Context aware threat protection

• US 9,843,599 B2
• Filed: 04/05/2017
• Issued: 12/12/2017
• Est. Priority Date: 12/29/2014
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Jalan, Rajkumar, Groves, Vernon Richard
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): Khan, Sher A
• Application Number:
  US15/480,212
• Publication Number:
  US 20170208082A1
• Time in Patent Office: 251 Days
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Methods and systems for dynamic threat protection are disclosed. An example method for dynamic threat protection may commence with receiving real-time contextual data from at least one data source associated with a client. The method may further include analyzing the real-time contextual data to determine a security threat score associated with the client. The method may continue with assigning, based on the analysis, the security threat score to the client. The method may further include automatically applying a security policy to the client. The security policy may be applied based on the security threat score assigned to the client.

Claims

1. A method performed by at least one hardware processor for dynamic threat protection comprising:

dynamically receiving real-time contextual data from at least one data source associated with a client and a subscriber list, the real-time contextual data including subscriber-specific information;

analyzing the real-time contextual data to determine a security threat score associated with the client, the analyzing including evaluating whether the subscriber-specific information received from the subscriber list is valid;

assigning the security threat score to the client using the analysis;

automatically applying a security policy to the client using the security threat score, the applying including;

providing a higher quality of service to the client when the subscriber-specific information is valid; and

providing a lower quality of service to the client when the subscriber-specific information is not valid;

determining whether the security threat score assigned to the client is above a predetermined threshold threat score; and

based on the determining, selectively analyzing, contents of data packets associated with the client for adherence to a predetermined standard, the data packets being carried between the client and a server by a data network.

2. The method of claim 1, further comprising providing a quality of service to the client based on the assigned security threat score.

3. The method of claim 1, further comprising:

based on the determining, selectively applying additional security measures to the client.

4. The method of claim 1, wherein the real-time contextual data is received from the at least one data source via a common event bus.

5. The method of claim 1, wherein the real-time contextual data includes at least one of the following:

authentication data, Internet Protocol (IP) data, wireless roaming data, network path data, payment data, account data, operating system data, virus scan data, session data, client data, client location data, session encryption data, client network data, and client reputation data.

6. The method of claim 1, wherein the real-time contextual data is received from a third-party system.

7. The method of claim 1, wherein the real-time contextual data is obtained from at least one data protocol of data communications with the client.

8. The method of claim 1, wherein the security policy is continuously updated based on real-time contextual data.

9. A dynamic threat protection system comprising:

at least one processor; and

a memory communicatively coupled to the at least one processor, the memory storing instructions executable by the at least one processor to perform a method comprising;

dynamically receiving real-time contextual data from at least one data source associated with a client and a subscriber list, the real-time contextual data including subscriber-specific information;

analyzing the real-time contextual data to determine a security threat score associated with the client, the analyzing including evaluating whether the subscriber-specific information received from the subscriber list is valid;

assigning the security threat score to the client using the analysis;

automatically applying a security policy to the client using the security threat score, the applying including;

providing a higher quality of service to the client when the subscriber-specific information is valid; and

providing a lower quality of service to the client when the subscriber-specific information is not valid;

determining whether the security threat score assigned to the client is above a predetermined threshold threat score; and

based on the determining, selectively analyzing contents of data packets associated with the client for adherence to a predetermined standard, the data packets being carried between the client and a server by a data network.

10. The system of claim 9, wherein a quality of service is provided to the client using the assigned security threat score.

11. The system of claim 9, wherein the method further comprises:

selectively applying additional security measures to the client using the determination.

12. The system of claim 9, wherein the real-time contextual data is received from the at least one data source via a common event bus.

13. The system of claim 9, wherein the real-time contextual data includes at least one of the following:

authentication data, Internet Protocol (IP) data, wireless roaming data, network path data, payment data, account data, operating system data, virus scan data, session data, client data, client location data, session encryption data, client network data, and client reputation data.

14. The system of claim 9, wherein the real-time contextual data is received from a third-party system.

15. The system of claim 9, wherein the real-time contextual data is obtained from at least one data protocol of data communications with the client.

16. The system of claim 9, wherein the security policy is continuously updated based on real-time contextual data.

17. A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by at least one processor to perform a method for dynamic threat protection, the method comprising:

dynamically receiving real-time contextual data from at least one data source associated with a client and a subscriber list, the real-time contextual data including subscriber-specific information;

analyzing the real-time contextual data to determine a security threat score associated with the client, the analyzing including evaluating whether the subscriber-specific information received from the subscriber list is valid;

assigning the security threat score to the client using the analysis;

automatically applying a security policy to the client using the security threat score, the applying including;

providing a higher quality of service to the client when the subscriber-specific information is valid; and

providing a lower quality of service to the client when the subscriber-specific information is not valid;

determining whether the security threat score assigned to the client is above a predetermined threshold threat score; and

based on the determining, selectively analyzing contents of data packets associated with the client for adherence to a predetermined standard, the data packets being carried between the client and a server by a data network.

18. The non-transitory computer-readable storage medium of claim 17, wherein a quality of service is provided to the client using the assigned security threat score.

19. The non-transitory computer-readable storage medium of claim 17, wherein the real-time contextual data includes at least one of the following:

authentication data, Internet Protocol (IP) data, wireless roaming data, network path data, payment data, account data, operating system data, virus scan data, session data, client data, client location data, session encryption data, client network data, and client reputation data.

20. The non-transitory computer-readable storage medium of claim 17, wherein the security policy is continuously updated based on real-time contextual data.