network policy associated with the application comprises to auto-configure, based on the statistical analysis, a threshold for a number of requests indicative of abnormal behavior of the application; and apply the application-specific network policy to the network flow, wherein to apply the application-specific network policy to the network flow comprises to apply the one or more application-specific rules to the network flow. ### Claim 2 (depends on 1) The one or more non-transitory machine-readable media of claim 1, wherein the plurality of instructions further causes the compute device to: determine whether a number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application; and log, in response to a determination that the number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application, an indication that the number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application. ### Claim 3 (depends on 2) The one or more non-transitory machine-readable media of claim 2, wherein to analyze communication statistics for network traffic associated with the application comprises to analyze communication statistics for network traffic during a defined time window. ### Claim 4 (depends on 2) The one or more non-transitory machine-readable media of claim 2, wherein to determine, based on the statistical analysis, the threshold for the number of requests indicative of abnormal behavior of the application comprises to determine, based on the statistical analysis, a threshold for a number of requests of a certain type indicative of abnormal behavior of the application; wherein to determine whether the number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application comprises to determine whether a number of requests of the certain type of the network flow is past the threshold for the number of requests of the certain type indicative of abnormal behavior of the application; and wherein to log, in response to the determination that the number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application, the indication that the number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application comprises to log, in response to a determination that the number of requests of the certain type of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application, an indication that the number of requests of the network flow of the certain type is past the threshold for the number of requests of the certain type indicative of abnormal behavior of the application. ### Claim 5 (depends on 1) The one or more non-transitory machine-readable media of claim 1, wherein the plurality of instructions further causes the compute device to: receive the application-specific network policy from an administrator of the compute device, wherein the application-specific network policy includes an indication of the associated application; and save the application-specific network policy to storage on the compute device prior to the identification of the application associated with the network flow. ### Claim 6 (depends on 1) The one or more non-transitory machine-readable media of claim 1, wherein the application-specific network policy comprises an indication that packets associated with the application and with a certain destination port should be denied; wherein to apply the application-specific network policy to the network flow comprises to deny, based on the application-specific network policy, packets associated with the application and with the certain destination port. ### Claim 7 (depends on 1) The one or more non-transitory machine-readable media of claim 1, wherein the plurality of instructions further causes the compute device to: dynamically load the application-specific network policy from a remote repository to keep the application-specific network policy up to date. ### Claim 8 A compute device comprising at least one processor; and one or more memory devices having stored thereon a plurality of instructions that, when executed by the at least one processor, causes the compute device to: identify an application associated with a network flow; analyze communication statistics for network traffic associated with the application; configure, based on the statistical analysis of network traffic associated with the application, an application-specific network policy associated with the application, wherein the application-specific network policy includes one or more application-specific rules wherein to configure, based on the statistical analysis of network traffic associated with the application, the application-specific network policy associated with the application comprises to auto-configure, based on the statistical analysis, a threshold for a number of requests indicative of abnormal behavior of the application; and apply the application-specific network policy to the network flow, wherein to apply the application-specific network policy to the network flow comprises to apply the one or more application-specific rules to the network flow. ### Claim 9 (depends on 8) The compute device of claim 8, wherein the plurality of instructions further causes the compute device to: determine whether a number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application; and log, in response to a determination that the number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application, an indication that the number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application. ### Claim 10 (depends on 9) The compute device of claim 9, wherein to analyze communication statistics for network traffic associated with the application comprises to analyze communication statistics for network traffic during a defined time window. ### Claim 11 (depends on 9) The compute device of claim 9, wherein to determine, based on the statistical analysis, the threshold for the number of requests indicative of abnormal behavior of the application comprises to determine, based on the statistical analysis, a threshold for a number of requests of a certain type indicative of abnormal behavior of the application; wherein to determine whether the number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application comprises to determine whether a number of requests of the certain type of the network flow is past the threshold for the number of requests of the certain type indicative of abnormal behavior of the application; and wherein to log, in response to the determination that the number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application, the indication that the number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application comprises to log, in response to a determination that the number of requests of the certain type of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application, an indication that the number of requests of the network flow of the certain type is past the threshold for the number of requests of the certain type indicative of abnormal behavior of the application. ### Claim 12 (depends on 8) The compute device of claim 8, wherein the plurality of instructions further causes the compute device to: receive the application-specific network policy from an administrator of the compute device, wherein the application-specific network policy includes an indication of the associated application; and save the application-specific network policy to storage on the compute device prior to the identification of the application associated with the network flow. ### Claim 13 (depends on 8) The compute device of claim 8, wherein the application-specific network policy comprises an indication that packets associated with the application and with a certain destination port should be denied; wherein to apply the application-specific network policy to the network flow comprises to deny, based on the application-specific network policy, packets associated with the application and with the certain destination port. ### Claim 14 (depends on 8) The compute device of claim 8, wherein the plurality of instructions further causes the compute device to: dynamically load the application-specific network policy from a remote repository to keep the application-specific network policy up to date. ### Claim 15 A compute device comprising means for identifying an application associated with a network flow; means for analyzing communication statistics for network traffic associated with the application; means for configuring, based on the statistical analysis of network traffic associated with the application, an application-specific network policy associated with the application, wherein the application-specific network policy includes one or more application-specific rules, wherein the means for configuring, based on the statistical analysis of network traffic associated with the application, the application-specific network policy associated with the application comprises means for auto-configuring, based on the statistical analysis, a threshold for a number of requests indicative of abnormal behavior of the application; and means for applying the application-specific network policy to the network flow, wherein to apply the application-specific network policy to the network flow comprises to apply the one or more application-specific rules to the network flow. ### Claim 16 (depends on 15) The compute device of claim 15, further comprising: means for determining whether a number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application; and means for logging, in response to a determination that the number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application, an indication that the number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application. ### Claim 17 (depends on 16) The compute device of claim 16, wherein the means for analyzing communication statistics for network traffic associated with the application comprises means for analyzing communication statistics for network traffic during a defined time window. ### Claim 18 (depends on 16) The compute device of claim 16, wherein the means for determining, based on the statistical analysis, the threshold for the number of requests indicative of abnormal behavior of the application comprises means for determining, based on the statistical analysis, a threshold for a number of requests of a certain type indicative of abnormal behavior of the application; wherein the means for determining whether the number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application comprises means for determining whether a number of requests of the certain type of the network flow is past the threshold for the number of requests of the certain type indicative of abnormal behavior of the application; and wherein the means for logging, in response to the determination that the number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application, the indication that the number of requests of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application comprises means for logging, in response to a determination that the number of requests of the certain type of the network flow is past the threshold for the number of requests indicative of abnormal behavior of the application, an indication that the number of requests of the network flow of the certain type is past the threshold for the number of requests of the certain type indicative of abnormal behavior of the application. ### Claim 19 (depends on 15) The compute device of claim 15, further comprising: means for receiving the application-specific network policy from an administrator of the compute device, wherein the application-specific network policy includes an indication of the associated application; and means for saving the application-specific network policy to storage on the compute device prior to the identification of the application associated with the network flow. ### Claim 20 (depends on 15) The compute device of claim 15, wherein the application-specific network policy comprises an indication that packets associated with the application and with a certain destination port should be denied; wherein the means for applying the application-specific network policy to the network flow comprises means for denying, based on the application-specific network policy, packets associated with the application and with the certain destination port.