Threat detection of application traffic flows
AssigneeCisco Technology, Inc.
InventorsGangadharan Byju Pularikkal, Santosh Ramrao Patil, Paul Wayne Bigbee, Darrin Joseph Miller, Madhusudan Nanjanagud
Life of this patent
Estimating the term…
Abstract
The present technology pertains to a system that routes application flows. The system can receive an application flow from a device by an active threat detection agent; analyze the application flow for user context, device context, and application context; classify the application flow based on the analysis of the application flow; and direct the application flow according to the classification of the application flow and an application access policy.
Claims19
A non-transitory computer readable medium comprising instructions that when executed cause at least one processor to:
- receive traffic flow of an application through a network from a device by an active threat detection agent, wherein the active threat detection agent is executing on a network device on a route of the traffic flow from the device to a destination in the network;
- analyze the traffic flow for at least, device context including at least a security assessment of the device;
- determine whether to classify the traffic flow, based on the analysis of the traffic flow, as anomalous;
- and
- in response to the traffic flow being classified as anomalous, restricting the traffic flow to the destination according to the classification of the traffic flow and an application access policy by a change of authorization on the network device, wherein the application access policy includes at least one restriction for the traffic flow.
A system comprising:
- an identity service configured to analyze a traffic flow of an application through a network for device context including at least a security assessment of the device;
- a threat detection agent configured to receive the traffic flow, and to classify the traffic flow based on the analysis of the traffic flow by the identify service, and in response to the traffic flow being classified as anomalous, the identify services is configured to restrict the traffic flow to a destination in the network according to the classification of the traffic flow and an application access policy by a change of authorization on the network device, wherein the application access policy includes at least one restriction for the traffic flow, and wherein the active threat detection agent is executing on a network device on a route of the traffic flow from the device to the destination.
A method comprising:
- receiving an traffic flow of an application through a network from a device by an active threat detection agent, wherein the active threat detection agent is executing on a network device on a route of the traffic flow from the device to a destination in the network;
- analyzing the traffic flow for device context including at least a security assessment of the device;
- determining whether to classifying the traffic flow based on the analysis of the traffic flow, as anomalous;
- and
- in response to the traffic flow being classified as anomalous, restricting the traffic flow to the destination according to the classification of the traffic flow and an application access policy by a change of authorization on the network device, wherein the application access policy includes at least one restriction for the traffic flow.
Dependencies are inferred from the claim text.