# US 12,309,206 B2 · System and method for creating access control policies for individual users, user groups, network host or network host groups through network traffic analysis

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,309,206 B2
- Document ID: US12309206B2
- Status: Granted
- Kind: B2
- Application number: 17/396,895
- Filed: 2021-08-09
- Published: 2022-02-10
- Granted: 2025-05-20
- Earliest claimed: 2020-08-09
- Assignees: Ericom Software Ltd.
- Applicants: Ericom Software Ltd.
- Inventors: John Peterson
- Web page: https://patentgrep.com/patent/US12309206B2

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/102: {Entity profiles}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)}
- G06N 20/00: Machine learning
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

A method and system for automatically creating access control policies for a network, including: (a) automatically identifying and recording user or host entities that attach to the network; (b) monitoring allowed network communications from the user or host entities; (c) correlating network address information from the allowed network communications with names of the user or host entities; and (d) proposing a respective access control policy for each of the user or host entities based on information gleaned during a learning process.

## Claims

### Claim 1

A method for automatically creating access control policies for a network, comprising:
(a) automatically identifying and recording user or host entities that attach to the network, each of the user or host entities being assigned respective network addresses;
(b) monitoring allowed network communications from said user or host entities to extract the respective network addresses;
(c) removing any existing access control policies previously assigned to the network addresses;
(d) correlating the respective network addresses with corresponding existing access control policies of said user or host entities based on said allowed network communications;
(e) performing a learning process, on user or host entities for which no existing access control policies exist; and
(f) proposing a respective access control policy for each of said user or host entities based on information gleaned during the learning process.

### Claim 2 (depends on 1)

The method of claim 1, wherein said learning process includes at least one of:
(i) performing network traffic analysis on network traffic to and from said user or host entities;
(ii) performing behavior analysis on said user or host entities; and
(iii) performing machine learning on activities of said user or host entities.

### Claim 3 (depends on 1)

The method of claim 1, wherein said respective access control policy for each of said entities is reviewed by a human security administrator or automatically implemented.

### Claim 4 (depends on 1)

The method of claim 1, wherein said user or host entities are selected from groups including: users, user groups, network hosts or network host groups.