# US 10,872,148 B2 · System, method, and computer program product for isolating a device associated with at least potential data leakage activity, based on user input > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,872,148 B2 - Document ID: US10872148B2 - Status: Granted - Kind: B2 - Application number: 15/044,720 - Filed: 2016-02-16 - Published: 2016-08-25 - Granted: 2020-12-22 - Earliest claimed: 2007-08-29 - Assignees: McAfee, Inc. - Applicants: McAfee, LLC - Inventors: Srinivasan Sankararaman; Deepakeswaran Kolingivadi - Web page: https://patentgrep.com/patent/US10872148B2 ## CPC - G06F 21/554: {involving event detection and direct action} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/102: {Entity profiles} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 2221/034: Test or assess a computer or a system - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system, method, and computer program product are provided for isolating a device associated with at least potential data leakage activity, based on user input. In operation, at least potential data leakage activity associated with a device is identified. Furthermore, at least one action is performed to isolate the device, based on user input received utilizing a user interface. ## Claims ### Claim 1 A computer-implemented method for reducing an impact of data leakage activity in a network, comprising: generating, by executing an instruction with at least one processor of a first computer, a user prompt including choices for isolating a first node in the network, the user prompt generated in response to detecting a notification that indicates (a) a second computer detected a potential data leakage activity of the first node and (b) a suggested action for isolating the node, at least one of the choices including the suggested action, the first node different than the first computer and the second computer; determining, by executing an instruction with the at least one processor of the first computer, the first node is in a group of nodes; and in response to detecting the notification, forming an isolated group, by executing an instruction with the at least one processor of the first computer, by causing at least one device to enforce a policy to isolate the first node and ones of the group of nodes that have exhibited characteristics of the potential data leakage activity from the network, the policy including monitoring traffic flowing out of the isolated group to determine whether additional potential data leakage activity is present. ### Claim 2 (depends on 1) The method of claim 1, wherein the choices include an option for user selection representing an action to disable the first node. ### Claim 3 (depends on 1) The method of claim 1, wherein the choices include an option for user selection representing an action to disable an account associated with the first node. ### Claim 4 (depends on 1) The method of claim 1, wherein the choices include an option for user selection representing an action to lock the first node. ### Claim 5 (depends on 1) The method of claim 1, wherein the choices include an option for user selection representing an action to quarantine the first node. ### Claim 6 (depends on 1) The method of claim 1, wherein the first computer includes at least one physical computer. ### Claim 7 A storage device or storage medium comprising instructions that when executed cause a first computer to at least: in response to a notification that indicates (1) a second computer detected a potential data leakage activity on a first node in a network and (2) a suggested action for isolating the first node, generate a user prompt including choices for isolating the first node, at least one of the choices including the suggested action, the first node different than the first computer and the second computer; determine the first node is in a group of nodes; and in response to detecting the notification, form an isolated group by causing at least one device to enforce a policy to isolate the first node and ones of the group of nodes that have exhibited characteristics of the potential data leakage activity from the network, the policy including monitoring traffic flowing out of the isolated group to determine whether additional potential data leakage activity is present. ### Claim 8 (depends on 7) The storage device or storage medium of claim 7, wherein the choices include an option for user selection representing an action to disable the first node. ### Claim 9 (depends on 7) The storage device or storage medium of claim 7, wherein the choices include an option for user selection representing an action to disable an account associated with the first node. ### Claim 10 (depends on 7) The storage device or storage medium of claim 7, wherein the choices include an option for user selection representing an action to lock the first node. ### Claim 11 (depends on 7) The storage device or storage medium of claim 7, wherein the choices include an option for user selection representing an action to quarantine the first node. ### Claim 12 (depends on 7) The storage device or storage medium of claim 7, wherein the first computer includes at least one physical computer. ### Claim 13 (depends on 7) The storage device or storage medium of claim 7, wherein the first computer includes a mobile device. ### Claim 14 (depends on 13) The storage device or storage medium of claim 13, wherein the mobile device is mobile phone. ### Claim 15 A system, comprising: one or more processors of a first computer; and a memory, coupled to the one or more processors, including instructions that, when executed by the one or more processors, cause the one or more processors to at least: in response to a notification that indicates (1) a second computer detected a potential data leakage activity on a first node in a network and (2) a suggested action for isolating the first node, generate a user prompt including choices for isolating the first node, at least one of the choices including the suggested action, the first node different than the first computer and the second computer; determine the first node is in a group of nodes; and in response to detecting the notification, form an isolated group by causing at least one device to enforce a policy to isolate the first node and ones of the group of nodes that have exhibited characteristics of the potential data leakage activity from the network, the policy including monitoring traffic flowing out of the isolated group to determine whether additional potential data leakage activity is present. ### Claim 16 (depends on 15) The system of claim 15, wherein the choices include an option for user selection representing an action to disable the first node. ### Claim 17 (depends on 15) The system of claim 15, wherein the choices include an option for user selection representing an action to disable an account associated with the first node. ### Claim 18 (depends on 15) The system of claim 15, wherein the choices include an option for user selection representing an action to lock the first node. ### Claim 19 (depends on 15) The system of claim 15, wherein the choices include an option for user selection representing an action to quarantine the first node. ### Claim 20 (depends on 15) The system of claim 15, wherein the system includes a mobile device. ### Claim 21 (depends on 20) The system of claim 20, wherein the mobile device is mobile phone.