Network traffic correlation engine
AssigneeBank of America Corporation
InventorsJonathan Sheedy, Steven E. Sinks
Life of this patent
Estimating the term…
Abstract
A network traffic correlation engine monitors inbound and/or outbound connection information received from on each host computer system on a network. Each host device on the network store data logs corresponding to information corresponding to communications sent by the device and received by the device. The network traffic correlation engine correlates connections between different hosts throughout the network. If the network traffic correlation engine identified unmatched outbound and inbound connections, the network traffic correlation engine generates an alert to initiate further investigation and may also provide a mapping of the communications showing a possible start device for the connection and/or a type of access that the connections may now be providing.
Claims20
A system comprising:
- a plurality of hosts on an enterprise network, each host of the plurality of hosts sending communications via the enterprise network;
- and
- a computing device, comprising:
- a processor;
- and
- non-transitory memory storing instructions that, when executed by the processor, cause the computing device to:
- monitor, by a network traffic correlation engine, network communications aggregated from the plurality of hosts on the enterprise network, wherein the network communications comprises inbound and outbound connection information received from each host on the enterprise network;
- identify, by the network traffic correlation engine, whether a correlation exists between a first communication sent from a first host device via the enterprise network to a second host device and a second communication received via the enterprise network by the second host device;
- determine, based on whether a correlation exists between the first communication and the second communication, whether an anomalous communication condition exists;
- and
- trigger, based on the correlation, an alert identifying that the anomalous communication condition is present between the first host device and the second host device.
A method comprising:
- monitoring, by a network traffic correlation engine, network communications based on aggregated information from each host of a plurality of hosts on an enterprise network, wherein the network communications comprises inbound and outbound connection information;
- identifying, by the network traffic correlation engine, whether a correlation exists between a first outbound communication sent from a first host device and a second inbound communication received by a second host device;
- and
- triggering, based on the correlation, an alert identifying that an anomalous communication condition is present between the first host device and the second host device, wherein the anomalous communication condition comprises an indication of host to host communication.
One or more non-transitory computer-readable media storing instructions that, when executed by a host computing device comprising a processor, memory, and a communication interface, cause the host computing device to:
- aggregate, by a network traffic correlation engine, network communications information from a plurality of hosts on an enterprise network, wherein the network communications information comprises inbound and outbound connection information associated with each host on the enterprise network;
- identify, by the network traffic correlation engine, whether a correlation exists between a first outbound communication sent from a first host device and a second inbound communication received by a second host device;
- and
- trigger, based on the correlation, an alert identifying that an anomalous communication condition is present between the first host device and the second host device, wherein the anomalous communication condition comprises an indication of host to host communication.
Dependencies are inferred from the claim text.