US 11,388,200 B2Granted

Scalable network security detection and prevention platform

AssigneeServiceNow, Inc.

InventorAndreas Seip Haugsnes

Life of this patent

Estimating the term…

Loading patent…

Abstract

This disclosure provides a network security architecture that permits installation of different software security products as virtual machines (VMs). By relying on a common data format and standardized communication structure (e.g., using pre-established, cross-platform messaging), a general architecture can be created and used to dynamically build and reconfigure interaction between both similar and dissimilar security products. Examples are provided where an intrusion monitoring system (IMS) can be used to detect network threats based on distributed threat analytics, passing detected threats to other security products (e.g., products with different capabilities from different vendors) to trigger automatic, dynamically configured communication and reaction. A network security provider using this infrastructure can provide hosted or managed boundary security to a diverse set of clients, each on a customized basis.

Claims13

Dependent claims

A tangible, non-transitory, machine-readable medium, comprising machine-readable instructions that, when executed by one or more processors of the machine, cause the machine to:

receive a first input from a first security software service that utilizes a first format for data communicated to, from, or to and from the first security software, wherein the first input comprises an indication of a first security characteristic of a computer network, represented in the first format;
convert the first input, represented in the first format into a common communications format, resulting in a converted first input in the common communications format;
use the converted first input and a second converted input indicating a second security characteristic of the computer network from a second security software service to further analyze the converted first input on behalf of a client network,
wherein the first security software service and the second security software service are natively incompatible with each other;
and
filter a subset of inputs meeting a specified security threat threshold to be displayed based at least in part on the analysis of the converted first input, wherein the inputs comprise the converted first input and the second converted input.

3 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/270,819Filed 8 Feb 2019 · continuation
Priority: 1 Feb 2012
Published: US 2019/0297118 A126 Sep 2019
Granted: 12 Jul 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification19 codes

H04L 63/205
For managing network security; network security policies in general: involving negotiation or determination of the one or more network security…
G06F 9/45558
Hypervisors; Virtual machine monitors: hypervisor-specific management and integration aspects
G06F 16/23
Of structured data, e.g. relational data: updating
G06F 16/245
Querying: query processing

Family

Application61/593,853Us provisional application · filed 1 Feb 2012
Application13/556,524Parent of this continuation · filed 24 Jul 2012
Application15/002,655Parent of this continuation · filed 21 Jan 2016
US 2019/0297118 A1Pre-grant publication · published 26 Sep 2019
US 10,225,288 B2Parent of this continuation
US 2016/0269427 A1Published application
US 11,388,200 B2This patent

From the US filing history. Foreign family members aren’t listed.