# US 11,310,201 B2 · Network security system with enhanced traffic analysis based on feedback loop > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,201 B2 - Document ID: US11310201B2 - Status: Granted - Kind: B2 - Application number: 16/168,451 - Filed: 2018-10-23 - Published: 2020-04-23 - Granted: 2022-04-19 - Earliest claimed: 2018-10-23 - Assignees: Akamai Technologies, Inc. - Applicants: Akamai Technologies, Inc. - Inventors: Eugene (“John”) Neystadt; Eyal Heiman; Elisha Ben-Zvi; Asaf Nadler - Web page: https://patentgrep.com/patent/US11310201B2 ## CPC - H04L 63/0245: {Filtering by information in the payload} - G06N 20/00: Machine learning - H04L 45/74: Address processing for routing - H04L 47/263: Rate modification at the source after receiving feedback - H04L 61/4511: using domain name system [DNS] - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/101: {Access control lists [ACL]} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/168: {above the transport layer} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract This document describes among other things, network security systems that incorporate a feedback loop so as to automatically and dynamically adjust the scope of network traffic that is subject to inspection. Risky traffic can be sent for inspection; risky traffic that is demonstrated to have high rate of threats can be outright blocked without further inspection; traffic that is causing errors due to protocol incompatibility or should not be inspected for regulatory or other reasons can be flagged so it bypasses the security inspection system. The system can operate on a domain by domain basis, IP address basis, or otherwise. ## Claims ### Claim 1 A system for automatically adjusting the scope of network traffic that is subject to security inspection, comprising: a first network device that in operation provides request routing of client requests, said request routing including directing, according to a first configuration, at least some client requests to a second network device for inspection, and that in operation produces first logs of the request routing performed by the first network device; a second network device that in operation receives client requests routed by the first network device to the second network device for inspection, and inspects for network security threats at least one of: (i) the client requests and (ii) responses to the client requests generated by a remote host, said inspection being performed according to a second configuration at the second network device; the second network device in operation producing second logs of the results of the inspections; a feedback analysis system that in operation receives the first logs and the second logs, and based on processing thereof produces at least one adjustment to at least one of the first configuration and the second configuration, said at least one adjustment comprising: an indication of network traffic to whitelist at the first network device, where said network traffic was previously routed to the second network device for inspection; wherein said at least one adjustment is based on at least one of the following: (a) a determination by the feedback analysis system that inspected network traffic is associated with an incidence of errors that exceeds a threshold and therefore is deemed incompatible with inspection, and (b) a determination by the feedback analysis system that inspected network traffic is associated with an incidence of sensitive data that exceeds a threshold, and therefore the inspected network traffic is deemed sensitive network traffic; the first network device, the second network device, and the feedback analysis system comprising one or more or hardware processors and memory storing computer program instructions to operate the first network device, the second network device, and the feedback analysis system as specified above. ### Claim 2 (depends on 1) The system of claim 1, wherein the indication of network traffic comprises any of: a list of domain names and a list of IP addresses. ### Claim 3 (depends on 1) The system of claim 1, wherein said at least one adjustment further comprises: an indication of network traffic that should be blocked at the first network device, where said network traffic was previously routed to the second network device for inspection; wherein the at least one adjustment is based on a determination by the feedback analysis system that inspected network traffic exhibits an incidence of security violations that exceeds a threshold. ### Claim 4 (depends on 1) The system of claim 1, wherein said at least one adjustment is associated with an expiration time. ### Claim 5 (depends on 1) The system of claim 1, wherein the first network device comprises a DNS server. ### Claim 6 (depends on 1) The system of claim 1, wherein the second network device comprises a network security gateway. ### Claim 7 (depends on 1) The system of claim 1, wherein the first network device and the second network device each comprise a multi-tenant device, and the first configuration and the second configuration are each associated with a first tenant and applicable to traffic associated with the first tenant, the first and second network devices operable to store third and fourth configurations, respectively, that are each associated with a second tenant. ### Claim 8 (depends on 7) The system of claim 7, wherein the first tenant comprises any of: a particular enterprise and a particular internet service provider. ### Claim 9 (depends on 1) The system of claim 1, wherein at least one of the first configuration and the second configuration comprises any of: a list of domain names and a list of IP addresses. ### Claim 10 (depends on 1) The system of claim 1, wherein the feedback analysis system comprises a machine learning component that ingests data derived from the first and second logs to produce said at least one adjustment, which further comprises: an indication of network traffic that the first network device should route to the second network device for inspection. ### Claim 11 A method for automatically adjusting the scope of network traffic that is subject to security inspection by a network security system that has one or more computers comprising one or more or hardware processors and memory storing computer program instructions to perform the method, the method comprising: providing request routing of client requests, said request routing including directing, according to a first configuration, at least some client requests to a network device for inspection; producing first logs of the request routing performed; receiving client requests routed to the network device for inspection, and inspecting for network security threats at least one of: (i) the client requests and (ii) responses to the client requests generated by a remote host, said inspection being performed according to a second configuration; producing second logs of the results of the inspections; receiving the first logs and the second logs, and based on processing thereof producing at least one adjustment to at least one of the first configuration and the second configuration, said at least one adjustment comprising: an indication of network traffic to whitelist, where said network traffic was previously routed to the network device for inspection, and wherein said at least one adjustment is based on at least one of: (a) a determination that inspected network traffic is associated with an incidence of errors that exceeds a threshold and therefore is deemed incompatible with inspection, and (b) a determination that inspected network traffic is associated with an incidence of sensitive data that exceeds a threshold, and therefore the inspected network traffic is deemed sensitive network traffic. ### Claim 12 (depends on 11) The method of claim 11, wherein the indication of network traffic comprises any of: a list of domain names and a list of IP addresses. ### Claim 13 (depends on 11) The method of claim 11, wherein said at least one adjustment further comprises: an indication of network traffic that should be blocked, where said network traffic was previously routed to the network device for inspection; wherein the at least one adjustment is based on a determination that inspected network traffic exhibits an incidence of security violations that exceeds a threshold. ### Claim 14 (depends on 11) The method of claim 11, wherein the at least one adjustment is associated with an expiration time. ### Claim 15 (depends on 11) The method of claim 11, wherein the requesting routing is provided by a DNS server. ### Claim 16 (depends on 11) The method of claim 11, wherein the network device comprises a network security gateway. ### Claim 17 (depends on 11) The method of claim 11, wherein the first configuration and the second configuration are each associated with a first tenant among a plurality of tenants and applicable to traffic associated with the first tenant. ### Claim 18 (depends on 11) The method of claim 11, wherein at least one of the first configuration and the second configuration comprises any of: a list of domain names and a list of IP addresses. ### Claim 19 (depends on 11) The method of claim 11, wherein the network security system uses a machine learning component to ingest data derived from the first and second logs to produce the at least one adjustment, which further comprises: an indication of network traffic that should be routed to the network device for inspection.