Adaptive enforcement of security within a network

Patent metadata

Field	Value
Publication number	US-12452305-B2
Application number	US-202217672262-A
Country	US
Kind code	B2
Filing date	Feb 15, 2022
Priority date	Feb 15, 2022
Publication date	Oct 21, 2025
Grant date	Oct 21, 2025

Abstract

A system receives one or more ingress data packets from a client device or a user in a network. The system obtains attributes, via packet inspection, from the one or more ingress data packets, and determines one or more embedding vectors from the attributes. The one or more embedding vectors represent a status of a session during which the ingress data packets are obtained. The system transmits the one or more embedding vectors as inputs to a trained machine learning model. The system infers, using the trained machine learning mode, one or more security policies based on the embedding vectors. The system provides or implementing the one or more security policies.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving one or more ingress data packets from a client device or a user in a network;
obtaining attributes, via packet inspection, from the one or more ingress data packets;
determining one or more embedding vectors from the attributes, wherein the one or more embedding vectors represent a status of a session during which the ingress data packets are obtained;
transmitting the one or more embedding vectors as inputs to a trained machine learning model, wherein the machine learning model is trained using a first training dataset that indicates respective mappings of embedding vectors to security policies and a second training dataset generated based on incorrectly determined or incorrectly mapped security policies by the machine learning model; and
inferring, using the trained machine learning model, one or more security policies based on the embedding vectors; and
providing or implementing the one or more security policies.

2. The computer-implemented method of claim 1 , wherein the security policies comprise an operating system aspect, a networking aspect, a cryptographic aspect, and an application aspect.

3. The computer-implemented method of claim 2 , wherein the networking aspect is associated with intrusion detection, anti-malware, anti-virus protection, data loss prevention and a firewall.

4. The computer-implemented method of claim 2 , wherein the cryptographic aspects comprise tunneling parameters or attributes.

5. The computer-implemented method of claim 2 , wherein the application aspects comprise access control or log auditing attributes or parameters.

6. The computer-implemented method of claim 1 , wherein the determination of the one or more vectors comprises generating:
a first embedding vector corresponding to attributes associated with the client device or the user;
a second embedding vector corresponding to attributes associated with destination from which data is sought;
a third embedding vector corresponding to attributes associated with the network; and
a fourth embedding vector corresponding to attributes associated with the contextual parameters.

7. The computer-implemented method of claim 6 , wherein the attributes associated with the client device or the user comprise at least two of:
a location of the client device or the user;
bandwidth consumptions of different categories of content or applications by the client device or the user;
a reputation based on content accessed by the client device or the user; and
a frequency or number of security events triggered by the client device or the user.

8. The computer-implemented method of claim 6 , wherein the attributes associated with the destination comprise at least two of:
a deployment of the destination;

a transmission medium or protocol of the destination;
a reputation of the destination based on historical security attributes, parameters, or events;
an abnormality metric of the destination; and
a software stack or software embedding of the destination.

9. The computer-implemented method of claim 6 , wherein the attributes associated with the network comprise at least two of:
a network type;
health parameters of the network;
a distribution of priority traffic flows throughout the network;

a geolocation over which the network is distributed; and
one or more tags within the network.

10. A non-transitory storage medium storing instructions that, when executed by at least one processor of a computing system, cause the computing system to:
receive one or more ingress data packets from a client device or a user in a network;
obtain attributes, via packet inspection, from the one or more ingress data packets;
determine one or more embedding vectors from the attributes, wherein the one or more embedding vectors represent a status of a session during which the ingress data packets are obtained;
transmit the one or more embedding vectors as inputs to a trained machine learning model, wherein the machine learning model is trained using a first training dataset that indicates respective mappings of embedding vectors to security policies and a second training dataset generated based on incorrectly determined or incorrectly mapped security policies by the machine learning model; and
infer, using the trained machine learning model, one or more security policies based on the embedding vectors, wherein the security policies comprise an operating system aspect, a networking aspect, a cryptographic aspect, and an application aspect; and
providing or implementing the one or more security policies.

11. The non-transitory storage medium of claim 10 , wherein the security policies comprise an operating system aspect, a networking aspect, a cryptographic aspect, and an application aspect.

12. The non-transitory storage medium of claim 11 , wherein the networking aspect comprises attributes or parameters associated with intrusion detection, anti-malware, anti-virus protection, data loss prevention and a firewall.

13. The non-transitory storage medium of claim 10 , wherein the determination of the one or more vectors comprises generating:
a first embedding vector corresponding to attributes associated with the client device or the user;
a second embedding vector corresponding to attributes associated with destination from which data is sought;
a third embedding vector corresponding to attributes associated with the network; and
a fourth embedding vector corresponding to attributes associated with the contextual parameters.

14. A computer-implemented method, comprising:
receiving one or more ingress data packets from a client device or a user in a network;
obtaining attributes, via packet inspection, from the one or more ingress data packets;
determining one or more embedding vectors from the attributes, wherein the determination of the one or more vectors comprises generating
a first embedding vector corresponding to attributes associated with the client device or the user,
a second embedding vector corresponding to attributes associated with destination from which data is sought,
a third embedding vector corresponding to attributes associated with the network, and
a fourth embedding vector corresponding to attributes associated with the contextual parameters,
and wherein the one or more embedding vectors represent a status of a session during which the ingress data packets are obtained;
transmitting the one or more embedding vectors as inputs to a trained machine learning model; and
inferring, using the trained machine learning model, one or more security policies based on the embedding vectors; and
providing or implementing the one or more security policies.

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Gupta Gopal
• Mishra Abhinesh

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L63/0245

  Filtering by information in the payload · CPC title