Method and apparatus for security-risk based admission control

An admission control for use in admitting a user device waiting to enter a network having one or more currently admitted user devices, the admission control comprising:

• a memory to store instructions;
• and
• a processor coupled to the memory to execute the instructions to perform a method comprising
• receiving a request from the user device to access the network,
• determining whether to admit the user device based on a security-based admission control policy that admits user devices based on a constraint optimization that attempts to maximize the sum utility of the currently admitted user devices in view of a security assessment of the user device and security risk imposed on the network and already admitted user devices if the user device is admitted to the network, wherein the constraint optimization is based on a utility associated with admitting the user device to the network, a reputation value associated with the user device, and a botnet damage estimation on the network associated with the user device, and
• admitting the user device to the network based on results of determining whether to admit the user device.

An article of manufacture having one or more computer readable storage media storing instructions which when executed by an admission controller of a network cause the admission controller to perform a method comprising:

• receiving a request from the user device to access the network;
• determining whether to admit the user device based on a security-based admission control policy that admits user devices based on a constraint optimization that attempts to maximize the sum utility of the currently admitted user devices in view of a security assessment of the user device and security risk imposed on the network and already admitted user devices if the user device is admitted to the network, wherein the constraint optimization is based on a utility associated with admitting the user device to the network, a reputation value associated with the user device, and a botnet damage estimation on the network associated with the user device;
• and
• admitting the user device to the network based on results of determining whether to admit the user device.