# US 2019/0173909 A1 · Method and device for robust detection, analytics, and filtering of data/information exchange with connected user devices in a gateway-connected user-space

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0173909 A1
- Document ID: US20190173909A1
- Status: Published application
- Kind: A1
- Application number: 16/260,083
- Filed: 2019-01-28
- Published: 2019-06-06
- Earliest claimed: 2016-08-05
- Assignees: Oak Tree Logic, LLC
- Applicants: Oak Tree Logic, LLC
- Inventors: ROBERT A. MIXER; LAURENCE E. RUSSELL
- Web page: https://patentgrep.com/patent/US20190173909A1

## CPC

- H04L 63/1433: {Vulnerability analysis}
- H04L 41/082: the condition being updates or upgrades of network functionality
- H04L 41/142: using statistical or mathematical methods
- H04L 43/04: Processing captured monitoring data, e.g. for logfile generation
- H04L 43/062: related to network traffic
- H04L 43/065: related to network devices
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/0272: {Virtual private networks}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/302: {gathering intelligence information for situation awareness or reconnaissance}
- H04L 63/0263: {Rule management}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A security appliance includes: a network port enabling direct connection to a gateway; a storage module having stored thereon firmware for operating the security appliance; and a processor that executes the program code of the firmware. The firmware configures the appliance to: establish a seamless communication interface with a connected gateway; monitor traffic coming into and going out from the connected gateway; and identify traffic anomalies within the monitored traffic. The firmware further configures the appliance to: in response to identifying one or more of the traffic anomalies: forward information about the identified traffic anomalies to a centralized database for evaluation and reporting; and in response to receiving an update from a server associated with the centralized database, update a security protocol of the appliance and/or the gateway to more quickly respond to detection of similar traffic anomalies and mitigate or counter emerging threats associated with the traffic anomalies.

## Claims

### Claim 1

A security appliance comprising:
a network port enabling direct connection to a gateway;
a storage module having stored thereon firmware for operating the security appliance; and
a processor that executes the program code of the firmware, which configures the appliance to:
establish a seamless communication interface with a connected gateway;
in response to establishing the seamless communication interface, monitor traffic coming into and going out from the connected gateway;
identify traffic anomalies within the monitored traffic; and
in response to identifying one or more of the traffic anomalies:
block and filter out undesirable traffic associated with the anomalies; and
generate one or more alerts and filter out the captured data in preparation for forwarding to a remote server database; and
forward the filtered information about the identified traffic anomalies to a centralized database for evaluation and reporting; and
in response to receiving an update from a server associated with the centralized database, update a security protocol of at least one of the appliance and the gateway to more quickly respond to detection of similar traffic anomalies and mitigate or counter emerging threats associated with the traffic anomalies.

### Claim 2 (depends on 1)

The security appliance of claim 1, wherein the traffic anomalies comprise at least one of measurable changes in traffic patterns, pre-specified traffic conditions, known threats, and potential threats.

### Claim 3 (depends on 1)

The security appliance of claim 1, wherein the firmware further configures the appliance to:
dynamically collect primary device metrics associated with a local network, the metrics comprising a number and type of attached computers, a type and patch level of the attached computers, types of communications made by the attached computers to each other and to the Internet;
dynamically collect secondary device metrics unique to the local network, the secondary device metrics comprising profiles of home automation devices, gaming systems, security alarm systems, motion detection systems, surveillance camera systems, multi-media systems, guest's mobile devices, the network access device, and other installed local routers and network devices.

### Claim 4 (depends on 3)

The security appliance of claim 3, wherein the firmware configures the appliance to implement retrieval of privacy-preserving security metrics, wherein the appliance screens out privacy data of all users within the user location network, such that only non-private data is forwarded and monitored and collected metrics are limited to only metrics associated with security needs for the network, user or small business, and enterprise, wherein no network flow data or metadata about specific communications or personnel or business information are collected.

### Claim 5 (depends on 3)

The security appliance of claim 3, further comprising the firmware configuring the appliance to:
actively reroute communications of the primary and secondary devices so that the devices interface with the appliance as the router;
passively collect metrics by monitoring communications;
actively scan the communication periodically for additional metrics; and
temporarily store the collected and additional metrics within the local storage.

### Claim 6 (depends on 5)

The security appliance of claim 5, wherein a cyber security function provided by the appliance is enhanced by communicatively connecting the security appliance to at least one physical security device to work in concert to provide total security protection for a space in which the security appliance is operational.

### Claim 7 (depends on 3)

The security appliance of claim 3, further comprising the firmware configuring the appliance to:
actively scan a perimeter firewall of the router in both inbound and outbound directions for open and close ports; and
identify vulnerable network services and known obsolete or vulnerable router models within the network, the identifying utilizing a cloud-based server to collect metrics about the security configuration of the router and the communication traffic through the router.

### Claim 8 (depends on 1)

The security appliance of claim 1, wherein the firmware provides automated patching by configuring the security appliance to enable small, special-purpose security patches to be pushed by a network-connected management server to minimize appliance downtime, wherein the security appliance is centrally managed by a network-connected security management server and establishes and maintains persistent outbound connections to the management server.

### Claim 9 (depends on 1)

The security appliance of claim 1, wherein the firmware further configures the appliance to:
perform automated tuning of security controls based on a characterization of a communication profile of the local network device, wherein the characterization is completed via passive and active metric collection over a fixed period; and
dynamically adjust a policy of allowed communications for the device if a match for a profile of the device is found within an intelligence database accessible to the server.

### Claim 10 (depends on 1)

The security appliance of claim 1, wherein the firmware further configures the appliance to:
detect a setting of an away mode of a home security system that is network connected; and
in response to detecting the setting of the away mode, automatically enable an “away protection” mode of the security appliance, the away protection mode including: integrating a home security system via an application programming interface (API), The API receiving notifications from a securely registered home security system; providing a client application that can securely register with the API of the home security system to push similar notifications to or pull similar notifications from the API; and during a virtual “away” period triggered by the security appliance, communicating with the physical security system to trigger the physical security system to generate data that makes it appear as though there is physical activity at/within a given location.

### Claim 11 (depends on 1)

The security appliance of claim 1, wherein the firmware further configures the appliance to mask internet bounded traffic to prevent identification of communication with the network during away periods on the network.

### Claim 12 (depends on 11)

The security appliance of claim 11, wherein the firmware further configures the appliance to mask the internet bounded traffic by configuring the appliance to:
collect metrics about usage and traffic when home devices are actively communicating over a learning period;
learn patterns based of the collected metrics to generate a home network communication profile; and
automatically tune one or more security rules for enforcement by the security appliance based on the generated home network communication profile;
wherein the metrics are collected in a format that enables packaging and forwarding to a remote security server.

### Claim 13 (depends on 11)

The security appliance of claim 11, wherein the firmware further configures the appliance to detect periods of statistical change that are indicative of an “away” period; and mask the internet bounded traffic during future away periods.

### Claim 14 (depends on 1)

The security appliance of claim 1, wherein the firmware further configures the appliance to:
identify security system traffic generated by one or more connected home security systems; and
in response to detection of an alarm activity within the security system traffic:
automatically raise a level of network security profile to counter any potential attempts to breach the home network; and
record metrics related to the period before, during and after detection of the alarm/security event to enable additional post-event analysis of the event.
wherein security system traffic comprises one or more of traffic from an alarm system, a motion sensor, and traffic from security cameras.

### Claim 15

A system that enhances at-home security of network connected devices, the system comprising:
a security appliance having at least one port for establishing a seamless communication interface with a connected gateway of a local network, the security appliance configured to: monitor network traffic coming into and going out from the connected gateway; identify traffic anomalies within the monitored traffic; and block and filter out undesirable traffic associated with the anomalies in both inbound and outbound communications utilizing a local evaluation module; and generate one or more alerts and update a remote server database; and
a management server communicatively connected to the security appliance via a public network, the server having a server processor communicatively coupled to the remote server database and server firmware that executes on the processor to cause the server to:
receive data from a plurality of different security appliances, each associated with a specific local network to which a respective appliance is connected;
analyze the received data for potential harm to one of the local network, a user device, and an enterprise network to which the user device connects; and
generate a report that consolidates a result of analyzing the data, the report sanitized of all personal and private data of users, including patterns of use and connection of the device.

### Claim 16 (depends on 15)

The system of claim 15, wherein the server firmware further causes the server processor to:
aggregate data received from a plurality of network-connected security appliances;
update a database of historical data arranged in a format that can be queried for future access;
enable automated sharing of real-time threat intelligence between different appliances;
update firmware for one or more of the security appliances based on an analysis of the aggregated data;
provide an application programming interface for integrating aggregate data of multiple appliances into other applications and workflows for enterprises that need visibility into the network security of their remote workforce; and
in response to one or more interested parties being subscribed to receive the report, forward the generated report to the one or more interested parties;
wherein the security appliance is centrally managed by a network-connected security management server and establishes and maintains persistent outbound connections to the management server; and
wherein the server provides centralized management of the appliance by generating and forwarding security patch applications, providing log collection and analysis, and forwarding product upgrades and general maintenance of the Appliances as a service.

### Claim 17

A device-implemented method comprising:
interfacing, via a security appliance, with a local user network device that supports external/public network connectivity and information communication by one or more user devices;
detecting anomalies within a behavior associated with Internet usage through machine learning algorithms;
generating and forwarding configurable push alerts for security issues identified by the appliance;
blocking and filtering out unwanted and undesirable traffic associated with the anomalies in both inbound and outbound communications;
generating one or more alerts and filtering out the captured data in preparation for forwarding to a remote server database;
forwarding the filtered information about the identified traffic anomalies to a centralized database for evaluation and reporting; and
in response to receiving an update from a server associated with the centralized database, update a security protocol of at least one of the appliance and the gateway to more quickly respond to detection of similar traffic anomalies and mitigate or counter emerging threats associated with the traffic anomalies.

### Claim 18 (depends on 17)

The method of claim 17, further comprising:
profiling communication across the network to automatically identify network endpoint;
dynamically tuning security controls based on the characterization of a device's communication profile;
periodically updating a network-wide intrusion prevention policy via accessing generally available threat intelligence;
performing reputation-based filtering of Internet communications based on that threat intelligence;
performing security assessments of a configuration of the router;
identifying and blocking man-in-the-middle attacks on the network; and
detecting characteristics associated with the router having been compromised;

### Claim 19 (depends on 17)

The method of claim 17, further comprising:
enabling and supporting a virtual private network (VPN) channel to allow a user mobile device to tunnel back into the home network from outside the home;
performing network traffic generation to mask differences between at-home/away periods; and
extending similar security features to the VPN channel as with an in-home connection of the mobile device.

### Claim 20 (depends on 17)

The method of claim 17, further comprising:
implementing retrieval of privacy-preserving security metrics by screening out privacy data of all users within the user location network, such that only non-private data is forwarded; and
limiting monitored and collected metrics to only metrics associated with security needs for the network, user, and enterprise, wherein no network flow data or metadata about specific communications are collected.