System and methods for computer network security involving user confirmation of network connections
AssigneeLancope, Inc.
InventorsRobert Charles Palazzo, Michael Sea Luu
Life of this patent
Estimating the term…
Abstract
Systems and methods for detecting anomalies in network traffic and providing notification to the users of the computers that generated the network traffic for confirmation of the activities that resulted in the network traffic are described herein. According to particular embodiments, the system is configured to collect data regarding network activity (e.g., via sensors), generate inquiries to users regarding that activity, receive the user's response to those inquiries, and provide the user's response along with the network activity to a security analyst.
Claims34
A computer system for monitoring a data communication network comprising:
- at least one processor configured for:
- receiving security event data from a sensor, the sensor operatively coupled to the data communication network and operative for determining the existence of a client/server connection on the data communication network;
- transmitting a notification to a particular user of a machine on the data communication network associated with the client of the client/server connection, the notification comprising the indication of the nature of a security event represented in the security event data and a query as to the nature of the particular user's network activity relating to the server of the client/server connection;
- receiving the user's response to the query;
- based upon the user's response to the query, generating a security alert based on the response to the query and the security event data;
- communicating the security alert to a security analyst computer system with associated with the data communication network.
A method for monitoring a data communication network, comprising the steps of:
- collecting network communication metadata relating to a communication between a client and a server on a network;
- based the communication metadata, determining that further information is needed regarding a server identified from the communication metadata;
- querying a user associated with the client involved in the communication for further information about the connection with the server identified from the communication metadata;
- receiving a user response to the query;
- and
- storing the user response in a database in association with at least some of the communication metadata corresponding to the server identified from the communication metadata for use in evaluating a security risk of past, present, or subsequent connections to that server by users of the data communication network.
Dependencies are inferred from the claim text.