# US 12,225,030 B2 · Identifying network entities based on beaconing activity > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,030 B2 - Document ID: US12225030B2 - Status: Granted - Kind: B2 - Application number: 17/826,011 - Filed: 2022-05-26 - Published: 2022-12-22 - Granted: 2025-02-11 - Earliest claimed: 2021-06-18 - Assignees: ExtraHop Networks, Inc. - Applicants: ExtraHop Networks, Inc. - Inventors: Jeff James Costlow; Michael Ryan Corder; Edmund Hope Driggs; Benjamin Thomas Higgins; Michael Kerber Krause Montague; Kenneth Perrault; Jesse Abraham Rothstein; Jonathan Jacob Scott; Marc Adam Winners; Xue Jun Wu - Web page: https://patentgrep.com/patent/US12225030B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04W 12/121: Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS] - H04L 43/062: related to network traffic - H04L 43/08: Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters - H04L 43/12: Network monitoring probes - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Embodiments are directed to monitoring network traffic using network monitoring computers (NMCs). Metrics may be determined based on monitoring network traffic associated with a plurality of entities each associated with a profile that includes the metrics for each entity. Beaconing metrics associated with beaconing activity may be determined based on the metrics. The profile of each entity may be compared with the beaconing metrics to determine the entities that may be engaged in beaconing activity. The entities may be characterized based on beaconing activity such that the beaconing activity includes communication with endpoints associated with the third parties, employing communication protocols associated with the third-parties, or exchanging payloads consistent with the beaconing activity. Reports that include information associated with the entities and its beaconing activity may be generated. ## Claims ### Claim 1 A method for monitoring communication over a network between one or more computers, with one or more network monitoring computers (NMCs) that perform actions, comprising: determining one or more metrics based on monitoring network traffic associated with a plurality of entities in the network; determining one or more beaconing metrics associated with beaconing activity based on the one or more metrics; generating a profile for each entity with one or more portions of the one or more beaconing metrics associated with update activity for each entity, wherein the update activity for an entity includes an aggregated characteristic associated with a type of the entity; employing one or more observed cadences for validation of one or more licenses by one or more unknown applications associated with the one or more entities to infer one or more types of the one or more applications and infer one or more identities for the one or more entities; characterizing the one or more entities based on its beaconing activity, wherein the beaconing activity includes one or more of communication with one or more endpoints associated with one or more third parties; determining anomalous activity by the one or more entities or the one or more third parties based on one or more machine learning classifiers trained on captured network traffic to recognize the anomalous activity associated with it's beaconing activity, it's update activity and it's license activity; and generating one or more reports that include information associated with the one or more entities and its beaconing activity and the anomalous activity. ### Claim 2 (depends on 1) The method of claim 1, further comprising: comparing the profile of each entity with the one or more beaconing metrics, wherein the comparison is employed to determine one or more entities of the plurality of entities that are engaged in beaconing activity. ### Claim 3 (depends on 1) The method of claim 1, wherein the beaconing activity further comprises one or more of: employing communication protocols associated with the one or more third-parties, or exchanging payloads consistent with the beaconing activity associated with the one or more third parties. ### Claim 4 (depends on 1) The method of claim 1, wherein the anomalous activity further comprises one or more of beaconing activity, update activity, or license activity. ### Claim 5 (depends on 1) The method of claim 1, wherein the plurality of entities further comprises one or more of on-premise license servers that perform one or more license activities on one or more local networks. ### Claim 6 (depends on 1) The method of claim 1, wherein the determined anomalous activity further comprises one or more of: an unexpected update, an unexpected reboot or restart of an entity, an unexpected target endpoint, an unknown application, or an unknown peripheral device. ### Claim 7 (depends on 1) The method of claim 1, further comprises: determining an association of the beaconing activity with one or more third parties; and determining an association for each entity with a profile that includes the one or more metrics for each entity. ### Claim 8 A system for monitoring network traffic in one or more networks: one or more network monitoring computers (NMCs), comprising: a memory that stores at least instructions; and one or more processors that execute instructions that enable performance of actions, including: determining one or more metrics based on monitoring network traffic associated with a plurality of entities in the network; determining one or more beaconing metrics associated with beaconing activity based on the one or more metrics; generating a profile for each entity with one or more portions of the one or more beaconing metrics associated with update activity for each entity, wherein the update activity for an entity includes an aggregated characteristic associated with a type of the entity; employing one or more observed cadences for validation of one or more licenses by one or more unknown applications associated with the one or more entities to infer one or more types of the one or more applications and infer one or more identities for the one or more entities; characterizing the one or more entities based on its beaconing activity, wherein the beaconing activity includes one or more of communication with one or more endpoints associated with one or more third parties; determining anomalous activity by the one or more entities or the one or more third parties based on one or more machine learning classifiers trained on captured network traffic to recognize the anomalous activity associated with it's beaconing activity, it's update activity and it's license activity; and generating one or more reports that include information associated with the one or more entities and its beaconing activity and anomalous activity. ### Claim 9 (depends on 8) The system of claim 8, further comprising: comparing the profile of each entity with the one or more beaconing metrics, wherein the comparison is employed to determine one or more entities of the plurality of entities that are engaged in beaconing activity. ### Claim 10 (depends on 8) The system of claim 8, wherein the beaconing activity further comprises one or more of: employing communication protocols associated with the one or more third-parties, or exchanging payloads consistent with the beaconing activity associated with the one or more third parties. ### Claim 11 (depends on 8) The system of claim 8, wherein the anomalous activity further comprises one or more of beaconing activity, update activity, or license activity. ### Claim 12 (depends on 8) The system of claim 8, wherein the plurality of entities further comprises one or more of on-premise license servers that perform one or more license activities on one or more local networks. ### Claim 13 (depends on 8) The system of claim 8, wherein the determined anomalous activity further comprises one or more of: an unexpected update, an unexpected reboot or restart of an entity, an unexpected target endpoint, an unknown application, or an unknown peripheral device. ### Claim 14 (depends on 8) The system of claim 8, further comprises: determining an association of the beaconing activity with one or more third parties; and determining an association for each entity with a profile that includes the one or more metrics for each entity. ### Claim 15 A processor readable non-transitory storage media for storing instructions, wherein execution of the instructions by one or more network monitoring computers (NMCs) enables monitoring communication over a network between one or more computers to perform actions, comprising: determining one or more metrics based on monitoring network traffic associated with a plurality of entities in the network; determining one or more beaconing metrics associated with beaconing activity based on the one or more metrics; generating a profile for each entity with one or more portions of the one or more beaconing metrics associated with update activity for each entity, wherein the update activity for an entity includes an aggregated characteristic associated with a type of the entity; employing one or more observed cadences for validation of one or more licenses by one or more unknown applications associated with the one or more entities to infer one or more types of the one or more applications and infer one or more identities for the one or more entities; characterizing the one or more entities based on its beaconing activity, wherein the beaconing activity includes one or more of communication with one or more endpoints associated with one or more third parties; determining anomalous activity by the one or more entities or the one or more third parties based on one or more machine learning classifiers trained on captured network traffic to recognize the anomalous activity associated with it's beaconing activity, it's update activity and it's license activity; and generating one or more reports that include information associated with the one or more entities and its beaconing activity and anomalous activity. ### Claim 16 (depends on 15) The processor readable non-transitory storage media of claim 15, further comprising: comparing the profile of each entity with the one or more beaconing metrics, wherein the comparison is employed to determine one or more entities of the plurality of entities that are engaged in beaconing activity. ### Claim 17 (depends on 15) The processor readable non-transitory storage media of claim 15, wherein the beaconing activity further comprises one or more of: employing communication protocols associated with the one or more third-parties, or exchanging payloads consistent with the beaconing activity associated with the one or more third parties. ### Claim 18 (depends on 15) The processor readable non-transitory storage media of claim 15, wherein the plurality of entities further comprises one or more of on-premise license servers that perform one or more license activities on one or more local networks. ### Claim 19 (depends on 15) The processor readable non-transitory storage media of claim 15, wherein the determined anomalous activity further comprises one or more of: an unexpected update, an unexpected reboot or restart of an entity, an unexpected target endpoint, an unknown application, or an unknown peripheral device. ### Claim 20 (depends on 15) The processor readable non-transitory storage media of claim 15, further comprises: determining an association of the beaconing activity with one or more third parties; and determining an association for each entity with a profile that includes the one or more metrics for each entity.