Preventing network attacks

A computer program product comprising program instructions stored on a non-transitory computer readable storage medium, wherein the computer readable storage medium is not a transitory signal per se, the program instructions executable by a processor to cause the processor to perform a method comprising:

• generating a usage profile for a computing device that accesses a network:
• determining a plurality of actual use real-time indicators for a network connection on the network;
• determining a plurality of expected use real-time indicators for the network connection;
• calculating a risk assessment value for the network connection by:
• comparing the actual use real-time indicators to the expected use real-time indicators;
• and
• increasing the risk assessment value when one of the actual use real-time indicators represents a greater use than a corresponding one of the expected use real-time indicators;
• and
• performing a security action for the network connection based on the calculated risk assessment value by sending a warning alert to a user of the computing device based on the risk assessment value comprising a relatively low level of the network attack risk;
• and
• dropping the network connection based on the risk assessment value comprising a relatively high value of network attack risk.

A system comprising:

• a computer processing circuit;
• and a non-transitory computer-readable storage medium storing instructions, which, when executed by the computer processing circuit, are configured to cause the computer processing circuit to perform a method comprising:
• generating a usage profile for a computing device that accesses a network;
• determining a plurality of actual use real-time indicators for a network connection on the network;
• determining a plurality of expected use real-time indicators for the network connection;
• calculating a risk assessment value for the network connection by:
• comparing the actual use real-time indicators to the expected use real-time indicators;
• and
• increasing the risk assessment value when one of the actual use real-time indicators represents a greater use than a corresponding one of the expected use real-time indicators;
• and
• performing a security action for the network connection based on the calculated risk assessment value by sending a warning alert to a user of the computing device based on the risk assessment value comprising a relatively low level of the network attack risk;
• and
• shutting down a port for the network connection based on the risk assessment value comprising a relatively high value of network attack risk.