# US 2021/0344769 A1 · Network security layer > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344769 A1 - Document ID: US20210344769A1 - Status: Published application - Kind: A1 - Application number: 17/302,219 - Filed: 2021-04-27 - Published: 2021-11-04 - Earliest claimed: 2020-04-30 - Assignees: Perygee Inc. - Applicants: Perygee Inc. - Inventors: Mollie Breen - Web page: https://patentgrep.com/patent/US20210344769A1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 67/56: Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) - G06N 5/04: Inference or reasoning models - G06N 20/00: Machine learning - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0281: {Proxies} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 67/59: Providing operational support to end devices by off-loading in the network or by emulation, e.g. when they are unavailable - H04L 47/2483: involving identification of individual flows - H04L 63/0245: {Filtering by information in the payload} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 2463/121: Timestamp - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A method performed by a server for protecting a network infrastructure can include: receiving, from an inline hardware appliance associated with an asset, traffic associated with the asset; analyzing the traffic based on a behavioral fingerprint associated with the asset to determine if the traffic is normal or abnormal, wherein the behavioral fingerprint can be stored on the server; and in response to determining that the traffic is normal, forwarding the traffic to the asset. ## Claims ### Claim 1 A method performed by a server for protecting a network infrastructure comprising: receiving, from an inline hardware appliance that proxies traffic associated with an asset, traffic associated with the asset; analyzing the traffic based on a behavioral fingerprint associated with the asset to determine if the traffic is normal or abnormal, wherein the behavioral fingerprint is stored on the server; and in response to determining that the traffic is normal, forwarding the traffic to the asset. ### Claim 2 (depends on 1) The method of claim 1 comprising: determining if the traffic is incoming or outgoing; and in response to determining that the traffic is incoming and abnormal, blocking the traffic from being received by the asset. ### Claim 3 (depends on 2) The method of claim 2, wherein determining that the traffic is abnormal comprises determining that the traffic will cause downtime on the asset. ### Claim 4 (depends on 1) The method of claim 1 comprising; determining if the traffic is incoming or outgoing; and in response to determining that the traffic is outgoing and abnormal, determining that the asset is compromised. ### Claim 5 (depends on 4) The method of claim 4 comprising, in response to determining that the asset is compromised, gaining remote control of the asset. ### Claim 6 (depends on 5) The method of claim 5 comprising performing remote command executions on the asset with existing libraries of the asset. ### Claim 7 (depends on 4) The method of claim 4 comprising, in response to determining that the asset is compromised, isolating the asset from other assets on the network infrastructure. ### Claim 8 (depends on 1) The method of claim 1 further comprising updating the behavioral fingerprint. ### Claim 9 A method performed by a server for protecting a network infrastructure comprising: receiving identification information for a plurality of assets on a network; and for each asset: connecting the asset through an inline hardware appliance that proxies traffic, wherein the inline hardware appliance is configured to route traffic associated with the asset to the server; generating a behavioral fingerprint for the asset; storing the behavioral fingerprint on the server; and using the behavioral fingerprint to control traffic associated with the asset. ### Claim 10 (depends on 9) The method of claim 9, wherein generating the behavioral fingerprint for the asset comprises: monitoring traffic associated with the asset continuously and for a predetermined length of time; and generating the behavioral fingerprint based on received traffic data. ### Claim 11 (depends on 10) The method of claim 10, wherein traffic data comprises at least one of: frequencies of traffic; identification information of other assets that communicate with the asset; traffic packet sizes; traffic packet timestamps; time and duration information from when the asset is turned off; time and duration information from when the asset is turned on; or sensor data from a sensor of the asset. ### Claim 12 (depends on 11) The method of claim 11, wherein generating the behavioral fingerprint based on the received traffic data comprises using machine learning to generate an algorithm configured to predict whether a traffic packet associated with the asset is normal or abnormal. ### Claim 13 (depends on 9) The method of claim 9, wherein using the behavioral fingerprint to control traffic associated with the asset comprises: receiving, from the inline hardware appliance, a traffic packet associated with the asset; analyzing the traffic packet based on the behavioral fingerprint to determine if the traffic packet is normal or abnormal; and in response to determining that the traffic packet is normal, forwarding the traffic packet to the asset. ### Claim 14 (depends on 13) The method of claim 13 comprising: determining if the traffic packet is incoming or outgoing; and in response to determining that the traffic packet is incoming and abnormal, blocking the traffic packet from being received by the asset. ### Claim 15 (depends on 13) The method of claim 13 comprising; determining if the traffic packet is incoming or outgoing; and in response to determining that the traffic packet is outgoing and abnormal, determining that the asset is compromised. ### Claim 16 (depends on 15) The method of claim 15 comprising, in response to determining that the asset is compromised, controlling the asset using only resources of the asset. ### Claim 17 (depends on 13) The method of claim 13 further comprising updating the behavioral fingerprint. ### Claim 18 (depends on 9) The method of claim 9, wherein connecting the asset to the inline hardware appliance comprises configuring the inline hardware appliance to route all traffic associated with a media access control (MAC) address of the asset to the server. ### Claim 19 A system for protecting a network infrastructure comprising: a network; a plurality of assets connected to the network; and a server connected to the network, the server comprising a plurality of proxies, wherein the server is configured to, for each asset on the network: connect a proxy to the asset; generate a behavioral fingerprint for the asset; store the behavioral fingerprint on the server; and use the behavioral fingerprint to control traffic associated with the asset; wherein each proxy of the plurality of proxies is configured to route traffic associated with a connected asset to the server. ### Claim 20 (depends on 19) The system of claim 19, wherein generating the behavioral fingerprint comprises using machine learning to generate an algorithm configured to predict whether a traffic packet associated with the asset is normal or abnormal.