INTERNAL CONTROLS ENGINE AND REPORTING OF EVENTS GENERATED BY A NETWORK OR ASSOCIATED APPLICATIONS

• US 20170364702A1
• Filed: 08/11/2017
• Published: 12/21/2017
• Est. Priority Date: 06/02/2015
• Status: Active Grant

• Current Assignee: Altr Solutions, Inc.
• Original Assignee: Altr Solutions, Inc.
• Inventors: Goldfarb, Scott Nathaniel, Struttmann, Christopher Edward, Beecham, James Douglas, Martin, Gordon Earl
• Granted Patent: US 10,095,878 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/122 of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 45/02 Topology update or discovery
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Provided is a process including: obtaining, with a network controls engine, network traffic, wherein: the network traffic is sent across the network between source computing devices and destination computing devices; at least one of the source or destination computing devices are on a network carrying the network traffic; and the network has a plurality of computing devices causing the network traffic and which are assigned addresses on the network; applying, with the network controls engine, a plurality of rules to the network traffic to identify rules with criteria satisfied by the network traffic; and causing, with the network controls engine, one or more actions prescribed by one or more identified rules with criteria satisfied by the network traffic.

Claims

1. A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:

obtaining, with one or more processors, with a network controls engine, network traffic, wherein;

the network traffic is sent across the network between source computing devices and destination computing devices;

the source computing devices and destination computing devices are different computing devices from one or more computing devices executing the internal controls engine;

at least one of the source or destination computing devices are on a network carrying the network traffic; and

the network has a plurality of computing devices causing the network traffic and which are assigned addresses on the network;

applying, with one or more processors, with the network controls engine, a plurality of rules to the network traffic to identify rules with criteria satisfied by the network traffic; and

causing, with one or more processors, with the network controls engine, one or more actions prescribed by one or more identified rules with criteria satisfied by the network traffic.

2. The medium of claim 1, wherein the operations comprise:

logging an event in an immutable data repository responsive to determining that criteria of a given rule are satisfied.

3. The medium of claim 2, wherein:

the immutable repository is a tamper-evident, immutable data repository.

4. The medium of claim 3, wherein:

the tamper-evident, immutable data repository comprises replicated instances of a directed acyclic graph having edges defined by cryptographic hash pointers with cryptographic hash values based on content of adjacent nodes in the graph, wherein the content of adjacent nodes includes respective cryptographic hash pointers of respective adjacent nodes, a cryptographic hash value based on a respective logged event, or a respective logged event.

5. The medium of claim 1, wherein the operations comprise logging, in a tamper-evident, immutable data repository one or more records documenting of one or more of the following:

network activity;

network changes;

emails;

email attachments;

application log entries;

syslog messages;

attempts to access the tamper-evident, immutable data repository;

attempts to access a document repository;

attempts to access a record by which permissions defining who is authorized to access documents in the document repository are defined;

attempts to access a database;

or

attempts to access a record by which permissions defining who is authorized to access database records are defined.

6. The medium of claim 1, wherein the operations comprise logging, in a tamper-evident, immutable data repository one or more records documenting four or more of the following, but not necessarily in the same record:

network activity;

network changes;

emails;

email attachments;

application log entries;

syslog messages;

attempts to access the tamper-evident, immutable data repository;

attempts to access a document repository;

attempts to access a record by which permissions defining who is authorized to access documents in the document repository are defined;

attempts to access a database;

or

attempts to access a record by which permissions defining who is authorized to access database records are defined.

7. The medium of claim 1, wherein the operations comprise logging, in a tamper-evident, immutable data repository one or more records documenting of the following, but not necessarily in the same record:

network activity;

network changes;

emails;

email attachments;

application log entries;

syslog messages;

attempts to access the tamper-evident, immutable data repository;

attempts to access a document repository;

attempts to access a record by which permissions defining who is authorized to access documents in the document repository are defined;

attempts to access a database; and

attempts to access a record by which permissions defining who is authorized to access database records are defined.

8. The medium of claim 1, wherein criteria of at least some of the rules are based on one or more of the following:

a rate of a type of network event occurring in the network traffic;

a pattern appearing in human-readable natural language text of an email;

an attempt to access data or a computing device designated as high-security;

deviation from a predictive model configured based on previous behavior on the network;

or

geolocation of a computing device sending or receiving network traffic.

9. The medium of claim 1, wherein criteria of at least some of the rules are based on two or more of the following, though not necessarily in the same rule:

a rate of a type of network event occurring in the network traffic;

a pattern appearing in human-readable natural language text of an email;

an attempt to access data or a computing device designated as high-security;

deviation from a predictive model configured based on previous behavior on the network;

or

geolocation of a computing device sending or receiving network traffic.

10. The medium of claim 1, wherein criteria of at least some of the rules are based on each of the following, though not necessarily in the same rule:

a rate of a type of network event occurring in the network traffic;

a pattern appearing in human-readable natural language text of an email;

an attempt to access data or a computing device designated as high-security;

deviation from a predictive model configured based on previous behavior on the network; and

geolocation of a computing device sending or receiving network traffic.

11. The medium of claim 1, wherein:

the network controls engine periodically applies each rule to the network traffic within less than 500 milliseconds of receiving the network traffic.

12. The medium of claim 1, wherein:

the network controls engine applies each rule to the network traffic upon receiving a threshold amount of network traffic.

13. The medium of claim 1, wherein:

the network controls engine is configured to apply at least some of the rules concurrently to the network traffic.

14. The medium of claim 1, wherein:

at least some of the rules are based on headers in network layer packets; and

at least some of the rules are based on patterns in application-layer protocol content encapsulated within payloads of the network layer packets.

15. The medium of claim 1, wherein the one or more actions include at least one of the following:

sending an email notification;

logging an event in a tamper-evident, immutable data repository;

quarantining a user or a computing device on the network;

rate-limiting data access by a user or computing device on the network;

or shutting down the network.

16. The medium of claim 1, wherein the one or more actions include each of the following, though not necessarily in the same action:

sending an email notification;

logging an event in a tamper-evident, immutable data repository;

quarantining a user or a computing device on the network; and

rate-limiting data access by a user or computing device on the network.

17. The medium of claim 1, wherein the operations comprise:

sending a user computing device a graphical user interface by which the plurality of rules are editable or new rules are composable.

18. The medium of claim 1, wherein the operations comprise:

steps for providing visibility into network traffic; and

steps for providing actionability to automatically respond to network traffic.

19. The medium of claim 1, wherein the operations comprise:

hosting a tamper-evident, immutable data repository in which logged events are stored;

managing permissions of the user computing devices to access resources via the network;

hosting a tamper-evident, immutable data repository in which documents accessible via the network are stored; and

hosting a tamper-evident, immutable data repository in which database entries accessible via the network are stored.

20. A method, comprising:

obtaining, with one or more processors, with a network controls engine, network traffic, wherein;

the network traffic is sent across the network between source computing devices and destination computing devices;

the source computing devices and destination computing devices are different computing devices from one or more computing devices executing the internal controls engine;

at least one of the source or destination computing devices are on a network carrying the network traffic; and

the network has a plurality of computing devices causing the network traffic and which are assigned addresses on the network;

applying, with one or more processors, with the network controls engine, a plurality of rules to the network traffic to identify rules with criteria satisfied by the network traffic; and

causing, with one or more processors, with the network controls engine, one or more actions prescribed by one or more identified rules with criteria satisfied by the network traffic.