Back to results
US 8,275,899 B2Granted
Methods, devices and computer program products for regulating network activity using a subscriber scoring system
AssigneeAT&T Intellectual Property I, L.P.
InventorsWilliam R. Beckett, III, Deepak Chawla
Life of this patent
Estimating the term…
Abstract
Network activity in a network is regulated. Network activity scores that correspond to network usage patterns for respective network users are calculated. A network user is assigned into one of multiple risk classes responsive to a respective one of the network activity scores. A subsequent action is selected responsive to which of the risk classes the network user is assigned.
Claims15
A computer implemented method, comprising:
- performing operations as follows on at least one processor:
- calculating a network activity score that corresponds to a network usage pattern for each network user of a plurality of network users;
- assigning one network user of the plurality of network users into a first risk class of a plurality of risk classes responsive to the network activity score of the one network user;
- and
- selecting a first subsequent action based on the first risk class to which the one network user is assigned,
- wherein the plurality of risk classes include at least the first risk class, a second risk class and a third risk class,
- wherein the plurality of network users include a first network user, a second network user and a third network user, and
- wherein the second risk class is associated with a second subsequent action and the third risk class is associated with a third subsequent action,
- the method further comprising assigning the second network user to the second risk class responsive to the network activity score of the second network user, selecting the second subsequent action based on the second risk class to which the second network user is assigned, assigning the third network user to the third risk class responsive to the network activity score of the third network user, and selecting the third subsequent action based on the third risk class to which the third network user is assigned;
- wherein calculating the network activity score comprises estimating network flow data corresponding to each one of the plurality of network users;
- wherein estimating the network flow data comprises:
- estimating bandwidth utilization of each one of the plurality of network users;
- and
- estimating high-risk-access data corresponding to communications between each one of the plurality of network users and high-risk network sources;
- wherein assigning the second network user to the second risk class responsive to the network activity score of the second network user comprises assigning the second network user to a subscriber surveillance class, and
- wherein selecting the second subsequent action based on the second risk class to which the second network user is assigned comprises:
- gathering evidence of high-risk network activity;
- and
- adjusting the network activity score of the second network user responsive to gathering evidence of high-risk network activity;
- wherein gathering the evidence of high-risk network activity comprises:
- redirecting network traffic of the network user to a security node that is operable to analyze network activity of the network user via deep packet inspection.
18 more elements
A computer program product, comprising:
- a non-transitory computer readable medium comprising computer readable program code stored on the computer readable medium, the computer readable program code comprising:
- computer readable program code configured to calculate a network activity score that corresponds to a network usage pattern for each network user of a plurality of network users;
- computer readable program code configured to assign one network user of the plurality of network users into a first risk class of a plurality of risk classes responsive to the network activity score of the one network user;
- and
- computer readable program code configured to select a first subsequent action based on the first risk class to which the one network user is assigned,
- wherein the plurality of risk classes include at least the first risk class, a second risk class and a third risk class,
- wherein the plurality of network users include a first network user, a second network user and a third network user, and
- wherein the second risk class is associated with a second subsequent action and the third risk class is associated with a third subsequent action,
- the computer readable program code further comprising computer readable program code configured to assign the second network user to the second risk class responsive to the network activity score of the second network user, computer readable program code configured to select the second subsequent action based on the second risk class to which the second network user is assigned, computer readable program code configured to assign the third network user to the third risk class responsive to the network activity score of the third network user, and computer readable program code configured to select the third subsequent action based on the third risk class to which the third network user is assigned;
- wherein the computer readable program code configured to calculate the network activity score comprises computer readable program code configured to estimate network flow data corresponding to each one of the plurality of network users;
- wherein the computer readable program code configured to estimate the network flow data comprises:
- computer readable program code configured to estimate bandwidth utilization of each one of the plurality of network users;
- and
- computer readable program code configured to estimate high-risk-access data corresponding to communications between each one of the plurality of network users and high-risk network sources;
- wherein the computer readable program code configured to assign the second network user to the second risk class responsive to the network activity score of the second network user comprises computer readable program code configured to assign the second network user to a subscriber surveillance class, and
- wherein the computer readable program code configured to select the second subsequent action based on the second risk class to which the second network user is assigned comprises:
- computer readable program code configured to gather evidence of high-risk network activity;
- and
- computer readable program code configured to adjust the network activity score of the second network user responsive to gathering evidence of high-risk network activity;
- wherein the computer readable program code configured to gather the evidence of high-risk network activity comprises:
- computer readable program code configured to redirect network traffic of the network user to a security node that is operable to analyze network activity of the network user via deep packet inspection.
18 more elements
Dependencies are inferred from the claim text.