System, Method, and Computer Program Product for Isolating a Device Associated with At Least Potential Data Leakage Activity, Based on User Input

• US 20160246962A1
• Filed: 02/16/2016
• Published: 08/25/2016
• Est. Priority Date: 08/29/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Sankararaman, Srinivasan, Kolingivadi, Deepakeswaran
• Granted Patent: US 10,872,148 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system, method, and computer program product are provided for isolating a device associated with at least potential data leakage activity, based on user input. In operation, at least potential data leakage activity associated with a device is identified. Furthermore, at least one action is performed to isolate the device, based on user input received utilizing a user interface.

Claims

1. A computer-implemented method, comprising:

receiving, by a first computer system, a first notification from a third computer indicating the third computer detected a potential data leakage activity on a second computer;

generating a user prompt on the first computer system in response to receiving the first notification from the third computer, wherein the user prompt comprises a plurality of choices for isolating the second computer, wherein at least one of the plurality of choices is received from the third computer in the first notification;

receiving a user input after generating the user prompt, the user input indicating a selection of one of the choices; and

attempting to isolate the second computer based on the selected choice.

2. The method of claim 1, wherein the plurality of choices comprises an option for user selection representing an action to disable the second computer.

3. The method of claim 1, wherein the plurality of choices comprises an option for user selection representing an action to disable an account associated with the second computer.

4. The method of claim 1, wherein the plurality of choices comprises an option for user selection representing an action to lock the second computer.

5. The method of claim 1, wherein the plurality of choices comprises an option for user selection representing an action to quarantine the second computer.

6. The method of claim 1, wherein the first computer system comprises a plurality of physical computers.

7. A non-transitory machine readable medium, on which are stored instructions, comprising instructions that when executed cause one or more programmable devices to:

receive, by a first computer system, a first notification from a third computer indicating the third computer detected a potential data leakage activity on a second computer;

generate a user prompt on the first computer system in response to receiving the first notification from the third computer, wherein the user prompt comprises a plurality of choices for isolating the second computer, wherein at least one of the plurality of choices is received from the third computer in the first notification;

receive a user input after generating the user prompt, the user input indicating a selection of one of the choices; and

attempt to isolate the second computer based on the selected choice.

8. The machine readable medium of claim 7, wherein the plurality of choices comprises an option for user selection representing an action to disable the second computer.

9. The machine readable medium of claim 7, wherein the plurality of choices comprises an option for user selection representing an action to disable an account associated with the second computer.

10. The machine readable medium of claim 7, wherein the plurality of choices comprises an option for user selection representing an action to lock the second computer.

11. The machine readable medium of claim 7, wherein the plurality of choices comprises an option for user selection representing an action to quarantine the second computer.

12. The machine readable medium of claim 7, wherein the first computer system comprises a plurality of physical computers.

13. The machine readable medium of claim 7, wherein the first computer system comprises a mobile device.

14. The machine readable medium of claim 13, wherein the mobile device is mobile phone.

15. A system comprising:

one or more processors; and

a memory, coupled to the one or more processors, on which instructions are stored comprising instructions which, when executed by the one or more processors cause the one or more processors to;

receive a first notification from a first computer indicating the first computer detected a potential data leakage activity on a second computer;

generate a user prompt in response to receiving the first notification from the first computer, wherein the user prompt comprises a plurality of choices for isolating the second computer, wherein at least one of the plurality of choices is received from the first computer in the first notification;

receive a user input after generating the user prompt, the user input indicating a selection of one of the choices; and

attempt to isolate the second computer based on the selected choice.

16. The system of claim 15, wherein the plurality of choices comprises an option for user selection representing an action to disable the second computer.

17. The system of claim 15, wherein the plurality of choices comprises an option for user selection representing an action to disable an account associated with the second computer.

18. The system of claim 15, wherein the plurality of choices comprises an option for user selection representing an action to lock the second computer.

19. The system of claim 15, wherein the plurality of choices comprises an option for user selection representing an action to quarantine the second computer.

20. The system of claim 15, wherein the first computer system comprises a mobile device.

21. The system of claim 20, wherein the mobile device is mobile phone.