Network Activity Association System and Method

• US 20140379911A1
• Filed: 06/21/2013
• Published: 12/25/2014
• Est. Priority Date: 06/21/2013
• Status: Abandoned Application

• Current Assignee: LogicNow Limited (GFI Software Limited)
• Original Assignee: GFI Software Ip Sarl
• Inventors: Fayssal, Samer Nabih, Galindo, Sergio
• Application Number:
  US13/923,786
• Publication Number:
  US 20140379911A1
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04W 12/065 Continuous authentication
• CPC Class Codes: H04W 12/08 Access security

Abstract

A method is provided for associating a networking device with a profile by analyzing a usage pattern of communicating over one or more network and comparing the usage pattern with a benchmark pattern of the profile. The method may authenticate the networking device that correlates with a profile within a threshold level of confidence. The method may identify the networking device using an address, such as a MAC address. The method may detect and analyze application usage for authentication. A system is provided for authenticating a networking device in accordance with the method.

Claims

1. A network activity association method operated on a computerized device with a processor and memory comprising:

(a) analyzing a network to detect an identifiable networking device;

(b) identifying the networking device using an address;

(c) associating the networking device with a profile;

(d) analyzing a usage pattern of communicating over the network for the profile to maintain a benchmark usage pattern;

(e) analyzing a subsequent usage pattern of communicating over the network for the profile;

(f) comparing the subsequent usage pattern with the benchmark usage pattern to determine a correlation;

(g) authenticating the profile with the correlation within a threshold level of confidence; and

(h) allowing access to the network for the profile that is authenticated and at least partially denying access to the network for the profile that fails to be authenticated;

wherein the profile is indicative of a user;

wherein the benchmark usage pattern is updatable;

wherein a plurality of networking devices is associable with the profile;

wherein the profile is storable in a database accessible from the network;

wherein the profile is accessible from the database over a plurality of networks.

2. The method of claim 1, wherein the address is a medium access control (MAC) address.

3. The method of claim 1, wherein the network is associable with a wireless router.

4. The method of claim 3, wherein step (c) further comprises:

(i) determining a network address for the wireless router to be included in a first list;

(j) determine the address for the networking device to be included in a second list;

(k) comparing the first list with the second list to determine a connective relationship between the networking device and the wireless router; and

(l) associating connection labels comprising location and time with the connective relationship in the profile.

5. The method of claim 1, wherein the usage pattern includes information relating to execution of applications on the networking device.

6. The method of claim 1, wherein a first device and a second device that are commonly simultaneously connected to the network are associable with the profile and increase compliance of the correlation within the threshold level of confidence.

7. The method of claim 1, wherein upon detecting a connection to the network by the profile that is authenticated for an additional network, the system includes the additional network in the profile and updates the correlation between the profile and the network.

8. The method of claim 1, wherein the method further comprises generating an alert for the profile that fails to be authenticated.

9. A network activity association method operated on a computerized device with a processor and memory comprising:

(a) analyzing a network associable with a wireless router to detect an identifiable networking device;

(b) identifying the networking device using an address;

(c) associating the networking device with a profile, further comprising;

(i) determining a network address for the wireless router to be included in a first list,

(ii) determining the address for the networking device to be included in a second list,

(iii) comparing the first list with the second list to determine a connective relationship between the networking device and the wireless router, and

(iv) associating connection labels comprising location and time with the connective relationship in the profile.

(d) analyzing a usage pattern of communicating over the network for the profile to maintain a benchmark usage pattern;

(e) analyzing a subsequent usage pattern of communicating over the network for the profile;

(f) comparing the subsequent usage pattern with the benchmark usage pattern to determine a correlation;

(g) authenticating the profile with the correlation within a threshold level of confidence; and

(h) allowing access to the network for the profile that is authenticated and at least partially denying access to the network for the profile that fails to be authenticated, an alert being generable for the profile that fails to be authenticated;

wherein the profile is indicative of a user;

wherein the benchmark usage pattern is updatable;

wherein a plurality of networking devices is associable with the profile.

10. The method of claim 9, wherein the address is a medium access control (MAC) address.

11. The method of claim 9, wherein the profile is storable in a database accessible from the network and wherein the profile is accessible from the database over a plurality of networks.

12. The method of claim 9, wherein the usage pattern includes information relating to execution of applications on the networking device.

13. The method of claim 9, wherein a first device and a second device that are commonly simultaneously connected to the network are associable with the profile and increase compliance of the correlation within the threshold level of confidence.

14. The method of claim 9, wherein upon detecting a connection by the profile that is authenticated to an additional network, the system includes the additional network in the profile and updates the correlation between the profile and the network.

15. A network activity association system comprising:

an association module to detect an identifiable networking device by performing the steps;

(a) analyzing a network to detect the identifiable networking device,

(b) identifying the networking device using an address, and

(c) associating the networking device with a profile; and

an authentication module to authenticate the profile by performing the steps;

(d) analyzing a usage pattern of communicating over the network for the profile to maintain a benchmark usage pattern,

(e) analyzing a subsequent usage pattern of communicating over the network for the profile,

(f) comparing the subsequent usage pattern with the benchmark usage pattern to determine a correlation,

(g) authenticating the profile with the correlation within a threshold level of confidence, and

(h) allowing access to the network for the profile that is authenticated and at least partially denying access to the network for the profile that fails to be authenticated,

wherein an alert is generable for the profile that fails to be authenticated;

wherein the profile is indicative of a user;

wherein the benchmark usage pattern is updatable;

wherein a plurality of networking devices are associable with the profile;

wherein the profile is storable in a database accessible from the network;

wherein the profile is accessible from the database over a plurality of networks;

wherein the network is associable with a wireless router.

16. The system of claim 15, wherein the address is a medium access control (MAC) address.

17. The system of claim 15, wherein step (c) further comprises:

(i) determining a network address for the wireless router to be included in a first list;

(j) determine the address for the networking device to be included in a second list;

(k) comparing the first list with the second list to determine a connective relationship between the networking device and the wireless router; and

(l) associating connection labels comprising location and time with the connective relationship in the profile.

18. The system of claim 15, wherein the usage pattern includes information relating to execution of applications on the networking device.

19. The system of claim 15, wherein a first device and a second device that are commonly simultaneously connected to the network are associable with the profile and increase compliance of the correlation within the threshold level of confidence.

20. The system of claim 15, wherein upon detecting a connection by the profile that is authenticated to an additional network, the system includes the additional network in the profile and updates the correlation between the profile and the network.