Policy-based network security management

A method of providing policy-based network security management, comprising the steps of:

• receiving a set of data regarding a user of a network, wherein the set of data is a first set of data that is collected over a first duration of time;
• receiving a second set of data that is collected over a second duration of time, wherein the first duration of time is shorter than the second duration of time;
• creating and storing a risk level of the user based on the second set of data, wherein the second duration of time is sufficient to collect historical data regarding past malicious activities of the user, and wherein the risk level is a discrete value representing a long-term measurement of the likelihood of the user harming the network;
• creating and storing a current alert level based on the first set of data, wherein the first duration of time is of a length appropriate for assessing current activities of the user, and wherein the current alert level is a discrete value representing a current measurement of the likelihood of the user negatively affecting the network;
• automatically deciding on a course of action based on the risk level and the current alert level, wherein the course of action may be adverse to the user although the current alert level is insufficient to establish whether the user is performing a malicious action;
• and
• sending signals to one or more network elements in the network to implement the course of action.

A method of policy-based network security management, comprising the computer-implemented steps of:

• collecting network performance statistics related to an overall health of a network and individual performance statistics of one or more individual units of the network, the collecting being performed by a performance management system;
• sending the network performance statistics to a controller for analysis;
• computing an overall health state based on the network performance statistics and the individual performance statistics, using the controller;
• reading external alert data from an external alert source, using the controller;
• collecting security event data from the network;
• sending the security event data to a fault management system;
• using the fault management system for checking for duplications in the security event data, and deduplicating duplicate security events in the security event data;
• calculating an alert state based on the security event data from the fault management system and the external alert data, wherein the alert state is a discrete value representing a current measurement of the likelihood of the network being negatively affected;
• obtaining user information from a subscriber management system;
• correlating the security event data from the fault management system with the user information to form correlated security event data;
• reading external user risk data from an external user risk source into the controller;
• calculating a user risk state based on the correlated security event data and the external user risk data, using the controller, wherein the user risk state is a discrete value representing a long-term measurement of the likelihood of the network being harmed;
• calculating a decision regarding whether to take corrective action based on the overall health state, the alert state, and the user risk state, using the controller;
• sending the decision from the controller to the subscriber management system;
• and
• sending directives, related to the decision, from the subscriber management system to the network.

A system comprising:

• a fault management system that receives network security data and deduplicates duplicate indications of security events in the network security data to form deduplicated security event data;
• a subscriber management system that manages subscribers using a network, wherein the subscriber management system stores subscriber information about individual users and is capable of sending directives to the individual users based on a decision to take corrective action toward the individual users;
• wherein the deduplicated security event data from the fault management system is correlated to the subscriber information to form correlated network security data;
• a performance management system that receives overall performance data related to an overall health of the network and individual performance data related to a health of one or more individual units of the network;
• and
• a controller that:
• receives external alert data from an external alert source, external user risk data from an external user risk source, the deduplicated security event data, the correlated network security data, the overall performance data, and the individual performance data;
• computes an alert state based on at least the external alert data and the deduplicated security event data, wherein the alert state is a discrete value representing a current measurement of the likelihood of the network being negatively affected;
• computes a user risk state based on at least the external user risk data and the correlated network security data, wherein the user risk state is a discrete value representing a long-term measurement of the likelihood of the network being harmed;
• computes a health state based on at least the overall performance data and the individual performance data;
• makes the decision whether to take corrective action based on at least the alert state, the user risk state, and the health state;
• and
• causes directives that implement the decision to be sent to the network.

An apparatus for providing policy-based network security management, comprising:

• means for receiving a set of data regarding a user of a network, wherein the set of data is a first set of data that is collected over a first duration of time;
• means for receiving a second set of data that is collected over a second duration of time, wherein the first duration of time is shorter than the second duration of time;
• means for creating and storing a risk level of the user based on the second set of data, wherein the second duration of time is sufficient to collect historical data regarding past malicious activities of the user, and wherein the risk level is a discrete value representing a long-term measurement of the likelihood of the user harming the network;
• means for creating and storing a current alert level based on the first set of data, wherein the first duration of time is of a length appropriate for assessing current activities of the user, and wherein the current alert level is a discrete value representing a current measurement of the likelihood of the user negatively affecting the network;
• means for automatically deciding on a course of action based on the risk level and the current alert level, wherein the course of action may be adverse to the user although the current alert level is insufficient to establish whether the user is performing a malicious action;
• and
• means for sending signals to one or more network elements in the network to implement the course of action.