US 2021/0243204 A1Published application

Network threat prevention and information security using machine learning

AssigneeBank of America Corporation

InventorsJo-Ann Taylor, Benjamin F. Tweel, Michael R. Young, Michael J. Sbandi

Life of this patent

Estimating the term…

Loading patent…

Abstract

An information security system that includes an information security engine configured to detect an attack by a malicious software element in a network. The information security engine is further configured to transfer the malicious software element from the network to the emulated network in response to detecting an attack. The information security engine is further configured to select defense strategies for restricting communications using different port configurations and to implement each defense strategy within the emulated network. The information security engine is further configured to execute a duplicate of the malicious software element in the emulated network and to determine a performance level for each of the defense strategies against the duplicate of the malicious software element. The information security engine is further configured to select a defense strategy with a highest performance level and to implement the selected defense strategy within the network.

Claims20

Dependent claims

An information security system, comprising:

a network comprising a plurality of data resources configured to store data;
an emulated network comprising copies of the plurality of data resources;
an information security engine implemented by a processor configured to:
detect an attack by a malicious software element, wherein the attack attempts to transmit a portion of data from a data resource in the network to a device located outside of the network;
transfer the malicious software element from the network to the emulated network in response to detecting the attack;
select a first defense strategy for restricting communications using a first port configuration;
implement the first defense strategy within the emulated network, wherein implementing the first defense strategy comprises replicating data traffic from the network within the emulated network;
generate a first duplicate of the malicious software element within the emulated network, wherein the first duplicate of the malicious software element is a copy of the malicious software element;
execute the first duplicate of the malicious software element in the emulated network;
determine a first performance level for the first defense strategy against the first duplicate of the malicious software element;
select a second defense strategy for restricting communication using a second port configuration, wherein the second port configuration is different from the first port configuration;
implement the second defense strategy within the emulated network, wherein implementing the second defense strategy comprises replicating data traffic from the network within the emulated network;
generate a second duplicate of the malicious software element within the emulated network, wherein the second duplicate of the malicious software element is a copy of the malicious software element;
execute the second duplicate of the malicious software element in the emulated network;
determine a second performance level for the second defense strategy against the second duplicate of the malicious software element;
compare the first performance level with the second performance level;
select one of the first defense strategy and the second defense strategy with a highest performance level based on the comparison;
and
implement the selected defense strategy within the network.

16 more elements

A network threat prevention method, comprising:

detecting an attack by a malicious software element, wherein:
the attack attempts to transmit a portion of data from a data resource in a network to a device located outside of the network;
and
the network comprises a plurality of data resources configured to store data;
transferring the malicious software element from the network to an emulated network in response to detecting the attack, wherein the emulated network comprises copies of the plurality of data resources in the network;
selecting a first defense strategy for restricting communications using a first port configuration;
implementing the first defense strategy within the emulated network, wherein implementing the first defense strategy comprises replicating data traffic from the network within the emulated network;
generating a first duplicate of the malicious software element within the emulated network, wherein the first duplicate of the malicious software element is a copy of the malicious software element;
executing the first duplicate of the malicious software element in the emulated network;
determining a first performance level for the first defense strategy against the first duplicate of the malicious software element;
selecting a second defense strategy for restricting communication using a second port configuration, wherein the second port configuration is different from the first port configuration;
implementing the second defense strategy within the emulated network, wherein implementing the second defense strategy comprises replicating data traffic from the network within the emulated network;
generating a second duplicate of the malicious software element within the emulated network, wherein the second duplicate of the malicious software element is a copy of the malicious software element;
executing the second duplicate of the malicious software element in the emulated network;
determining a second performance level for the second defense strategy against the second duplicate of the malicious software element;
comparing the first performance level with the second performance level;
selecting one of the first defense strategy and the second defense strategy with a highest performance level based on the comparison;
and
implementing the selected defense strategy within the network.

16 more elements

A computer program comprising executable instructions stored in a non-transitory computer readable medium that when executed by a processor causes the processor to:

detect an attack by a malicious software element, wherein:
the attack attempts to transmit a portion of data from a data resource in a network to a device located outside of the network;
and
the network comprises a plurality of data resources configured to store data;
transfer the malicious software element from the network to an emulated network in response to detecting the attack, wherein the emulated network comprises copies of the plurality of data resources in the network;
select a first defense strategy for restricting communications using a first port configuration;
implement the first defense strategy within the emulated network, wherein implementing the first defense strategy comprises replicating data traffic from the network within the emulated network;
generate a first duplicate of the malicious software element within the emulated network, wherein the first duplicate of the malicious software element is a copy of the malicious software element;
execute the first duplicate of the malicious software element in the emulated network;
determine a first performance level for the first defense strategy against the first duplicate of the malicious software element;
select a second defense strategy for restricting communication using a second port configuration, wherein the second port configuration is different from the first port configuration;
implement the second defense strategy within the emulated network, wherein implementing the second defense strategy comprises replicating data traffic from the network within the emulated network;
generate a second duplicate of the malicious software element within the emulated network, wherein the second duplicate of the malicious software element is a copy of the malicious software element;
execute the second duplicate of the malicious software element in the emulated network;
determine a second performance level for the second defense strategy against the second duplicate of the malicious software element;
compare the first performance level with the second performance level;
select one of the first defense strategy and the second defense strategy with a highest performance level based on the comparison;
and
implement the selected defense strategy within the network.

16 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/779,243Filed 31 Jan 2020
Published: 5 Aug 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/145
Countermeasures against malicious traffic: the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
H04L 63/1408
For detecting or protecting against malicious traffic: by monitoring network traffic
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection

Family

US 11,323,473 B2Related patent
US 2021/0243204 A1This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key