# US 11,310,285 B2 · Adaptive network security policies > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,285 B2 - Document ID: US11310285B2 - Status: Granted - Kind: B2 - Application number: 16/460,004 - Filed: 2019-07-02 - Published: 2019-10-24 - Granted: 2022-04-19 - Earliest claimed: 2019-07-02 - Assignees: Trend Micro Incorporated - Applicants: Trend Micro Incorporated - Inventors: Harry A. Bryson; Malcolm Dodds; Wei Lu; Julian Palmer - Web page: https://patentgrep.com/patent/US11310285B2 ## CPC - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04W 12/67: Risk-dependent, e.g. selecting a security level depending on risk profiles - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Adaptive network security policies can be selected by assigning a number of risk values to security intelligence associated with network traffic, and identifying a number of security policies to implement based on the risk values. ## Claims ### Claim 1 A computer-implemented method of protecting a computer network, the method comprising: receiving, over a computer network, a first network traffic in a first network security system; inspecting, in the first network security system, the first network traffic using a first security policy; obtaining a first security intelligence based at least on the inspection of the first network traffic using the first security policy; selecting a second security policy to be implemented in a second network security system based at least on the first security intelligence; receiving, over the computer network, the first network traffic in the second network security system; inspecting, in the second network security system, the first network traffic using the second security policy; obtaining a second security intelligence based at least on the inspection of the first network traffic using the second security policy; selecting a third security policy to be implemented in a third network security system based at least on the second security intelligence; receiving, over the computer network, the first network traffic in the third network security system, wherein the first, second, and third network security systems are different types of network security systems; inspecting, in the third network security system, the first network traffic using the third security policy; and performing a response action against the first network traffic in response to detecting that the first network traffic is a threat to the computer network. ### Claim 2 (depends on 1) The method of claim 1, wherein the response action includes blocking the first network traffic. ### Claim 3 (depends on 1) The method of claim 1, wherein the first network security system comprises a firewall and the second network security system comprises an application identification system (AIS). ### Claim 4 (depends on 1) The method of claim 1, wherein the third security policy comprises a filter for allowing or blocking network traffic. ### Claim 5 (depends on 1) The method of claim 1, further comprising: storing the first security intelligence in a historical database; and forwarding the first security intelligence from the historical database to the second network security system over the computer network. ### Claim 6 (depends on 1) The method of claim 1, further comprising: assigning a first risk level to the first network traffic based on the inspection of the first network traffic using the first security policy, wherein the second security policy is selected to be implemented in the second network security system based at least on the first risk level being assigned to the first network traffic. ### Claim 7 (depends on 6) The method of claim 6, further comprising: receiving, over the computer network, a second network traffic in the first network security system; inspecting, in the first network security system, the second network traffic using the first security policy; assigning a second risk level to the second network traffic based at least on the inspection of the second network traffic using the first security policy; selecting a fourth security policy to be implemented in the second network security system based at least on the second risk level being assigned to the second network traffic; and inspecting, in the second network security system, the second network traffic using the fourth security policy. ### Claim 8 A system for protecting a computer network, the system comprising: a first network security system comprising a processor and a memory, the first network security system being configured to receive a first network traffic over a computer network, inspect the first network traffic using a first set of security policies, and generate a first security intelligence based on the inspection of the first network traffic using the first set of security policies; a second network security system comprising a processor and a memory, the second network security system being configured to receive the first security intelligence over the computer network, select a second set of security policies based at least on the first security intelligence, inspect the first network traffic using the second set of security policies, and generate a second security intelligence based on the inspection of the first network traffic using the second set of security policies; and a third network security system comprising a processor and a memory, the third network security system being configured to receive the second security intelligence over the computer network, select a third set of security policies based at least on the second security intelligence, and inspect the first network traffic using the third set of security policies, wherein the first, second, and third network security systems are different types of network security systems, and wherein the second network security system selects the second set of security policies based at least on a first risk level being assigned to the first network traffic. ### Claim 9 (depends on 8) The system of claim 8, wherein the third network security system is configured to perform a response action against the first network traffic in response to detecting that the first network traffic is a threat to the computer network. ### Claim 10 (depends on 9) The system of claim 9, wherein the response action includes blocking the first network traffic. ### Claim 11 (depends on 8) The system of claim 8, wherein the third set of security policies comprises filters for allowing or blocking network traffic. ### Claim 12 (depends on 8) The system of claim 8, wherein the second network security system is configured to receive a second network traffic over the computer network, select a fourth set of security policies based at least on a second risk level being assigned to the second network traffic, and inspect the second network traffic using the fourth set of security policies. ### Claim 13 (depends on 8) The system of claim 8, wherein the first network security system comprises a firewall and the second network security system comprises an application identification system (AIS). ### Claim 14 A computer-implemented method of protecting a computer network, the method comprising: receiving, over a computer network, a first network traffic in a first network security system; inspecting, in the first network security system, the first network traffic using a first set of security policies; assigning a first risk value to the first network traffic based at least on the inspection of the first network traffic using the first set of security policies; selecting a second set of security policies to be implemented in a second network security system based at least on the first risk value being assigned to the first network traffic; receiving, over the computer network, the first network traffic in the second network security system; inspecting, in the second network security system, the first network traffic using the second set of security policies; assigning a second risk value to the first network traffic based at least on the inspection of the first network traffic using the second set of security policies, wherein the second risk value is different from the first risk value; selecting a third set of security policies to be implemented in a third network security system based at least on the second risk value being assigned to the first network traffic, wherein the first, second, and third network security systems are different types of network security systems; inspecting, in the third network security system, the first network traffic using the third set of security policies; and in response to detecting that the first network traffic is a threat to the computer network, performing a response action against the first network traffic. ### Claim 15 (depends on 14) The method of claim 14, further comprising: revising the second set of security policies based at least on the inspection of the first network traffic in the third network security system using the third set of security policies; and inspecting, in the second network security system, a second network traffic using the revised second set of security policies. ### Claim 16 (depends on 14) The method of claim 14, wherein the first network security system comprises a firewall and the second network security system comprises an application identification system (AIS). ### Claim 17 (depends on 14) The method of claim 14, wherein the response action includes blocking the first network traffic.