METHODS AND APPARATUS FOR AUTOMATIC SECURITY CHECKING IN SYSTEMS THAT MONITOR FOR IMPROPER NETWORK USAGE

• US 20080120688A1
• Filed: 11/22/2006
• Published: 05/22/2008
• Est. Priority Date: 11/22/2006
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Panek, Diana, Chorley, William, Qiu, Chaoxin Charles
• Granted Patent: US 9,047,465 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Methods and apparatus for automatic security checking in systems that monitor for improper network usage are disclosed. An example system to mitigate improper network usage disclosed herein comprises an alert processor to determine whether to issue a notification in response to an activity alert corresponding to monitored usage of a communication network by a user device, wherein the monitored usage occurs after the user device has been granted access to the communication network, and an automatic verifier to respond to the activity alert by causing at least one of an automatic validation command or an automatic disconnect command to be sent to the user device before the alert processor determines whether to issue the notification.

Claims

1. A system to mitigate improper network usage comprising:

an alert processor to determine whether to issue a notification in response to an activity alert corresponding to monitored usage of a communication network by a user device, wherein the monitored usage occurs after the user device has been granted access to the communication network; and

an automatic verifier to initiate transmission of at least one of an automatic validation command or an automatic disconnect command to the user device before the alert processor determines whether to issue the notification.

2. A system as defined in claim 1 wherein the automatic validation command comprises a network-initiated re-authentication request.

3. A system as defined in claim 1 wherein the automatic disconnect command comprises a network-initiated de-registration request.

4. A system as defined in claim 1 wherein the user device is configured to re-register with the communication network after responding to the automatic disconnect command.

5. A system as defined in claim 1 wherein the alert processor is configured to trigger the automatic verifier to generate the at least one of the automatic validation command or the automatic disconnect command based on at least one threshold counter configured to count at least one type of activity alert.

8. A system as defined in claim 1 further comprising a policy manager to provide policy rules to define types of suspicious network activity, and wherein the alert processor uses the policy rules to determine whether to at least one of issue the notification in response to the activity alert or trigger the automatic verifier to respond to the activity alert.

9. A system as defined in claim 8 wherein the policy rules are based on a historical analysis of prior network activity within the communication network.

10. A system as defined in claim 1 further comprising a notification interface to notify at least one of a user of the user device or an operation support system when the notification is issued by the alert processor.

13. A system as defined in claim 1 wherein the alert processor includes a session initiation protocol interface and wherein the alert processor is configured to obtain the activity alert by subscribing through the session initiation protocol interface to at least one call usage event package published by at least one call processor operating in the communication network.

14. A system as defined in claim 13 wherein the call processor is further configured to notify the alert processor of the activity alert through the session initiation protocol interface.

6. -7. (canceled)

11. -12. (canceled)

15. -23. (canceled)

24. A method to respond to an activity alert corresponding to monitored usage of a communication network by a user device, the method comprising:

signaling the user device to perform a validation procedure with the communication network when the activity alert corresponds to a first policy condition;

signaling the user device to perform a disconnect procedure with the communication network when the activity alert corresponds to a second policy condition; and

determining whether the activity alert corresponds to improper activity based on a result of at least one of the validation procedure or the disconnect procedure.

25. A method as defined in claim 24 wherein signaling the user device to perform the validation procedure comprises sending a network-initiated re-authentication request to the user device.

26. A method as defined in claim 24 wherein signaling the user device to perform the disconnect procedure comprises sending a network-initiated de-registration request to the user device.

28. A method as defined in claim 24 wherein the second policy condition comprises receiving an improper result from the validation procedure.

29. A method as defined in claim 28 wherein the method further comprises causing access to the communication network to be suspended for the user device after receiving an improper result from the disconnect procedure.

30. A method as defined in claim 24 wherein at least one of signaling the user device to perform the validation procedure or signaling the user device to perform the disconnect procedure is based on at least one threshold counter configured to count at least one type of activity alert.

32. A method as defined in claim 24 further comprising notifying at least one of a user of the user device or an operation support system when the activity alert is determined to correspond to the improper activity.

27. (canceled)

31. (canceled)

33. An article of manufacture storing machine readable instructions which, when executed, cause a machine to:

signal a user device operating in a communication network to perform a validation procedure with the communication network in response to an activity alert corresponding to a first policy condition;

signal the user device to perform a disconnect procedure with the communication network in response to an activity alert corresponding to a second policy condition; and

determine whether the activity alert corresponds to improper activity based on a result of at least one of the validation procedure or the disconnect procedure.

34. An article of manufacture as defined in claim 33 wherein the machine readable instructions, when executed, cause the machine to signal the user device to perform the validation procedure by sending a network-initiated re-authentication request to the user device.

35. An article of manufacture as defined in claim 33 wherein the machine readable instructions, when executed, cause the machine to signal the user device to perform the disconnect procedure by sending a network-initiated de-registration request to the user device.