Protecting network devices from suspicious communications

• US 10,243,979 B2
• Filed: 02/10/2016
• Issued: 03/26/2019
• Est. Priority Date: 02/11/2015
• Status: Active Grant

• Current Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Original Assignee: Comcast Cable Communications LLC (Comcast Corporation)
• Inventors: Poder, James, Francisco, Mark D.
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Gyorfi, Thomas A
• Application Number:
  US15/040,670
• Publication Number:
  US 20160234232A1
• Time in Patent Office: 1,140 Days
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

According to some aspects, disclosed methods and systems may comprise generating a profile that is based on monitoring a communication pattern associated with a device. Subsequent communications associated with the device may be monitored. Based on the profile and the subsequent communication, a security status may be associated with the device.

Claims

1. A method comprising:

generating, by a computing device and based on monitored communication associated with a first device at a first time, a profile of expected communication behavior for the first device, wherein the first device is associated with a first network;

determining, based on the profile and based on monitored communication associated with the first device at a second time, a degree of communication deviation associated with the first device;

comparing the degree of communication deviation with a plurality of different deviation ranges, wherein each of the deviation ranges is associated with one or more corresponding communication parameters; and

causing, based on the comparing, application of one or more communication parameters to communication of the first device.

2. The method of claim 1, further comprising:

determining, from a plurality of communication parameters, a first communication parameter based on the degree of communication deviation being within a first deviation range,

wherein the first communication parameter has fewer restrictions than a second communication parameter associated with a second deviation range.

3. The method of claim 2, further comprising:

determining, based on another monitoring of communication associated with the first device, a second degree of communication deviation within the second deviation range; and

causing, based on the second degree of communication deviation, application of the second communication parameter to communication of the first device.

4. The method of claim 3, further comprising updating, based on the second degree of communication deviation, the profile.

5. The method of claim 1, further comprising:

determining, based on another monitoring of communication associated with the first device, a second degree of communication deviation;

associating, based on the second degree of communication deviation, the first device with a different security status; and

causing, based on the different security status, application of one or more different communication parameters to communication of the first device, blocking communication to or from the first device, or allowing communication to or from the first device.

6. The method of claim 1, further comprising:

determining a communication attempt from a second device to the first device;

evaluating a security status associated with the second device; and

restricting, based on the evaluated security status and on the applied one or more communication parameters, communication associated with the communication attempt.

7. The method of claim 1, wherein the generating the profile is further based on one or more of:

a packet size associated with communication to or from the first device;

or

timing information associated with communication to or from the first device.

8. The method of claim 1, wherein the determining degree of communication deviation is further based on different weights for a plurality of communication deviation types associated with the first device.

9. The method of claim 1, further comprising:

setting, based on determining that a sensor type of a second device corresponds to a sensor type of the first device, a security status of the second device by using the profile of expected communication behavior for the first device.

10. A method comprising:

generating, based on monitored communication between a first device and a second device via a network, a profile of expected communication behavior for the first device;

determining, based on the profile and based on monitored subsequent communication associated with the first device, a degree of communication deviation;

comparing the degree of communication deviation with a plurality of different deviation ranges, wherein each of the deviation ranges is associated with one or more corresponding communication parameters;

causing, based on the comparing, application of one or more communication parameters to communication of the first device; and

controlling, based on the application, network access associated with the first device.

11. The method of claim 10, wherein the applied one or more communication parameters comprises one or more of:

a restriction on a packet size transmitted from the first device;

a restriction on a communication time for the first device;

a restriction on a communication attempt from the first device to another device;

or

a restriction on a communication attempt from another device to the first device.

12. The method of claim 10, wherein the controlling network access comprises:

restricting communication associated with a device that is not on a list of approved devices.

13. The method of claim 10, wherein the second device is associated with a second network external to the network.

14. The method of claim 12, wherein the controlling network access comprises:

allowing communication associated with a device that is on the list of approved devices.

15. The method of claim 10, wherein the controlling network access comprises restricting communication associated with a device that is on a list of approved devices.

16. A method comprising:

generating, by a computing device;

a first profile of expected communication behavior for a first device associated with a network; and

a second profile of expected communication behavior for a second device;

monitoring;

communication associated with the first device; and

communication associated with the second device;

determining, based on the first profile and based on the monitored communication associated with the first device, a first degree of communication deviation associated with the first device, wherein the first degree is within a first range;

determining, based on the second profile and based on the monitored communication associated with the second device, a second degree of communication deviation associated with the second device, wherein the second degree is within a second range different from the first range; and

causing, based on the first degree and the second degree, application of one or more communication parameters to communication between the first device and the second device.

17. The method of claim 16, wherein a degree of communication deviation within the second range is greater than a degree of communication deviation within the first range.

18. The method of claim 16, further comprising:

determining, based on another monitoring of communication associated with the second device, a third degree of communication deviation within the first range; and

causing, based on the third degree of communication deviation within the first range, application of one or more different communication parameters to communication between the first device and the second device.

19. The method of claim 16, further comprising:

determining a first communication attempt from the second device to the first device;

blocking communication associated with the first communication attempt;

determining, based on another monitoring of communication associated with the second device, a third degree of communication deviation within the first range;

determining a second communication attempt from the second device to the first device; and

allowing, based on a combination of the first degree of communication deviation and the third degree of communication deviation, communication associated with the second communication attempt.

20. The method of claim 16, further comprising:

causing, based on the first profile, application of a first weight for a communication deviation type in determining the first degree of communication deviation; and

causing, based on the second profile, application of a second weight different from the first weight for the communication deviation type in determining the second degree of communication deviation,

wherein the communication deviation type comprises one or more of;

a deviation of a communication packet size;

a deviation of a communication time;

a deviation of a communication frequency; and

a deviation of a communication target device.