Network data collection and response system

Patent metadata

Field	Value
Publication number	US-9854057-B2
Application number	US-201414270937-A
Country	US
Kind code	B2
Filing date	May 6, 2014
Priority date	May 6, 2014
Publication date	Dec 26, 2017
Grant date	Dec 26, 2017

Abstract

Embodiments include a network data collection and response system for enhancing security in an enterprise network providing a user-supplied computing device with access to the network. A network data collection and response system tracks network activity of the device and maintains a device inventory recording the device type and configuration information for the device along with a resource utilization profile for the device. The network data collection and response system detects high-risk or unauthorized network activity involving the device through passive monitoring without utilization of a data monitoring agent installed on the device and implements a response action to mitigate the high-risk or unauthorized network.

First claim

What is claimed is:

1. An enterprise network that is accessible to a computing device, the enterprise network comprising:
local network resources accessible to the device via the enterprise network;
a connection protocol server comprising a memory storing instructions and a processor executing the instructions, the processor of the connection protocol server executing instructions to assign a network address to the device to identify the device on the enterprise network in response to a network access request received from the device;
a network data collection and response system of the enterprise network that is operative to track network activity of the device including a device inventory comprising device type and configuration information for the device and a resource utilization profile for the device without utilization of a data monitoring agent installed on the device;
the network data collection and response system of the enterprise network is further operative to detect high-risk or unauthorized network activity involving the device through passive monitoring without utilization of a monitoring agent installed on the device, wherein to detect high-risk or unauthorized network activity comprises identifying attempted access to applications that offer services that are not authorized by the enterprise;
the network data collection and response system further operative to implement a response action to mitigate the high-risk or unauthorized network activity, wherein the response action comprises one or more of:
blocking the unauthorized network activity and providing notice to a user of the device that the device has attempted to conduct unauthorized network activity;
notifying a user or monitoring system of the device of malware present on the device and removal of the malware from the device;
detecting malware transmitted from the device; and
removal of the malware from the enterprise network.

2. The enterprise network of claim 1 , further comprising a gateway configured in a local network to provide the device with access to external resources via the local network.

3. The enterprise network of claim 1 , wherein the passively monitored network activity includes one or more of a dynamic host configuration protocol (DHCP) request received from the device and a domain name server (DNS) request received from the device.

4. The enterprise network of claim 1 , wherein the passively monitored network activity includes one or more of a network flow information derived from network packets sent and received by the device and a hypertext transfer protocol (HTTP) request sent and response received by the device.

5. The enterprise network of claim 1 , wherein the high-risk or unauthorized network activity comprises one or more of:
a combination of resources accessed by the device consistent of a high-risk activity profile maintained by the system; and
short response times and periodic response patterns indicative of programmatic or robot activity.

6. The enterprise network of claim 1 , wherein the network data collection and response system tracks and profiles the resource utilization of a device.

7. The enterprise network of claim 1 , wherein the network data collection infers one or more of the type and configuration information of the device.

8. A computer program product for providing a user-supplied computing device with access to an enterprise network comprising local network resources accessible to the device via the enterprise network, the computer program product comprising:
a non-transitory computer readable storage medium readable by a processing circuit and storing instructions that, when executed by the processing circuit, perform a method comprising:
tracking, by the enterprise network, network activity of the device through passive monitoring without utilization of a data monitoring agent installed on the device;
inferring type and configuration information of the device;
creating a device inventory comprising device type and one or more of configuration information for the device and a resource utilization profile for the device;
detecting, by the enterprise network, one or more of high-risk or unauthorized network activity involving the device, wherein the detecting high-risk or unauthorized network activity comprises identifying attempted access to applications that offer services that are not authorized by the enterprise; and
implementing a response action to mitigate the high-risk or unauthorized network activity, wherein the response action comprises one or more of:
blocking the unauthorized network activity and providing notice to a user of the device that the device has attempted to conduct unauthorized network activity;
notifying a user or monitoring system of the device of malware present on the device and removal of the malware from the device;
detecting malware transmitted from the device; and
removal of the malware from the enterprise network.

9. The computer program product of claim 8 , wherein tracking network activity includes one or more of detecting and recording a dynamic host configuration protocol (DHCP) request received from the device, a domain name server (DNS) request received from the device, a network flow information derived from network packets sent and received by the device, and a hypertext transfer protocol (HTTP) request sent and response received by the device.

10. The computer program product of claim 8 , wherein the high-risk or unauthorized network activity comprises a combination of resources accessed by the device consistent of a high-risk activity profile maintained by the system.

11. The computer program product of claim 8 , wherein the high-risk or unauthorized network activity comprises a short response times indicative of robot activity.

12. The computer program product of claim 8 , wherein the network data collection and response system tracks and profiles the resource utilization of a device.

13. The computer program product of claim 8 , wherein the network data collection infers one or more of the type and configuration information of the device.

14. A network data recording and response system for enhancing security in a computer enterprise network providing a computing device with access to the enterprise network, the system operable for:
assigning, by a processor executing instructions stored on a memory of a connection protocol server, a network address to the device to identify the device on the enterprise network in response to a network access request received from the device;
tracking, by the enterprise network, network activity of the device through passive monitoring without utilization of a data monitoring agent installed on the device;
inferring one or more of type and configuration information of the device;
creating a device inventory comprising one or more of device type and configuration information for the device and a resource utilization profile for the device;
detecting, by the enterprise network, high-risk or unauthorized network activity involving the device, wherein the detecting high-risk or unauthorized network activity comprises identifying attempted access to applications that offer services that are not authorized by the enterprise; and
implementing a response action to mitigate the high-risk or unauthorized network activity, wherein the response action comprises one or more of:
blocking the unauthorized network activity and providing notice to a user of the device that the device has attempted to conduct unauthorized network activity;
notifying a user or monitoring system of the device of malware present on the device and

Assignees

• IBM

Inventors

• Chari Suresh N
• Cheng Pau-Chen
• Hu Xin
• Koved Lawrence
• Rao Josyula R
• Sailer Reiner
• Schales Douglas L
• Singh Kapil K
• Stoecklin Marc P

Classifications

• H04L67/22

  Electricity · mapped topic

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L67/303 Primary

  Terminal profiles · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L67/535

  Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34) · CPC title