Behavior-based traffic profiling based on access control information

Patent metadata

Field	Value
Publication number	US-8955119-B2
Application number	US-201314019101-A
Country	US
Kind code	B2
Filing date	Sep 5, 2013
Priority date	Apr 3, 2009
Publication date	Feb 10, 2015
Grant date	Feb 10, 2015

Abstract

A method includes receiving one or more of user information, role information, or authorization information associated with a user accessing a network, selecting a traffic flow to monitor that is associated with the one or more of user information, role information, or authorization information, monitoring the traffic flow, determining whether an anomaly exists with respect to the traffic flow based on a traffic behavior pattern associated with the one or more of user information, role information, or authorization information, and performing a security response when it is determined that the anomaly exists.

First claim

What is claimed is:

1. A device comprising:
one or more processors to:
obtain, from a security device, traffic flow information associated with a user accessing a resource via a network,
the traffic flow information being generated based on monitoring network traffic associated with the user accessing the resource, and
the traffic flow information including information indicating a user role associated with the user and information identifying a source address and a destination address associated with the user accessing the resource;

determine, based on the information identifying the source address and the destination address, a user device and a destination device associated with the user accessing the resource;
determine whether a traffic behavior pattern, associated with the user role, exists;
when the traffic behavior pattern exists, the one or more processors are to:
update the traffic behavior pattern based on the traffic flow information, the user device, and the destination device to form an updated traffic behavior pattern;

when the traffic behavior pattern does not exist, the one or more processors are to:
determine, based on the traffic flow information, a quantity of sessions associated with the user accessing the resource is greater than a threshold quantity of sessions;
generate, based on the quantity of sessions being greater than the threshold quantity of sessions, the traffic behavior pattern based on the traffic flow information and information associated with the user device and the destination device; and

provide one of the updated traffic behavior pattern or the generated traffic behavior pattern to the security device,
the one of the updated traffic behavior pattern or the created traffic behavior pattern permitting the security device to control access, by the user, to the resource.

2. The device of claim 1 , where the one or more processors are further to:
receive user information from the user device;
grant the user device access to the network based on the user information; and
provide the user information to the security device to cause the security device to monitor the network traffic.

3. The device of claim 1 , where the traffic flow information includes information identifying a quantity of data included in one or more traffic flows associated with the user accessing the resource;
where the one or more processors are to:
determine, based on the quantity of data included in the one or more traffic flows, a volume of traffic per session associated with the user accessing the resource;

where, when updating the traffic behavior pattern, the one or more processors are to:
update the traffic flow pattern based on the volume of traffic per session associated with the user accessing the resource; and

where, when generating the traffic behavior pattern, the one or more processors are to:
generate the traffic flow pattern based on the volume of traffic per session associated with the user accessing the resource.

4. The device of claim 1 , where the one or more processors are to:
determine, based on the traffic flow information, a type of service accessed by the user, and
determine, based on the type of service accessed by the user, one or more services associated with the user role;
where, when updating the traffic behavior pattern, the one or more processors are to:
update the traffic behavior pattern based on the one or more services associated with the user role; and

where, when generating the traffic behavior pattern, the one or more processors are to:
generate the traffic behavior pattern based on the one or more services associated with the user role.

5. The device of claim 1 , where the user role includes one or more of:
a user role associated with a job title associated with the user, or
a user role associated with an access level associated with the user.

6. The device of claim 1 , where, when the traffic pattern does not exist, the one or more processors are further to:
associate the generated traffic behavior pattern with one or more of:
the user role,
information provided by the user to access the network, or
information identifying the user.

7. The device of claim 1 , where the one of the updated traffic behavior pattern or the generated traffic behavior pattern is compared to the traffic flow information to determine whether to perform a security response associated with the user accessing the resource.

8. A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by one or more processors, cause the one or more processors to:
obtain, from a security device, traffic flow information associated with a user accessing a resource via a network,
the traffic flow information being generated based on monitoring network traffic associated with the user accessing the resource, and
the traffic flow information including information indicating a user role associated with the user and information identifying a source address and a destination address associated with the user accessing the resource;

determine, based on the information identifying the source address and the destination address, a user device and a destination device associated with the user accessing the resource;
determine whether a traffic pattern, associated with the user role, exists;
update, when the traffic pattern exists, the traffic pattern based on the traffic flow information, the user device, and the destination device;
when the traffic pattern does not exist:
determine, based on the traffic flow information, that a quantity of sessions associated with the user accessing the resource is greater than a threshold quantity of sessions;
generate, based on the quantity of sessions being greater than the threshold quantity of sessions, the traffic pattern based on the traffic flow information and information associated with the user device and the destination device; and

provide one of the updated traffic pattern or the generated traffic pattern to the security device,
the one of the updated traffic pattern or the generated traffic pattern permitting the security device to control access, by the user, to the resource.

9. The non-transitory computer-readable medium of claim 8 , where the instructions further comprise:
one or more instructions that, when executed by the one or more processors, cause the one or more processors to:
receive user information from the user device;
grant the user device access to the network based on the user information; and
provide the user information to the security device to cause the security device to monitor the network traffic.

10. The non-transitory computer-readable medium of claim 8 , where the traffic flow information includes information identifying a quantity of data included in one or more traffic flows associated with the user accessing the resource;
where the instructions further comprise:
one or more instructions that, when executed by the one or more processors, cause the one or more processors to determine, based on the quantity of data included in the one or more traffic flows, a volume of traffic per session associated with the user accessing the resource;

where the one or more instructions to update the traffic behavior pattern include:
one or more instructions that, when executed by the one or more processors, cause the one or more processors to update the traffic flow pattern based on the volume of traffic per session associated with the user accessing the resource; and

where the one or more instructions to generate the traffic behavior pattern include:
one or more instructions that, when execut

Assignees

• Juniper Networks Inc

Inventors

• Zhao Ye

Classifications

• H04L12/2602

  Electricity · mapped topic

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L67/22

  Electricity · mapped topic

• H04L67/306

  User profiles · CPC title