Optimization of redundant usage patterns based on historical data and security constraints

Patent metadata

Field	Value
Publication number	US-11425100-B2
Application number	US-202016930555-A
Country	US
Kind code	B2
Filing date	Jul 16, 2020
Priority date	Jul 16, 2020
Publication date	Aug 23, 2022
Grant date	Aug 23, 2022

Abstract

Typically, a business desires to track and monitor all applications run on its servers. Nonetheless, one or more unauthorized applications may be running on the business's servers, exposing the business to potential regulatory liability and security breaches. Apparatus and methods are provided for isolating and disabling one or more unauthorized applications running on a server. The apparatus may comprise a system including a content-filtering web proxy server configured to filter outgoing requests and data associated with the requests. The system may also include a remediation framework configured to monitor request data in a proxy log stored by the proxy server. The remediation framework may be triggered to perform remedial action when the remediation framework determines that a request and associated data, as stored in the proxy log, meets predetermined conditions. The remediation framework, when triggered, may execute steps to truncate functionality of the unauthorized applications.

First claim

What is claimed is:

1. A system for quarantining shadow information technology (“IT”) comprising one or more unauthorized applications running on a server and for optimizing network traffic and enhancing data security, the system comprising:
a processor;
a memory;
a content-filtering web proxy server configured to filter HTTP requests and to store the HTTP requests and associated data in a proxy log;
a remediation framework configured to extract from the proxy log a group of HTTP requests received by the proxy server, each of the HTTP requests in the group being identified, by the remediation framework as:
including an IP address listing a predefined term;
having originated from a production server;
being associated with an account ID that identifies a service account;
being associated with either a user agent that identifies a program or not associated with any user name; and
being associated with an identification number that, in a central registry, identifies a production application;
the remediation framework being further configured to identify an anomalous HTTP request in the group by:
querying stored information associated with each of the identification numbers; and
identifying an IP address associated with one of the HTTP requests in the group that is anomalous based on the stored information associated with the identification number;

the remediation framework being configured to remove the anomalous HTTP request from the group to perform remedial action for the anomalous HTTP request, the remedial action including:
accessing the production server from which the anomalous HTTP request originated;
querying a directory to identify one or more authorized applications running on the production server from which the anomalous HTTP request originated;
quarantining one or more unauthorized applications running on the production server from which the anomalous HTTP request originated by moving each of the identified authorized applications from the production server to a replacement server, wherein after the quarantining the production server has been altered to be a modified production server;
creating a shadow account for accumulating third-party data requested by the modified production server and accumulating third-party data pushed to the modified production server; and
transmitting to the proxy server instructions to take remedial action;

the remediation framework being further configured to remove redundancies and enhance network performance by:
extracting from the group a subset of HTTP requests, each of the HTTP requests in the subset calling an IP address including a term, the term not being a term associated with a programming language;
when the HTTP requests in the subset are determined to be calling more than a threshold number of IP addresses, creating a first group including a predetermined number of IP addresses, the predetermined number being less than the threshold number, and a second group including the IP addresses not included in the first group; and
instructing the proxy server to intercept HTTP requests calling an IP address included in the second group and to re-direct the intercepted traffic to an IP address included in the first group of IP addresses; and

the proxy server for intercepting HTTP requests calling an IP address included in the second group and for re-directing the intercepted traffic to an IP address included in the first group of IP addresses.

2. The system of claim 1 wherein the proxy server is configured to execute the instructions received from the remediation framework to take remedial action by:
terminating all third-party data transmission to the modified production server;
redirecting to the shadow account all received third-party data directed to the modified production server;
in response to receiving a new HTTP request from the modified production server, forwarding a copy of the HTTP request to the shadow account;
executing the new HTTP request; and
when a response to the new HTTP request is received, linking the response to the new HTTP request and transmitting the response and the new HTTP request to the shadow account;

wherein:
completion, by the proxy server, of the remedial action truncates functionality of the one or more unauthorized applications running on the modified production server.

3. The system of claim 1 wherein:
creation, by the remediation framework, of the first group includes identifying IP addresses for which a Service Level Agreement (“SLA”) contract is in place with a company supporting the IP address;
when the number of IP addresses for which an SLA contract is in place is less than the predetermined number, including each of the IP addresses for which an SLA contract is in place in the first group; and
when the number of IP addresses for which an SLA contract is in place is greater than the predetermined number, ranking the IP addresses for which an SLA contract is in place based on the terms of the SLA contract, the terms including usage terms and conditions, and including in the first group the predetermined number of IP addresses, the IP addresses included in the group having the highest ranking.

4. The system of claim 3 wherein including an IP address in the second group includes automatically terminating an existing SLA with a company supporting the IP address.

5. The system of claim 3 wherein, in the event that an IP address in the first group is supported by a company for which no Service Level Agreement (“SLA”) is in place, automatically generating a request to a company representative to establish a contract with the company supporting the IP address.

6. The system of claim 1 further comprising:
the remediation server being configured to instruct the proxy server, upon the lapse of a predetermined time period, to block all HTTP requests calling an IP address included in the second group; and
the proxy server being configured to block all HTTP requests calling an IP address included in the second group in response to receipt of the instructions from the remediation server.

7. The system of claim 1 wherein:
the term is selected from a list of predefined terms, the predefined terms including the terms ‘weather’, ‘stock’, ‘temperature’ and ‘forecast’; and
the term does not include the term ‘API’, ‘www’, and ‘.com’ and ‘.org’.

8. The system of claim 1 , when the anomalous HTTP request is a first anomalous HTTP request, wherein:
the remediation framework is configured to identify a second anomalous HTTP request, the identification of the second anomalous HTTP request including the remediation framework performing an initial analysis including an initial filtering of the HTTP requests included in the group prior to the extracting from the group the subset of HTTP requests, the analysis comprising, for each HTTP request included in the group:
extracting from each HTTP request included in the group an API identifier;
querying a database to determine if the API identifier matches a stored API identifier;
when the API identifier matches a stored API identifier, retrieving from the database a usage limit including a maximum number of calls, including the API identifier, permitted to be generated during a service level agreement (“SLA”) time period;
extracting from the proxy log a first HTTP request associated with a first timestamp and a second HTTP request associated with a second timestamp wherein:
the first HTTP request is a most-recently fired HTTP request including the API identifier; and
a number of HTTP requests including the API identifier that were fired during a duration extending between, and including, the first timestamp the second timestamp is equal to the maximum number of calls;

when a period

Assignees

• Bank Of America

Inventors

• Ramaswamy Varadharajan Candhadai
• Ogrinz Michael

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/0281 Primary

  Proxies · CPC title

• H04L41/5006

  Creating or negotiating SLA contracts, guarantees or penalties · CPC title

• H04L63/1491

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title