Network isolation by policy compliance evaluation
AssigneeUpguard, Inc.
InventorsMichael Franz Baukes, Alan James Sharp-Paul
Life of this patent
Estimating the term…
Abstract
An internal network can include a plurality of linked internal nodes, each internal node being configured to communicate with other internal nodes or with one or more external servers over an external network. The internal network can analyze the configuration of the internal nodes and the network traffic between internal nodes of the internal network and external servers. Based on the analysis, a network vulnerability score measuring the vulnerability of the internal network to attack can be determined. If the vulnerability score is below a threshold, the internal network can be isolated from the external network, for example by preventing internal nodes from communicating with or over the external network.
Claims20
A method comprising:
- determining, for an internal network comprising a plurality of nodes, whether external traffic received by the internal network introduces an above-threshold level of risk of malicious action to the internal network;
- responsive to determining that the external traffic introduces the above-threshold level of risk of malicious action to the internal network:
- identifying a set of the plurality of nodes corresponding to the external network traffic that introduces the above-threshold level of risk of malicious action;
- and
- isolating the set of nodes by instructing a DNS server of the internal network to prevent resolution of DNS requests for IP addresses corresponding to the set of nodes until a simulation of external network traffic indicates that the external network traffic introduces a below-threshold level of risk of malicious action to the internal network.
A non-transitory computer readable storage medium comprising instructions which when executed by a processor cause the processor to perform the steps of:
- determining, for an internal network comprising a plurality of nodes, whether external traffic received by the internal network introduces an above-threshold level of risk of malicious action to the internal network;
- responsive to determining that the external traffic introduces the above-threshold level of risk of malicious action to the internal network:
- identifying a set of the plurality of nodes corresponding to the external network traffic that introduces the above-threshold level of risk of malicious action;
- and
- isolating the set of nodes by instructing a DNS server of the internal network to prevent resolution of DNS requests for IP addresses corresponding to the set of nodes until a simulation of external network traffic indicates that the external network traffic introduces a below-threshold level of risk of malicious action to the internal network.
A system comprising:
- a plurality of nodes within an internal network, each comprising one or more hardware processor and configured to receive external network traffic from an outside network;
- an operator node of the internal network, the operator node configured to:
- determine whether external traffic received by the internal network introduces an above-threshold level of risk of malicious action to the internal network;
- responsive to determining that the external traffic introduces the above-threshold level of risk of malicious action to the internal network:
- identifying a set of the plurality of nodes corresponding to the external network traffic that introduces the above-threshold level of risk of malicious action;
- and
- isolating the set of nodes by instructing a DNS server of the internal network to prevent resolution of DNS requests for IP addresses corresponding to the set of nodes until a simulation of external network traffic indicates that the external network traffic introduces a below-threshold level of risk of malicious action to the internal network.
Dependencies are inferred from the claim text.