US 12,695,794 B1Granted

Policy violation detection using a multi-sourced unified data model

AssigneeNetskope, Inc.

InventorsEetu Lassi Oskari Korhonen, Sayan Hazra, Hardik Shelat, Kaushik Mukherjee

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems, devices, and computer-implemented methods are presented for monitoring distinct enterprise systems for violations of security policies. In one embodiment, a network security system collects data from a plurality of monitored systems within an enterprise and generates a unified data model using the data. The unified data model establishes connections between two or more of the monitored systems, and more particularly, between objects within the monitored systems based on matching corresponding parameters. The connections provide the network security system with insight into other data in the monitored systems allowing the network security system to identify violations of security policies by leveraging the connections. The network security system can output alerts and remediate the violations in a given monitored system.

Claims20

Dependent claims

A computer-implemented method, comprising:

obtaining, by a network security system (NSS), first data from a first monitored system associated with an enterprise;
obtaining, by the NSS, second data from a second monitored system associated with the enterprise;
generating, by the NSS, a unified data model using the first data and the second data, wherein generating the unified data model comprises:
identifying a first parameter of a first object in the first data and a first parameter of a second object in the second data based at least in part on the first parameters of the first and second objects matching, and establishing a connection between the first object and the second object based on the identification;
and
identifying, by the NSS, a violation of a security policy of the enterprise based on searching the unified data model in response to identifying a change in one or more of the first data and the second data, wherein the searching comprises leveraging the connection and a second parameter of the first object to find corresponding information in the second data that is associated with the second parameter and in violation of the security policy.

3 more elements

A computing apparatus comprising:

one or more computer-readable storage media;
and program instructions stored on the one or more computer-readable storage media executable by a processor of a device that, based on being read and executed by the processor of the device, direct the processor of the device to:
obtain first data from a first monitored system associated with an enterprise;
obtain second data from a second monitored system associated with the enterprise;
generate a unified data model using the first data and the second data, wherein to generate the unified data model, the program instructions direct the processor of the device to:
identify a first parameter of a first object in the first data and a first parameter of a second object in the second data based at least in part on the first parameters of the first and second objects matching, and establish a connection between the first object and the second object based on the identification;
and
identify a violation of a security policy of the enterprise based on searching the unified data model in response to identifying a change in one or more of the first data and the second data, wherein the searching comprises leveraging the connection and a second parameter of the first object to find corresponding information in the second data that is associated with the second parameter and in violation of the security policy.

5 more elements

A system comprising:

a memory;
a data collection engine configured to:
obtain first data from a first monitored system associated with an enterprise, and obtain second data from a second monitored system associated with the enterprise;
a connector engine configured to:
generate a unified data model using the first data and the second data, wherein to generate the unified data model, the connector engine is configured to:
identify a first parameter of a first object in the first data and a first parameter of a second object in the second data based at least in part on the first parameters of the first and second objects matching, and establish a connection between the first object and the second object based on the identification;
and
a security policy query engine configured to:
identify a violation of a security policy of the enterprise based on searching the unified data model in response to identifying a change in one or more of the first data and the second data, wherein the searching comprises leveraging the connection and a second parameter of the first object to find corresponding information in the second data that is associated with the second parameter and in violation of the security policy.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 19/384,212Filed 10 Nov 2025
Granted: 28 Jul 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
H04L 41/024
Standardisation; Integration: using relational databases for representation of network management data, e.g. managing via structured query…
H04L 41/16
Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks: using machine learning…
H04L 63/102
For controlling access to devices or network resources: entity profiles