Methods, Devices and Computer Program Products for Regulating Network Activity Using a Subscriber Scoring System

• US 20100169474A1
• Filed: 12/29/2008
• Published: 07/01/2010
• Est. Priority Date: 12/29/2008
• Status: Active Grant

• Current Assignee: Uber Technologies, Inc.
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Chawla, Deepak, Beckett, William R. III
• Granted Patent: US 8,275,899 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Network activity in a network is regulated. Network activity scores that correspond to network usage patterns for respective network users are calculated. A network user is assigned into one of multiple risk classes responsive to a respective one of the network activity scores. A subsequent action is selected responsive to which of the risk classes the network user is assigned.

Claims

1. A method of regulating network activity in a network, the method comprising:

calculating a plurality of network activity scores that correspond to network usage patterns for respective ones of a plurality of network users;

assigning a network user of the plurality of network users into one of a plurality of risk classes responsive to a respective one of the plurality of network activity scores; and

selecting a subsequent action responsive to which of the plurality of risk classes the network user is assigned.

2. The method according to claim 1, wherein calculating the plurality of network activity scores comprises estimating network flow data corresponding to ones of the plurality of network users.

3. The method according to claim 2, wherein the network comprises the Internet and wherein estimating network flow data comprises:

estimating bandwidth utilization of ones of the plurality of network users; and

estimating high-risk-access data corresponding to communications between ones of the plurality of users and high-risk network sources.

4. The method according to claim 3, wherein high-risk-access data comprises percent bandwidth in file sharing networks, frequency of communication with known malicious sources, bandwidth ingress-to-egress ratios, and/or rate of spamming activity.

5. The method according to claim 1, wherein assigning the network user of the plurality of network users into one of the plurality of risk classes comprises:

comparing the respective network activity score of the plurality of network activity scores to a plurality of score ranges corresponding to the plurality of risk classes; and

identifying one of the plurality of risk classes based on the respective network activity score being within a corresponding one of the plurality of score ranges.

6. The method of claim 1, wherein assigning the network user of the plurality of network users into one of the plurality of risk classes comprises assigning the network user to a subscriber monitoring class, and

wherein selecting the subsequent action responsive to which of the plurality of risk classes the network user is assigned comprises monitoring the respective network activity score of the network user and, if the network activity score indicates an increase in network activity risk, flagging the network user.

7. The method according to claim 1, wherein assigning the network user of the plurality of network users into one of the plurality of risk classes comprises assigning the network user to a subscriber surveillance class, and

wherein selecting the subsequent action responsive to which of the plurality of risk classes the network user is assigned comprises:

gathering evidence of high-risk network activity; and

adjusting the network activity score responsive to gathering evidence of high-risk network activity.

8. The method according to claim 7, wherein gathering evidence of high-risk network activity comprises:

redirecting network traffic of the network user to a security node that is operable to analyze the network activity of the network user via deep packet inspection.

9. The method according to claim 1, wherein assigning the network user of the plurality of network users into one of the plurality of risk classes comprises assigning the network user to a subscriber protection class, and

wherein selecting the subsequent action responsive to which of the plurality of risk classes the network user is assigned comprises:

monitoring the respective network activity score of the network user;

denying network access by the network user to known high-risk network sources; and

providing risk mitigation services to the network user.

10. The method according to claim 9, wherein providing risk mitigation services to the network user comprises:

notifying the network user regarding high-risk network activity;

providing network services to the network user that are operable to remove sources of high-risk network activity from a network device used by the network user.

11. The method according to claim 1, wherein assigning the network user of the plurality of network users into one of the plurality of risk classes comprises assigning the network user to a subscriber quarantine class, and

wherein selecting the subsequent action responsive to which of the plurality of risk classes the network user is assigned comprises:

isolating the network user from the network;

providing network device restoration services to the network user.

12. The method according to claim 1, further comprising generating a network activity score model that is operable to provide a plurality of network activity scores that correspond to network usage patterns for respective ones of a plurality of network users.

13. The method according to claim 12, wherein generating a network activity score model comprises:

estimating a plurality of model network activity scores that correspond to each of a portion of the plurality of network users;

estimating a probability distribution corresponding to the plurality of model network activity scores;

determining an accuracy of the plurality of model network activity scores; and

if the accuracy is below a predetermined threshold, modifying estimating the plurality of model network activity scores to improve the accuracy of the plurality of model network activity scores.

14. The method according to claim 13, wherein determining the accuracy of the plurality of model network activity scores comprises:

estimating an actual risk corresponding to each of the portion of the plurality of network users via detailed user network activity data; and

comparing the actual risk to a predicted risk that corresponds to each a plurality of model network activity scores.

15. The method according to claim 14, wherein estimating the actual risk corresponding to each of the portion of the plurality of network users further comprises receiving externally generated network activity data corresponding to the portion of the plurality of network users.

16. The method according to claim 1, wherein the network includes the Internet, wherein the network users include subscribers to an internet service, wherein the network activity is regulated by an Internet Service Provider (ISP), and wherein each of the plurality of network activity scores includes a Subscriber Reputation Score that correlates to a security risk of the subscriber.

17. A computer program product comprising:

a computer readable storage medium having computer readable program code embodied therein, the computer readable program code comprising;

computer readable program code configured to generate a network activity score model that is operable to provide a plurality of network activity scores that correspond to network usage patterns for respective ones of a plurality of network users;

computer readable program code configured to calculate, using the network activity score model, the plurality of network activity scores that correspond to network usage patterns for respective ones of a plurality of network users;

computer readable program code configured to assign a network user of the plurality of network users into one of a plurality of risk classes responsive to a respective one of the plurality of network activity scores; and

computer readable program code configured to select a subsequent action responsive to which of the plurality of risk classes the network user is assigned.

18. The computer program product according to claim 17, wherein the computer readable program code configured to assign the network user of the plurality of network users into one of the plurality of risk classes comprises:

computer readable program code configured to compare the respective network activity score of the plurality of network activity scores to a plurality of score ranges corresponding to the plurality of risk classes; and

computer readable program code configured to identify one of the plurality of risk classes based on the respective network activity score being within a corresponding one of the plurality of score ranges, and

wherein the network includes the Internet, wherein the network users include subscribers to an internet service, and wherein each of the plurality of network activity scores includes a Subscriber Reputation Score (SRS) that correlates to a security risk of the subscriber.

19. The computer program product according to claim 17, wherein the computer readable program code configured to generate a network activity score model comprises:

computer readable program code configured to estimate a plurality of model network activity scores that correspond corresponding to each of a portion of the plurality of network users;

computer readable program code configured to estimate a probability distribution corresponding to the plurality of model network activity scores;

computer readable program code configured to determine an accuracy of the plurality of model network activity scores; and

if the accuracy is below a predetermined threshold, computer readable program code configured to modify estimating the plurality of model network activity scores to improve the accuracy of the plurality of model network activity scores.

20. A device for generating a network activity score, the device comprising:

a network activity score estimating module that is operable to estimate a plurality of model network activity scores that correspond to each of a portion of a plurality of network users;

a probability distribution estimating module that is operable to estimate a probability distribution corresponding to the plurality of model network activity scores;

an accuracy module that is operable to determine an accuracy of the plurality of model network activity scores; and

a modification module that is operable, if the accuracy is below a predetermined threshold, to modify operations in the network activity score estimating module to improve the accuracy of the plurality of model network activity scores.