System for dynamic node analysis for network security response

Patent metadata

Field	Value
Publication number	US-12160435-B2
Application number	US-202117542973-A
Country	US
Kind code	B2
Filing date	Dec 6, 2021
Priority date	Dec 6, 2021
Publication date	Dec 3, 2024
Grant date	Dec 3, 2024

Abstract

Systems, computer program products, and methods are described herein for dynamic node analysis for network security response. The present invention is configured to detect, using a node analysis engine, a change in a network security protocol associated with a first node within a distributed network; extract information associated with the change in the network security protocol associated with the first node; identify one or more adjacent nodes with a first degree of separation from the first node in response to detecting the change; determine a first set of changes to the network security protocols for the one or more adjacent nodes based on at least the information associated with the change in the network security protocol of the first node; and automatically implement the first set of changes to the network security protocols of the one or more adjacent nodes with the first degree of separation from the first node.

First claim

What is claimed is:

1. A system for dynamic node analysis for network security response, the system comprising:
a processor;
a non-transitory storage device containing instructions that, when executed by the processor, cause the processor
to:

detect, using a node analysis engine, a change in a network security protocol associated with a first node within a distributed network;
extract information associated with the change in the network security protocol associated with the first node;
identify one or more adjacent nodes with a first degree of separation from the first node in response to detecting the change;
determine a first set of changes to the network security protocols for the one or more adjacent nodes based on at least the information associated with the change in the network security protocol of the first node, wherein determining the first set of changes further comprises:
initiating a machine learning model on the information associated with the change in the network security protocol associated with the first node;
classifying, using the machine learning model, the change in the network security protocol associated with the first node into one or more classes;
retrieving one or more preset changes to the network security protocols associated with the one or more classes; and
determining the first set of changes to the network security protocols for the one or more adjacent nodes from the one or more preset changes; and

automatically implement the first set of changes to the network security protocols of the one or more adjacent nodes with the first degree of separation from the first node.

2. The system of claim 1 , wherein the network security protocol comprises at least one or more security controls, wherein the one or more security controls comprises at least a timeout adjustment, an authentication escalation, a re-authentication requirement, a bandwidth restriction adjustment, and/or a communication technology requirement.

3. The system of claim 1 , wherein the instructions, when executed, further cause the processor to:
continuously monitor, using the node analysis engine, the network security protocols associated with the one or more nodes within the distributed network; and
detect the change in the network security protocol associated with the first node based on at least the continuous monitoring.

4. The system of claim 1 , wherein the instructions, when executed, further cause the processor to:
retrieve, from a data repository, one or more detected changes to the network security protocols associated with one or more nodes;
retrieve, from the data repository, one or more sets of changes to the network security protocols of the one or more adjacent nodes with the first degree of separation from the one or more nodes implemented in response to the one or more detected changes;
initiate a machine learning algorithm on the one or more detected changes to the network security protocols associated with the one or more nodes and one or more sets of changes to the network security protocols of the one or more adjacent nodes with the first degree of separation from the one or more nodes; and
train, using the machine learning algorithm, the machine learning model, wherein training further comprises determining one or more classification parameters for the machine learning model.

5. The system of claim 4 , wherein the instructions, when executed, further cause the processor to:
classify, using the one or more classification parameters, the change in the network security protocol associated with the first node into the one or more classes.

6. The system of claim 1 , wherein the instructions, when executed, further cause the processor to:
identify one or more adjacent nodes with a second degree of separation from the first node in response to detecting the change;
determine a second set of changes to the network security protocols for the one or more adjacent nodes with the second degree of separation from the first node based on at least the information associated with the change in the network security protocol of the first node and the first set of changes implemented to the network security protocols of the one or more adjacent nodes with the first degree of separation from the first node; and
automatically implement the second set of changes to the network security protocols of the one or more adjacent nodes with the second degree of separation from the first node.

7. A computer program product for dynamic node analysis for network security response, the computer program product comprising a non-transitory computer-readable medium comprising code causing a first apparatus to:
detect, using a node analysis engine, a change in a network security protocol associated with a first node within a distributed network;
extract information associated with the change in the network security protocol associated with the first node;
identify one or more adjacent nodes with a first degree of separation from the first node in response to detecting the change;
determine a first set of changes to the network security protocols for the one or more adjacent nodes based on at least the information associated with the change in the network security protocol of the first node, wherein determining the first set of changes further comprises:
initiating a machine learning model on the information associated with the change in the network security protocol associated with the first node;
classifying, using the machine learning model, the change in the network security protocol associated with the first node into one or more classes;
retrieving one or more preset changes to the network security protocols associated with the one or more classes; and
determining the first set of changes to the network security protocols for the one or more adjacent nodes from the one or more preset changes; and

automatically implement the first set of changes to the network security protocols of the one or more adjacent nodes with the first degree of separation from the first node.

8. The computer program product of claim 7 , wherein the network security protocol comprises at least one or more security controls, wherein the one or more security controls comprises at least a timeout adjustment, an authentication escalation, a re-authentication requirement, a bandwidth restriction adjustment, and/or a communication technology requirement.

9. The computer program product of claim 7 , wherein the code further causes the first apparatus to:
continuously monitor, using the node analysis engine, the network security protocols associated with the one or more nodes within the distributed network; and
detect the change in the network security protocol associated with the first node based on at least the continuous monitoring.

10. The computer program product of claim 7 , wherein the code further causes the first apparatus to:
retrieve, from a data repository, one or more detected changes to the network security protocols associated with one or more nodes;
retrieve, from the data repository, one or more sets of changes to the network security protocols of the one or more adjacent nodes with the first degree of separation from the one or more nodes implemented in response to the one or more detected changes;
initiate a machine learning algorithm on the one or more detected changes to the network security protocols associated with the one or more nodes and one or more sets of changes to the network security protocols of the one or more adjacent nodes with the first degree of separation from the one or more nodes; and
train, using the machine learning algorithm, the machine learning m

Assignees

• Bank Of America

Inventors

• Sloane Brandon
• Ogrinz Michael
• Dudley Charles Edward

Classifications

• G06N5/022

  Knowledge engineering; Knowledge acquisition · CPC title

• H04L41/0816

  the condition being an adaptation, e.g. in response to network events · CPC title

• H04L41/147

  for predicting network behaviour · CPC title

• H04L63/205

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title