Network analytics for network security enforcement

A computer device comprising:

• a processing device communicatively coupled to a network interface;
• and
• a memory storing instructions, that when executed by the processing device, cause the computer device to:
• receive authentication information from a network controller, the authentication information associated with a client device and a user attempting to gain access to a computer network for a login session;
• provide information regarding attributes of the user and the client device to a network analytics server executing a network analytics engine (NAE), the NAE providing analysis functions and risk level rankings for one or more user-initiated actions within the computer network;
• receive information pertaining to monitoring of the one or more user-initiated actions by the NAE;
• and
• provide information regarding security actions to the network controller based on a risk determination associated with each of the one or more user-initiated actions.

A non-transitory computer readable medium comprising computer executable instructions that, when executed by one or more processing units, cause the one or more processing units to:

• receive authentication information from a network controller at a network access control (NAC) device, the authentication information associated with a client device and a user attempting to gain access to a computer network for a login session;
• provide information regarding attributes of the user and the client device to a network analytics server executing a network analytics engine (NAE), the NAE providing analysis functions and risk level rankings for one or more user-initiated actions within the computer network;
• receive information at the NAC device pertaining to monitoring of the one or more user-initiated actions by the NAE;
• and
• provide information regarding security actions from the NAC device to the network controller based on a risk determination associated with each of the one or more user-initiated actions.

The non-transitory computer readable medium of claim 18, further comprising computer executable instructions that, when executed by one or more processing units, cause the one or more processing units to:

• compare a risk factor associated with the potential security breach to a cumulative risk value associated with the login session;
• determine if the cumulative risk value associated with the login session has crossed an action threshold;
• based on a determination that the action threshold has been crossed, send a first NAC event from the NAC device to the network controller to isolate the client device with respect to further communications on the computer network;
• and
• based on a determination that the action threshold has not been crossed, increase the cumulative risk value associated with the login session.