# US 11,310,263 B1 · Rogue foothold network defense > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,263 B1 - Document ID: US11310263B1 - Status: Granted - Kind: B1 - Application number: 16/855,649 - Filed: 2020-04-22 - Granted: 2022-04-19 - Earliest claimed: 2017-04-24 - Assignees: Wells Fargo Bank, N.A. - Applicants: Wells Fargo Bank, N.A. - Inventors: Matthew J. Block; Jon M. Welborn; Adam Sheesley; David Huehulani Keene; Jennifer A. Holton; Douglas S. Rodgers - Web page: https://patentgrep.com/patent/US11310263B1 ## CPC - H04L 41/142: using statistical or mathematical methods - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 41/0681: Configuration of triggering conditions - H04L 41/0816: the condition being an adaptation, e.g. in response to network events - H04L 41/16: using machine learning or artificial intelligence - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The innovation disclosed and claimed herein, in one aspect thereof, comprises systems and methods of reconfiguring network settings. The systems and methods monitor a network and detect a hacker on a network. The systems and methods can reconfigure network settings of the network upon detecting the hacker. The systems and methods can analyze the hack for severity; and determine a reconfiguration layer based on the severity of the hack. The reconfiguration layer determines a subset of the network settings to be reconfigured. The systems and methods can dismantle the network and generate a replacement network having the reconfigured set of network settings and replace the network with the replacement network. ## Claims ### Claim 1 A method, comprising: detecting a foothold event at a first network segment, wherein the first network segment includes a set of network settings; analyzing the foothold event upon detecting the foothold event; determining a severity score based on the analysis of the foothold event; comparing the severity score to two or more score tiers; matching the severity score to one score tier of the two or more score tiers based on the comparison; determining a reconfiguration layer based on the matched score tier; reconfiguring at least part of the set of network settings of the first network segment based on the determined reconfiguration layer; and generating a second network segment having the reconfigured set of network settings that replaces the first network segment. ### Claim 2 (depends on 1) The method of claim 1, wherein the reconfiguration layer determines a subset of network settings of the set of network settings to be reconfigured. ### Claim 3 (depends on 1) The method of claim 1, comprising: dismantling the first network segment; and replacing the first network segment with the second network segment. ### Claim 4 (depends on 3) The method of claim 3, comprising: storing node communication information for the first network segment; rebuilding communication paths between at least two nodes for the second network segment using the node communication information, wherein the at least two nodes originally communicated with each other via the first network segment. ### Claim 5 (depends on 1) The method of claim 1, wherein the reconfiguring comprises: receiving a standardized set of network settings from a configuration server. ### Claim 6 (depends on 5) The method of claim 5, wherein the reconfiguring comprises: machine learning network settings across a network; and customizing the set of network settings according to machine learned settings on the configuration server. ### Claim 7 (depends on 1) The method of claim 1, wherein the first network segment is a virtual network that is part of the network, the virtual network having a set of virtual network settings. ### Claim 8 (depends on 1) The method of claim 1, wherein the detecting comprises: monitoring a network for the foothold event, wherein the monitoring is continuous or intermittent. ### Claim 9 (depends on 1) The method of claim 1, wherein the severity score is based on factors, the factors including at least one of criticality of the network segment, overall threat of the foothold event to compromising network data, extent of the foothold. ### Claim 10 (depends on 1) The method of claim 1, wherein the matched score tier affects a subset of network settings in the reconfiguration layer for the second network segment. ### Claim 11 A system, comprising: a processor coupled to a memory that includes instructions that when executed by the processor cause the processor to: detect a foothold event at a first network segment, wherein the first network segment includes a set of network settings; analyze the foothold event upon detecting the foothold event; determine a severity score based on the analysis of the foothold event; compare the severity score to two or more score tiers; match the severity score to one score tier of the two or more score tiers based on the comparison; determine a reconfiguration layer based on the matched score tier; reconfigure at least part of the set of network settings of the first network segment based on the determined reconfiguration layer; and generate a second network segment having the reconfigured set of network settings that replaces the first network segment. ### Claim 12 (depends on 11) The system of claim 11, wherein the reconfiguration layer determines a subset of network settings of the set of network settings to be reconfigured. ### Claim 13 (depends on 11) The system of claim 11, comprising: dismantling the first network segment; and replacing the first network segment with the second network segment. ### Claim 14 (depends on 13) The system of claim 13, comprising: storing node communication information for the first network segment; rebuilding communication paths between at least two nodes for the second network segment using the node communication information, wherein the at least two nodes originally communicated with each other via the first network segment. ### Claim 15 (depends on 11) The system of claim 11, wherein the reconfiguring comprises: receiving a standardized set of network settings from a configuration server. ### Claim 16 (depends on 15) The system of claim 15, wherein the reconfiguring comprises: machine learning network settings across a network; and customizing the set of network settings according to machine learned settings on the configuration server. ### Claim 17 (depends on 11) The system of claim 11, wherein the matched score tier affects a subset of network settings in the reconfiguration layer for the second network segment. ### Claim 18 (depends on 11) The system of claim 11, wherein the detecting comprises: monitoring a network for the foothold event, wherein the monitoring is continuous or intermittent. ### Claim 19 (depends on 11) The system of claim 11, wherein the severity score is based on factors, the factors including at least one of criticality of the network segment, overall threat of the foothold event to compromising network data, extent of the foothold. ### Claim 20 A non-transitory computer readable medium having instructions to control one or more processors configured to: detect a foothold event at a first network segment, wherein the first network segment includes a set of network settings; analyze the foothold event upon detecting the foothold event; determine a severity score based on the analysis of the foothold event; compare the severity score to two or more score tiers; match the severity score to one score tier of the two or more score tiers based on the comparison; determine a reconfiguration layer based on the matched score tier; reconfigure at least part of the set of network settings of the first network segment based on the determined reconfiguration layer; and generate a second network segment having the reconfigured set of network settings that replaces the first network segment.