Gain customer trust with early engagement through visualization and data driven configuration

• US 11,297,077 B2
• Filed: 10/31/2018
• Issued: 04/05/2022
• Est. Priority Date: 10/31/2018
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Janakiraman, Ramsundar, Rojas, Ronald Calvo
• Primary Examiner(s): Perungavoor, Venkat
• Assistant Examiner(s): Pan, Peiliang
• Application Number:
  US16/177,301
• Publication Number:
  US 20200137093A1
• Time in Patent Office: 1,252 Days
• Field of Search: 726 14
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A system may select a list of servers in a computer network to perform behavioural profiling, wherein each server is associated with a domain name, the list of servers includes domain name entries, and the list of servers is prioritized according to a popularity value for each server. The system may update the list of servers based on a popularity threshold, partition the computer network into one of: subnetworks or subdomains, and establish a hierarchy along one of: the subnetworks or the subdomains based on the domain name entries in the list of servers. The system may update the popularity value for a server associated with a resolved network address, and may update the hierarchy along one of: the subnetworks or the subdomains based on the popularity value.

Claims

1. A computer-implemented method, comprising:

selecting a list of servers in a computer network to perform behavioural profiling, wherein each server from the list of servers is associated with a domain name, wherein the list of servers comprises domain name entries;

determining a popularity value for each server from the list of servers, wherein the popularity value for each server comprises a measured value based on measuring a connectivity for each server in a network graph and measuring a frequency of appearance of a domain name for each server from the list of servers in a log of multiple transactions in the computer network, and wherein the list of servers is prioritized according to the popularity value for each server;

updating the list of servers based at least in part on a popularity threshold;

partitioning the computer network into one of;

subnetworks or subdomains;

establishing a hierarchy along one of;

the subnetworks or the subdomains based at least in part on the domain name entries in the list of servers;

updating the popularity value for a server associated with a resolved network address in one of;

the subnetworks or the subdomains, wherein the resolved network address is mapped into the domain name for the server and is accessed by a client device in the computer network; and

updating the hierarchy along one of;

the subnetworks or the subdomains based at least in part on the popularity value.

2. The computer-implemented method of claim 1, wherein updating the popularity value for the server associated with the resolved network address comprises normalizing a behaviour of the server with a frequency of access to the server in the computer network.

3. The computer-implemented method of claim 1, wherein updating the popularity value for the server comprises inspecting a plurality of packets at a network edge, wherein the network edge is outside of a firewall for a server host in the computer network.

4. The computer-implemented method of claim 1, further comprising partitioning the computer network into one of:

the subnetworks or the subdomains according to a social network of users of the computer network.

5. The computer-implemented method of claim 1, further comprising partitioning the computer network into an internal network comprising internal servers, and an external network comprising external servers, wherein the internal network and the external network are separated by a firewall defined according to an internal network administrator.

6. The computer-implemented method of claim 1, further comprising removing a domain name from the list of servers when the domain name is flagged for a safety compromise.

7. The computer-implemented method of claim 1, further comprising removing a domain name from the list of servers when a request for accessing the domain name violates a timing protocol.

8. The computer-implemented method of claim 1, further comprising flagging a domain name associated with an internal server that has been accessed by an external server.

9. A system, comprising:

a memory storing instructions; and

one or more processors configured to execute the instructions to cause the system to;

select a list of servers in a computer network to perform behavioural profiling, wherein each server from the list of servers is associated with a domain name, wherein the list of servers comprises domain name entries, and wherein the list of servers is prioritized according to a popularity value for each server, the popularity value for each server comprising a measured valued based on measuring a connectivity for each server in a network graph and measuring a frequency of appearance of a domain name for each server from the list of servers in a log of multiple transactions in the computer network;

update the list of servers based at least in part on a popularity threshold;

partition the computer network into one of;

subnetworks or subdomains;

establish a hierarchy along one of;

the subnetworks or subdomains based at least in part on the domain name entries in the list of servers;

update the popularity value for a server associated with a resolved network address in one of;

the subnetworks or the subdomains, wherein the resolved network address is mapped into the domain name for the server and is accessed by a client device in the computer network; and

update the hierarchy along one of;

the subnetworks or the subdomains based at least in part on the popularity value.

10. The system of claim 9, wherein the one or more processors are further configured to determine the popularity value for each server from the list of servers by measuring a connectivity for each server in a network graph and measuring a frequency of appearance of a domain name for each server from the list of servers in a log of multiple transactions in the computer network.

11. The system of claim 9, wherein to update the popularity value for the server associated with the resolved network address the one or more processors are further configured to normalize a behaviour of the server with a frequency of access to the server in the computer network.

12. The system of claim 9, wherein to update the popularity value for the server the one or more processors are configured to inspect a plurality of packets at a network edge, wherein the network edge is outside of a firewall for a server host in the computer network.

13. The system of claim 9, wherein the one or more processors are further configured to partition the computer network into one of:

subnetworks or the subdomains according to a social network of multiple users of the computer network.

14. A non-transitory, computer readable medium storing instructions which, when executed by a processor, cause a computer to perform a method, the method comprising:

selecting a list of servers in a computer network to perform behavioural profiling, wherein each server from the list of servers is associated with a domain name, wherein the list of servers comprises domain name entries,

determining a popularity value for each server from the list of servers, the popularity value for each server comprising a measured value based on measuring a connectivity for each server in a network graph and measuring a frequency of appearance of a domain name for each server from the list of servers in a log of multiple transactions in the computer network and wherein the list of servers is prioritized according to the popularity value for each server;

updating the list of servers based at least in part on a popularity threshold;

partitioning the computer network into one of;

subnetworks or subdomains;

establishing a hierarchy along one of;

the subnetworks or the subdomains based at least in part on the domain name entries in the list of servers;

updating the popularity value for a server associated with a resolved network address in one of;

the subnetworks or the subdomains, wherein the resolved network address is mapped into the domain name for the server and is accessed by a client device in the computer network; and

updating the hierarchy along one of;

the subnetworks or the subdomains based at least in part on the popularity value.

15. The non-transitory, computer readable medium of claim 14, wherein updating the popularity value for the server associated with the resolved network address comprises normalizing a behaviour of the server with a frequency of access to the server in the computer network.