Adaptive network security policies

Patent metadata

Field	Value
Publication number	US-10389760-B2
Application number	US-201314912665-A
Country	US
Kind code	B2
Filing date	Aug 19, 2013
Priority date	Aug 19, 2013
Publication date	Aug 20, 2019
Grant date	Aug 20, 2019

Abstract

A method and system for dynamic identification of network security policies are provided. The method comprises inspecting network traffic using a number of network inspection technologies; executing a first network security system to implement a first number of security policies to respond to a first number of threats identified by the number of network inspection technologies; executing a second network security system to implement a second number of security policies to respond to a second number of threats identified by the number of network inspection technologies; obtaining security intelligence from the first and second network security system; and adaptively reassessing the first and second number of security policies based on the security intelligence.

First claim

What is claimed:

1. A system comprising:
a first network security system that is configured to receive network traffic in a computer network, inspect the network traffic using a first set of security policies to generate first security intelligence associated with the network traffic, and forward the first security intelligence to a policy computer over the computer network;
the policy computer that is configured to receive the first security intelligence from the first network security system over the computer network, generate revised first security intelligence that include information from the first security intelligence and information from other security intelligence, and forward the revised first security intelligence to a second network security system over the computer network; and
the second network security system that is configured to receive the network traffic over the computer network, receive the revised first security intelligence from the policy computer over the computer network, identify a second set of security policies based on the revised first security intelligence, and inspect the network traffic using the second set of security policies to generate second security intelligence associated with the network traffic,
wherein the policy computer is configured to store the first security intelligence associated with the network traffic in a historical database,
wherein the second network security system is configured to forward the second security intelligence associated with the network traffic to the policy computer over the computer network,
wherein the policy computer is configured to receive the second security intelligence, generate revised second security intelligence that include information from the second security intelligence and information from the historical database, and forward the revised second security intelligence from the policy computer to a third network security system over the computer network, and
wherein the first network security system comprises a firewall (FW), the second network security system comprises an application identification system (AIS), and the third network security system comprises an intrusion prevention system (IPS).

2. The system of claim 1 , wherein the revised first security intelligence include information from the historical database.

3. The system of claim 1 , further comprising:
the third network security system that is configured to receive the network traffic over the computer network, receive the revised second security intelligence from the policy computer, identify a third set of security policies based on the revised second security intelligence, and inspect the network traffic using the third set of security policies to generate third security intelligence associated with the network traffic.

4. A method for dynamic identification of network security policies, the method comprising:
inspecting network traffic in a plurality of network security systems;
implementing a first security policy to respond to a first threat identified by a first network security system of the plurality of network security systems;
implementing a second security policy to respond to a second threat identified by a second network security system of the plurality of network security systems;
obtaining security intelligence from the first and second network security systems;
identifying a third security policy based on the security intelligence; and
implementing the third security policy in a third network security system of the plurality of network security systems,
wherein the first network security system comprises a firewall (FW), the second network security system comprises an application identification system (AIS), and the third network security system comprises an intrusion prevention system (IPS).

5. The method of claim 4 , further comprising:
storing the security intelligence in a historical database.

6. The method of claim 5 , wherein the third security policy is identified based on the security intelligence and other security intelligence stored in the historical database.

Assignees

• Trend Micro Inc

Inventors

• Bryson Harry
• Dodds Malcolm
• Lu Wei
• Palmer Julian

Classifications

• H04L63/02

  for separating internal from external traffic, e.g. firewalls · CPC title

• H04L63/205 Primary

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04W12/67

  Risk-dependent, e.g. selecting a security level depending on risk profiles · CPC title