Back to results
US 11,057,415 B1Granted
Systems and methods for dynamic zone protection of networks
AssigneeLookingglass Cyber Solutions, Inc.
InventorsBryan Wesley Brown, Paolo Fabio Zaino, Allan Thomson
Life of this patent
Estimating the term…
Abstract
Disclosed are systems and methods for securing a network using one or more controllers and one or more network nodes. A method may utilize a packet processing engine configured to process incoming network packets, a processing analysis engine configured to perform relatively more complex processing and analysis, and one or more controllers configured to coordinate one or more packet processing engines and one or more processing analysis engines across a network to perform endpoint threat detection and mitigation.
Claims20
A method of securing a network using one or more controllers and one or more network nodes, the method comprising:
- receiving data packets at a packet processing engine of a first network node of the network;
- forwarding, by the packet processing engine, the received data packets to one or more processing analysis engines of the first network node;
- retrieving, by the packet processing engine, one or more attributes associated with one or more predetermined data packets of interest;
- identifying and comparing, by the packet processing engine, one or more attributes of the received data packets to the one or more attributes associated with the one or more predetermined data packets of interest;
- processing, by the packet processing engine, the received data packets, a session associated with the received data packets, and/or a data flow associated with the received data packets based at least in part on the comparison;
- analyzing, by at least one processing analysis engine, the forwarded data packets, a session associated with the forwarded data packets, and/or a data flow associated with the forwarded data packets in parallel with the identifying and comparing step performed by the packet processing engine;
- and
- transmitting, by the at least one processing analysis engine, the analysis of the forwarded data packets, associated session, and/or associated data flow to the one or more controllers and/or one or more additional network nodes of the network;
- wherein the one or more controllers are configured to control the first network node to (i) update the one or more predetermined data packets of interests based on the received analysis and (ii) transmit one or more attributes associated with the updated one or more predetermined data packets of interest to the one or more additional network nodes and/or one or more agent nodes.
6 more elements
A system for securing a network, the system comprising:
- a first network node comprising a first packet processing engine and one or more processing analysis engines including a first processing analysis engine, wherein the first packet processing engine is configured to:
- receive and forward data packets to the first processing analysis engine,
- retrieve one or more attributes associated with one or more predetermined data packets of interest,
- identify and compare one or more attributes of the received data packets to the one or more attributes associated with the one or more predetermined data packets of interest, and
- process the received data packets, a session associated with the received data packets, and/or a data flow associated with the received data packets based at least in part on the comparison, and
- wherein the first processing analysis engine is configured to:
- analyze the forwarded data packets, a session associated with the forwarded data packets, and/or a data flow associated with the forwarded data packets in parallel with the identifying and comparing step performed by the first packet processing engine, and
- transmit the analysis of the forwarded data packets, associated session, and/or associated data flow to one or more controllers and/or one or more additional network nodes of the network;
- and
- one or more controllers configured to control at least the first network node to:
- (i) update the one or more predetermined data packets of interests based on the received analysis and (ii) transmit one or more attributes associated with the updated one or more predetermined data packets of interest to the one or more additional network nodes.
8 more elements
A system for a securing a network, the system comprising:
- an agent node configured to transmit one or more messages regarding a network connected device to a first processing analysis engine of a first network node and/or one or more controllers, wherein the network connected device is connected to the first network node of the network;
- the first network node comprising a first packet processing engine and one or more processing analysis engines including a first processing analysis engine, wherein the first packet processing engine is configured to:
- receive and forward a plurality of data packets to the first processing analysis engine,
- retrieve one or more attributes associated with one or more predetermined data packets of interest,
- identify and compare one or more attributes of the received data packets to the one or more attributes associated with the one or more predetermined data packets of interest, and
- process the received data packets, a session associated with the received data packets, and/or a data flow associated with the received data packets based at least in part on the comparison, and
- wherein the first processing analysis engine is configured to:
- analyze the forwarded data packet, a session associated with the forwarded data packets, and/or a data flow associated with the forwarded data packets at least based on the received one or more messages regarding the network connected device in parallel with the identifying and comparing step performed by the first packet processing engine, and
- transmit the analysis and/or the one or more messages regarding the network connected device to the one or more controllers;
- and
- the one or more controllers configured to control at least the first network node to:
- (i) update the one or more predetermined data packets of interests based on the received analysis and the one or more messages regarding the network connected device and (ii) transmit one or more attributes associated with the updated one or more predetermined data packets of interest to the one or more network nodes.
9 more elements
Dependencies are inferred from the claim text.