Traffic scanning with context-aware threat signatures
AssigneeSophos Limited
InventorsAndrew Thomas, Craig Jones, Michael Shannon
Life of this patent
Estimating the term…
Abstract
Threat management devices and methods. The methods include receiving, at an interface of a threat management device, contextual data associated with a first endpoint device that is in operable connectivity with the threat management device, wherein the threat management device is configured to execute at least one subsystem to scan network traffic. The methods further include determining at least a first signature from a plurality of signatures to use in scanning the network traffic based on the received contextual data and instructing the at least one subsystem to scan network traffic using at least the first determined signature.
Claims20
A method for operating a threat management device, the method comprising:
- receiving, at an interface of a threat management device, contextual data associated with a first endpoint device that is in operable connectivity with the threat management device, wherein the threat management device is configured to execute at least one subsystem to scan network traffic;
- determining at least a first signature from a plurality of signatures to use in scanning the network traffic based on the received contextual data;
- and
- instructing the at least one subsystem to scan network traffic using at least the first determined signature.
The method of claim 7, wherein the second signature is the first signature.
A threat management device comprising:
- an interface for at least receiving contextual data associated with a first endpoint device that is in operable connectivity with the threat management device;
- and
- one or more processors executing instructions stored on memory to:
- determine at least a first signature from a plurality of signatures to use in scanning the network traffic based on the received contextual data, and
- instruct the at least one subsystem to scan network traffic using at least the first determined signature.
A computer program product for threat detection, the computer program product comprising computer executable code embodied in one or more non-transitory computer readable media that, when executing on one or more processors, performs the steps of:
- receiving, at an interface of a threat management device, contextual data associated with a first endpoint device that is in operable connectivity with the threat management device, wherein the threat management device is configured to execute at least one subsystem to scan network traffic;
- determining at least a first signature from a plurality of signatures to use in scanning the network traffic based on the received contextual data;
- and
- instructing the at least one subsystem to scan network traffic using at least the first determined signature.
Dependencies are inferred from the claim text.