Back to results
US 8,146,160 B2Granted
Method and system for authentication event security policy generation
AssigneeArbor Networks, Inc.
InventorsDouglas B. Orr, Thomas Henry Ptacek, Douglas Joon Song
Life of this patent
Estimating the term…
Abstract
A method and system allows for the deployment of security policies into the higher layers of the OSI model. Specifically, it allows for the establishment of security policies at layer 4 and higher, by monitoring authentication flows and using these flows as the basis for establishing security policies which then can be used as a basis for assessing the operation of the network.
Claims34
A method for generating and using security policies for a computer network, the method comprising:
- detecting authentication events involving host computers contacting authentication servers on the computer network by monitoring activity involving the authentication servers;
- extracting authentication information for each of the authentication events including user names, host computer addresses, destination addresses, and authentication protocols from the authentication events and updating a usage model database containing legitimate network communications with the extracted authentication information including the user names, host computer addresses, destination addresses, and authentication protocol;
- using the authentication information of the usage model database to define security policies, the usage model characterizing legitimate network communications by reference to at least user names, host computer addresses, and destination addresses;
- detecting new authentication events on the computer network;
- extracting authentication information from the authentication events;
- and
- comparing the authentication information against the security policies for the network, the security policies defining legitimate network communications with respect to at least the user names, the host computer addresses, the destination addresses and the authentication protocols, and generating alerts if the new authentication events violate the security policies and indicating modification of the usage model if the new authentication events are not encompassed by the security policies, that is neither consistent with the security policies nor a breach of the security policies.
4 more elements
A method for monitoring security in a computer network, the method comprising:
- detecting communication events on the computer network;
- extracting authentication information from the communication events including user names of users of host computers seeking authentication, addresses of the host computers, and authentication protocols;
- and
- generating a model of the authentication state of the network including the user names, the addresses of the host computers, and the authentication protocols of the authentication information extracted from the communication events;
- monitoring new authentication events and comparing the authentication events against the model and generating alerts if the new authentication events violate security policies based on the model including the user names, the addresses of the host computers, and the authentication protocols of the new authentication and indicating modification of the model if the new authentication events are not encompassed by the security policies, that are neither consistent with the security policies nor a breach of the security policies.
2 more elements
A computer network security system, comprising:
- collectors for monitoring network communications events and authentication events involving host computers contacting authentication servers including at least user names, host computer addresses, authentication protocols, and destination addresses;
- a modeling mechanism for combining information from the network communications events and the authentication events into a model describing legitimate network activity and creating security policies based on the model, the usage model characterizing legitimate network communications by reference to at least user names, host computer addresses, authentication protocols, and destination addresses;
- and
- policy notification system for monitoring new authentication events detected by the collectors and comparing the authentication event against the security policies and generating alerts if the new authentication events violate the security policies and indicating modification of the model if the new authentication events are not encompassed by the security policies, that is neither consistent with the security policies nor a breach of the security policies.
1 more element
A computer network security system, comprising:
- collectors for monitoring network authentication events on a network;
- a modeling mechanism for combining information from the network authentication events into an authentication state model describing network activity including user names of users of host computers initiating the authentication events, authentication protocols, and addresses of the host computers;
- and
- a notification system for generating an alert if the network communication events violated security policies by reference to the user names of the users, authentication protocols, and the addresses of the host computers derived from the model and indicating modification of the model if the new authentication events are not encompassed by the security policies, that is neither consistent with the security policies nor a breach of the security policies.
1 more element
Dependencies are inferred from the claim text.