BEHAVIOR-BASED TRAFFIC PROFILING BASED ON ACCESS CONTROL INFORMATION

• US 20100257580A1
• Filed: 06/02/2009
• Published: 10/07/2010
• Est. Priority Date: 04/03/2009
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: ZHAO, Ye (Kevin)
• Granted Patent: US 8,621,615 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A method includes receiving one or more of user information, role information, or authorization information associated with a user accessing a network, selecting a traffic flow to monitor that is associated with the one or more of user information, role information, or authorization information, monitoring the traffic flow, determining whether an anomaly exists with respect to the traffic flow based on a traffic behavior pattern associated with the one or more of user information, role information, or authorization information, and performing a security response when it is determined that the anomaly exists.

Claims

1. A method performed by a device, comprising:

receiving, by the device, one or more of user information, role information, or authorization information associated with a user accessing a network;

selecting, by the device, a traffic flow to monitor that is associated with the one or more of user information, role information, or authorization information;

monitoring, by the device, the traffic flow;

determining, by the device, whether an anomaly of traffic behavior exists with respect to the traffic flow based on a traffic behavior pattern associated with the one or more of user information, role information, or authorization information; and

performing, by the device, a security response when it is determined that the anomaly exists.

2. The method of claim 1, where the determining comprises:

comparing, by the device, the traffic behavior pattern history with traffic behavior corresponding to the traffic flow; and

determining, by the device, whether the anomaly exists based on the comparing.

3. The method of claim 2, further comprising:

receiving, by the device, the traffic behavior pattern, from another device.

4. The method of claim 1, where the user information includes one of the user'"'"'s name, a string that includes a portion of the user'"'"'s name, or a string that corresponds to the user.

5. The method of claim 1, where the role information includes one of the user'"'"'s status, a job title, or the user'"'"'s access level.

6. The method of claim 1, where the authorization information includes one of password information, log-in information, authorization code, or credential information.

7. The method of claim 1, where the receiving comprises:

receiving, by the device, the one or more of user information, role information, or authorization information from a user device utilized by the user to access the network, or

receiving, by the device, the one or more of user information, role information, or authorization information from another device that regulates network access by the user.

8. The method of claim 1, further comprising:

storing, by the device, security policies; and

where the performing comprises;

selecting, by the device, one of the security policies corresponding to the anomaly, when it is determined that the anomaly exists; and

performing, by the device, the security response corresponding to the one of the security policies.

9. A network device, to:

receive one or more of user information, role information, or authorization information associated with a network access of a user;

select a traffic flow to monitor that is associated with the one or more of user information, role information, or authorization information;

store a traffic behavior pattern corresponding to the one or more of user information, role information, or authorization information, based on one or more previous network accesses by the user;

compare traffic flow information, associated with the traffic flow, with information associated with the traffic behavior pattern;

determine that an anomaly of traffic behavior exists when the traffic flow differs from the information associated with the traffic behavior pattern; and

perform a security response when it is determined that the anomaly of traffic behavior exists.

10. The network device of claim 9, where the network device is further configured to:

receive the traffic behavior pattern from another device.

11. The network device of claim 9, where the network device includes an intrusion, detection, and prevention device.

12. The network device of claim 9, where the network device is further configured to:

continue to monitor the traffic flow, when it is determined that the anomaly does not exist.

13. The network device of claim 9, where the traffic flow information includes one or more of source address, source port, destination address, destination port, protocol, type of service, quality of service, timestamp information, or number of packets or bytes.

14. The network device of claim 9, where the network device is further configured to:

monitor the traffic flow; and

obtain the traffic flow information from the traffic flow monitored.

15. The network device of claim 9, where the network device is further configured to receive a source address or a source port associated with the network access of the user, and where, when selecting the traffic flow, the network device is further configured to:

select the traffic flow to monitor based on the source address or the source port, which is associated with the one or more of user information, role information, or authorization information.

16. A computer-readable medium having stored thereon instructions, executable by at least one processor, the computer-readable medium comprising:

one or more instructions for receiving one or more of user information, role information, or authorization information associated with a network access by a user;

one or more instructions for selecting a traffic flow, where the traffic flow is associated with the network access;

one or more instructions for monitoring the traffic flow;

one or more instructions for determining whether an anomaly of traffic behavior exists with respect to the traffic flow by comparing the traffic flow with a traffic behavior pattern associated with the one or more of user information, role information, or authorization information; and

one or more instructions for performing a security response when it is determined that the anomaly exists.

17. The computer-readable medium of claim 16, where the traffic behavior pattern is based on one or more previous monitorings of traffic flows associated with the one or more of user information, role information, or authorization information.

18. The computer-readable medium of claim 16, further comprising:

one or more instructions for updating the traffic behavior pattern history based on information associated with the traffic flow, when it is determined that the anomaly does not exist.

19. A network device, comprising:

means for receiving one or more of user information, role information, or authorization information associated with a granted network access to a user;

means for selecting a traffic flow resulting from the granted network access;

means for monitoring the selected traffic flow;

means for receiving a traffic behavior pattern associated with the one or more of user information, role information, or authorization information;

means for comparing information associated with the selected traffic flow with the traffic behavior pattern;

means for determining whether an anomaly of traffic behavior exists based on the comparing; and

means for providing a security response when it is determined that the anomaly of traffic behavior exists.

20. A device, to:

receive traffic flow information;

construct a traffic profile associated with one or more of user information, role information, or authorization information relating to a granted network access;

update a traffic behavior pattern associated with the one or more of user information, role information, or authorization information based on the traffic profile, where the traffic behavior pattern includes values or ranges of values indicative of non-deviant traffic behavior; and

provide the updated traffic behavior pattern to another device.