Optimization of redundant usage patterns based on historical data and security constraints

A system for quarantining shadow information technology (“IT”) comprising one or more unauthorized applications running on a server and for optimizing network traffic and enhancing data security, the system comprising:

• a content-filtering web proxy server configured to filter HTTP requests and to store the HTTP requests and associated data in a proxy log;
• a remediation framework configured to extract from the proxy log a group of HTTP requests received by the proxy server, each of the HTTP requests in the group being identified, by the remediation framework as:
• including an IP address listing a predefined term;
• having originated from a production server;
• being associated with an account ID that identifies a service account;
• being associated with either a user agent that identifies a program or not associated with any user name;
• and
• being associated with an identification number that, in a central registry, identifies a production application;
• the remediation framework being further configured to identify an anomalous HTTP request in the group by:
• querying stored information associated with each of the identification numbers;
• identifying an IP address associated with one of the HTTP requests in the group that is anomalous based on the stored information associated with the identification number;
• and
• removing the anomalous HTTP request from the group;
• the remediation framework being further configured to remove redundancies and enhance network performance by:
• extracting from the group a subset of HTTP requests, each of the HTTP requests in the subset calling an IP address including a term, the term not being a term associated with a programming language;
• when the HTTP requests in the subset are determined to be calling four or more different IP addresses, creating a first group including three or less IP addresses and a second group including one or more IP addresses;
• and
• instructing the proxy server to:
• intercept HTTP requests calling an IP address included in the second group and for re-directing the intercepted traffic to an IP address included in the first group of IP addresses;
• and
• upon the lapse of a predetermined time period, block all HTTP requests calling an IP address included in the second group;
• and
• the proxy server for:
• intercepting HTTP requests calling an IP address included in the second group and for re-directing the intercepted traffic to an IP address included in the first group of IP addresses;
• and
• the proxy server being configured to block all HTTP requests calling an IP address included in the second group upon the lapse of the predetermined time period.

A method for quarantining shadow information technology (“IT”) comprising one or more unauthorized applications running on a server and for optimizing network traffic and enhancing data security, the method comprising:

• filtering, using a content-filtering web proxy server, HTTP requests and storing the HTTP requests and associated data in a proxy log;
• extracting, from the proxy log, using the remediation framework, a group of HTTP requests received by the proxy server, each of the HTTP requests in the group being identified, by the remediation framework as:
• including an IP address listing a predefined term;
• having originated from a production server;
• being associated with an account ID that identifies a service account;
• being associated with either a user agent that identifies a program or not associated with any user name;
• and
• being associated with an identification number that, in a central registry, identifies a production application;
• identifying, using the remediation framework, an anomalous HTTP request in the group by:
• querying stored information associated with each of the identification numbers;
• and
• identifying an IP address associated with one of the HTTP requests in the group that is anomalous based on the stored information associated with the identification number;
• removing, using the remediation framework, the anomalous HTTP request from the group to perform remedial action for the anomalous HTTP request, the remedial action including:
• accessing the production server from which the anomalous HTTP request originated;
• querying a directory to identify one or more authorized applications running on the production server from which the anomalous HTTP request originated;
• quarantining one or more unauthorized applications running on the production server from which the anomalous HTTP request originated by moving each of the identified authorized applications from the production server to a replacement server, wherein after the quarantining the production server has been altered to be a modified production server;
• creating a shadow account for accumulating third-party data requested by the modified production server and accumulating third-party data pushed to the modified production server;
• and
• transmitting to the proxy server instructions to take remedial action;
• removing redundancies and enhance network performance by the remediation framework performing the steps of:
• extracting from the group a subset of HTTP requests, each of the HTTP requests in the subset calling an IP address including a term, the term not being a term associated with a programming language;
• when the HTTP requests in the subset are determined to be calling four or more different IP addresses, creating a first group including three or less IP addresses and a second group including one or more IP addresses;
• and
• instructing the proxy server to intercept HTTP requests calling an IP address included in the second group and for re-directing the intercepted traffic to an IP address included in the first group of IP addresses;
• and
• using the proxy server, intercepting traffic directed the second group of IP addresses and re-directing the intercepted traffic to an IP address included in the first group of IP addresses.