Implement threat policy actions based on the network address of the host threat

Abstract

Embodiments of the present application relate to implementing threat policy actions based on network addresses of host threats. A device receives information identifying a specific host threat to a network, wherein the information includes a list of network addresses associated with the specific host threat. The device identifies a network element of the network associated with the specific host threat to the network, and determines a network control system associated with the identified network element. The device determines a policy implementation group of a network element in the identified network element that maps to the list of network addresses associated with the specific host threat, wherein the network control system is associated with the policy implementation group of the network element. The device determines a threat policy action to be implemented for the specific host threat, and causes the threat policy action to be implemented by the policy implementation group of the network element via the network control system.

Description

[0001] This application is a divisional application of the Chinese invention patent application with national application number 201910193886.9, application date March 14, 2019, and invention name “Implementing threat strategy actions based on the network address of host threats”.

[0002] CROSS-REFERENCE TO RELATED APPLICATIONS

[0003] This application claims priority under 35 USC §119 to U.S. Provisional Patent Application Nos. 62 / 647,431 and 62 / 647,460, filed on March 23, 2018, the contents of which are incorporated herein by reference in their entirety. Technical Field

[0004] Embodiments of the present application are directed to implementing threat policy actions based on the network address of a host threat. Background Art

[0005] As malware becomes more sophisticated, threat defense solutions can provide sufficient threat detection to implement infected endpoint host security controls at the perimeter of the network. However, in the case of adaptive network changes where threats are injected from both external endpoint host threats and internal endpoint host threats, security controls at the perimeter of the network may be insufficient. For example, an endpoint host threat that is connected to the network at a specific network segment and blocked at the network perimeter may bypass security controls when the endpoint host threat moves laterally to different network segments, different campuses, different sites, etc., because the network address (e.g., Internet Protocol (IP) address, Media Access Control (MAC) address, etc.) associated with the endpoint host threat may change. Summary of the invention

[0006] According to some implementations, a device may include one or more memories and one or more processors for receiving information identifying a specific host threat to a network, wherein the information may identify the specific host threat, including a list of network addresses associated with the specific host threat. The one or more processors may identify a network element of the network associated with the specific host threat to the network, and may determine a network control system associated with the identified network element. The one or more processors may determine a policy implementation group of a network element in the identified network element that maps to the list of network addresses associated with the specific host threat, wherein the network control system may be associated with the policy implementation group of the network element. The one or more processors may determine a threat policy action to be implemented for the specific host threat, and may cause the threat policy action to be implemented by the policy implementation group of the network element via the network control system.

[0007] According to some implementations, a non-transitory computer-readable medium may store one or more instructions that, when executed by one or more processors, cause the one or more processors to: receive host threat feed information associated with an endpoint host in communication with a network. The one or more instructions may cause the one or more processors to identify a specific host threat to the network from the host threat feed information, wherein the specific host threat may be caused by one of the endpoint hosts, and the specific host threat may be associated with a network address list of the network. The one or more instructions may cause the one or more processors to identify a network element of the network associated with the specific host threat to the network, and determine a network control system associated with the identified network element. The one or more instructions may cause the one or more processors to determine a policy implementation group of a network element in the identified network element that is mapped to the network address list associated with the specific host threat, wherein the network control system may be associated with the policy implementation group of the network element. The one or more instructions may cause the one or more processors to determine a threat policy action to be implemented for the specific host threat, and cause the threat policy action to be implemented by the policy implementation group of the network element via the network control system.

[0008] According to some implementations, a method may include receiving network topology information associated with a network, and generating a data structure including information identifying capabilities of each network element of the network based on the network topology information. The method may include receiving information identifying a specific host threat to the network, wherein the information identifying the specific host threat may include a list of network addresses associated with the specific host threat. The method may include identifying the network element associated with the specific host threat to the network based on the data structure, and determining a network control system associated with the identified network element. The method may include determining a policy implementation group of the network element that maps to the list of network addresses associated with the specific host threat in the identified network element, wherein the network control system may be associated with the policy implementation group of the network element. The method may include determining a threat policy action to be implemented for the specific host threat, and causing the threat policy action to be implemented by the policy implementation group of the network element via the network control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figures 1A to 1K is a diagram of an example implementation described herein;

[0010] Figure 2 is a diagram of an example environment in which the systems and / or methods described herein may be implemented;

[0011] Figure 3 yes Figure 2 diagrams of example components of one or more devices;

[0012] Figure 4 is a flow chart of an example process for implementing a threat policy action based on a network address of a host threat;

[0013] Figure 5 is a flow chart of an example process for implementing a threat policy action based on a network address of a host threat; and

[0014] Figure 6 is a flow chart of an example process for implementing threat policy actions based on the network address of a host threat. DETAILED DESCRIPTION

[0015] The following detailed description of example implementations refers to the accompanying drawings.The same reference numbers in different drawings may identify the same or similar elements.

[0016] Threat remediation systems that are unaware of the mobility of potential endpoint host threats in the network introduce several challenges. For example, threat identification is limited to detection in the data path of endpoint host threats that communicate with the network through perimeter network devices, lateral propagation of endpoint host threats inside the network cannot be detected and further expansion cannot be controlled, and once endpoint host threats move to different network segments, endpoint host threats may gain additional access rights and privileges, thereby compromising unprotected network segments. As a result, threat remediation systems are unable to consistently and effectively monitor, identify, and remediate endpoint host threats in real time throughout the network.

[0017] Some implementations described herein provide a policy implementation platform for implementing threat policy actions based on the network address of the host threat. For example, the policy implementation platform can receive information that identifies a specific host threat to the network and includes a list of network addresses associated with the specific host threat. The policy implementation platform can identify a network element associated with a specific host threat to the network, and can determine a network control system associated with the identified network element. The policy implementation platform can determine a policy implementation group of a network element mapped to a list of network addresses associated with a specific host threat in the identified network element, and the network control system can be associated with the policy implementation group of the network element. The policy implementation platform can determine the threat policy action to be implemented for a specific host threat, and can cause the threat policy action to be implemented by the policy implementation group of the network element via the network control system.

[0018] Figures 1A to 1K is a diagram of an example implementation 100 described herein. Figure 1A As shown in , a user device (e.g., an endpoint host) can be associated with a network, a policy enforcer platform, and a management device. Figure 1AAs further shown in , a network may include local area network (LAN) devices that may be provided by multiple different vendors (e.g., multi-vendor LAN devices), wireless local area network (WLAN) devices that may be provided by multiple different vendors (e.g., multi-vendor WLAN devices), network devices that may be provided by multiple different vendors, and / or network control systems (e.g., control systems) that may be provided by multiple different vendors. In some implementations, each control system may control and / or manage a network segment of the network. For example, a control system associated with a particular vendor may utilize devices associated with the particular vendor to control a network segment.

[0019] like Figure 1A , and as further indicated by reference numeral 105, the policy implementer platform may receive network topology information associated with the network from one or more control systems. In some implementations, the network topology information may include information identifying devices associated with the network (e.g., multi-vendor LAN devices, multi-vendor WLAN devices, network devices, control systems, endpoint hosts, etc.). For example, the network topology information may include information identifying the manufacturer, model, device identifier, throughput, bandwidth, network address, etc. of devices associated with the network, information identifying hardware provided in devices associated with the network, information identifying software provided in devices associated with the network, etc.

[0020] like Figure 1A , and as further shown by reference numeral 110, the policy implementer platform may receive host threat feed information associated with the network from a management device. In some implementations, the management device may include a security information and event management (SIEM) device that combines security information management (SIM) and security event management (SEM) and provides real-time analysis of security alerts generated by applications and devices associated with the network. In some implementations, the host threat feed information may include information identifying a threat feed associated with the network (e.g., a feed provided by an endpoint host and including threats). In some implementations, the host threat feed information may include information identifying a network address (e.g., an IP address) associated with the threat feed.

[0021] like Figure 1B115, the policy implementer platform may generate a data structure (e.g., a database, table, list, etc.) based on the network topology information, the data structure including information identifying network elements (e.g., multi-vendor LAN devices, multi-vendor WLAN devices, network devices, control systems, endpoint hosts, etc.) associated with the network. In some implementations, the data structure may include network topology information associated with the network elements, as described above. In some implementations, the policy implementer platform may utilize the network topology information to determine capabilities associated with the network elements, and may store information identifying capabilities associated with the network elements in the data structure. For example, Figure 1B As further shown in , the data structure may include information identifying a network element (e.g., a router, a switch, a firewall, a LAN device, a WLAN device, etc.), information identifying capabilities of the network element (e.g., routing services, switching services, threat defense, routing LAN services, routing WLAN services, etc.), etc. In some implementations, the data structures described herein may be stored in a memory associated with a policy implementer platform.

[0022] In some implementations, the policy implementer platform may utilize the network topology information to determine the capabilities associated with the network elements by analyzing the network topology information and determining the hardware, software, model, throughput, bandwidth, network address, etc. of the devices associated with the network based on analyzing the network topology information. The policy implementer platform may determine the capabilities associated with the network elements based on the hardware, software, model, throughput, bandwidth, network address, etc. of the devices associated with the network.

[0023] In some implementations, the policy implementer platform may utilize one or more artificial intelligence models to process network topology information to determine capabilities associated with network elements. In some implementations, the one or more artificial intelligence models may include one or more of a support vector machine model, an artificial neural network model, a data mining model, a pattern discovery model, and the like.

[0024] The support vector machine model may include a supervised learning model with one or more associated learning algorithms that analyze data for classification and regression analysis. Given a set of training examples, each labeled as belonging to one or the other of two categories, the training method of the support vector machine model builds a model that assigns new examples to one category or the other. The support vector machine model is a representation of the examples as points in space, mapped so that examples of separate categories are divided by clear gaps as wide as possible. New examples are then mapped into the same space and predicted to belong to which category based on which side of the gap they fall.

[0025] Artificial neural network models may include models that use artificial neural networks (e.g., to determine capabilities associated with network elements). Artificial neural networks utilize a collection of connected units or nodes called artificial neurons. Each connection between artificial neurons can transmit a signal from one artificial neuron to another artificial neuron. The artificial neuron that receives the signal can process the signal and then provide the signal to the artificial neuron connected to it. Artificial neurons and connections typically have weights that are adjusted as learning proceeds. The weights can increase or decrease the strength of the signal at the connection. In addition, the artificial neuron can have a threshold value so that the artificial neuron only sends a signal if the aggregate signal meets the threshold value. Typically, artificial neurons are organized in layers, and different layers can perform different types of transformations on their inputs.

[0026] Data mining models may include models that perform anomaly detection (e.g., outlier, change, and / or deviation detection) to identify unusual data records of interest or data errors that require further investigation, perform association rule learning (e.g., dependency modeling) to search for relationships between variables, perform clustering to discover groups and / or structures in similar data without using known structures in the data, perform classification to generalize known structures applied to new data, perform regression to identify functions that model the data with minimal error, perform summarization to provide a more compact representation of the data set, including visualization and report generation, etc.

[0027] Pattern discovery models can include data mining techniques, such as sequential pattern mining. Sequential pattern mining is a type of structured data mining that seeks to identify statistically relevant patterns between data examples where values ​​are passed in sequence. Sequential pattern mining can be categorized as string mining (e.g., which is based on string processing models) and / or item set mining (e.g., which is based on association rule learning). String mining deals with a finite alphabet of items that appear in a sequence, but the sequences themselves may be very long. Item set mining deals with discovering frequent item sets and the order in which frequent item sets appear.

[0028] In some implementations, the policy implementer platform can utilize one or more artificial intelligence models and can utilize the best result determined by one of the artificial intelligence models. In some implementations, the policy implementer platform can utilize multiple artificial intelligence models and can aggregate the results determined by multiple artificial intelligence models.

[0029] like Figure 1B, and as further shown by reference numeral 120, the policy implementer platform may generate a data structure (e.g., a database, table, list, etc.) including information identifying endpoint hosts (e.g., user devices) connected to a network based on network topology information and / or host threat feed information. In some implementations, the data structure may include network topology information associated with the endpoint host, as described above. In some implementations, the policy implementer platform may utilize the network topology information and / or host threat feed information to determine sessions associated with the endpoint host, and may store information identifying sessions associated with the endpoint host in the data structure. For example, Figure 1B As further shown in , the data structure may include information identifying an endpoint host (e.g., a computer, smart phone, laptop, tablet, wearable device, etc.), information identifying a session of the endpoint host (e.g., active, inactive, etc.), information identifying a threat score associated with the session (e.g., based on a threat level from 0 to 10, where zero indicates no threat and 10 indicates maximum threat), etc. In some implementations, the threat score may be provided by host threat feed information.

[0030] like Figure 1C In the example shown by reference numeral 125, the policy implementer platform may identify a control system associated with an endpoint host of the data structure including information identifying the endpoint host (eg, Figure 1B ). In some implementations, the policy implementer platform can utilize the network address (e.g., IP address) of the endpoint host to match each endpoint host to a particular network segment. In such an implementation, the policy implementer platform can determine (e.g., based on the network topology information) which control system is associated with (e.g., manages) each particular network segment, and can therefore identify the control system associated with the endpoint host. In some implementations, the policy implementer platform can add information identifying the associated control system to the data structure, which includes information identifying the endpoint host. For example, as Figure 1C As further shown in FIG. 1 , control system 1 may be associated with a computer and a smart phone, control system 2 may be associated with a tablet computer, control system 3 may be associated with a laptop computer, and control system 4 may be associated with a wearable device.

[0031] refer to Figure 1DIn some implementations and based on the host threat feed information (e.g., based on the threat score associated with the host threat feed), the policy implementer may coordinate threat enforcement actions by blocking endpoint host traffic at a perimeter network device (e.g., a firewall) of the network for external host threat traffic provided between LAN devices and / or WLAN devices, network devices, and endpoint hosts (e.g., north-south communication). Additionally or alternatively, the policy implementer may coordinate threat enforcement actions by blocking endpoint host traffic at a switching layer of the network for internal host threat traffic provided between LAN devices and / or between WLAN devices (e.g., east-west communication).

[0032] like Figure 1D In some implementations, the policy implementer platform may provide information to a control system associated with the peripheral network device indicating that the peripheral network device is to block the external host threat service. In such an implementation, the control system may provide an instruction to the peripheral network device to block the external host threat service. The peripheral network device may receive the instruction and may block the external host threat service based on the instruction. For example, since the tablet computer and the wearable device have active sessions with threat scores of 8 and 9, respectively (e.g., as shown in FIG. 1 ), the peripheral network device may be configured to block the external host threat service. Figure 1C ), so the policy enforcement platform can determine that the tablet computer and the wearable device represent external host threat services, and can cause the peripheral network devices associated with the tablet computer and the wearable device to block services received from the tablet computer and the wearable device, such as Figure 1D As further shown in .

[0033] like Figure 1D As further shown by reference numeral 135, the policy implementer platform can cause internal host threat traffic to be blocked at the switching layer of the network. In some implementations, the policy implementer platform can provide information to a control system associated with the switching layer (e.g., communications between LAN devices and / or WLAN devices) indicating that the LAN device and / or WLAN device will block the internal host threat traffic. In such an implementation, the control system can provide instructions to the LAN device and / or WLAN device to block the internal host threat traffic. The LAN device and / or WLAN device can receive the instruction and can block the internal host threat traffic based on the instruction. For example, the policy implementer platform can determine that a tablet computer and a wearable device generate internal host threat traffic in the LAN and / or WLAN, and can cause the LAN device and / or WLAN device associated with the LAN and / or WLAN to block such traffic.

[0034] like Figure 1EAs shown in the figure by reference numeral 140, the policy implementer platform can tag the host threat with a unique identification (ID). In some implementations, each unique ID can include a MAC address associated with a network interface card (NIC) associated with the endpoint host representing the threat, session information associated with the endpoint host representing the threat (e.g., user login session details), a device identifier associated with the endpoint host representing the threat (e.g., model, serial number, etc.), a combination of the foregoing, etc. In this way, the policy implementer platform can also track the endpoint host representing the threat even when the endpoint host is assigned a different network address (e.g., IP address) based on the location and manner in which the endpoint host reattaches to a new network segment after migrating (e.g., lateral migration) through the network.

[0035] In some implementations, such as Figure 1E As further shown in , the policy enforcement platform can mark only those endpoint hosts that represent a threat using a unique ID. For example, since a tablet computer and a wearable device have active sessions with threat scores of 8 and 9, respectively (e.g., Figure 1C ), the policy enforcement platform can tag the tablet computer and the wearable device with unique IDs (e.g., unique ID 1 and unique ID 2, respectively). In this way, the policy enforcement platform can track the movement of the tablet computer and the wearable device through the network. In some implementations, the policy enforcement platform can add information identifying the unique ID to the data structure, which includes information identifying the endpoint host and the session associated with the endpoint host (e.g., as shown in Figure 1B ).

[0036] like Figure 1F As shown in the figure numeral 145, the policy implementer platform can monitor host threat services across the network based on the unique ID. In some implementations, the policy implementer can automate the monitoring and tracking of lateral propagation of endpoint hosts representing threats across the network, and can continue to implement actions against endpoint hosts representing threats (e.g., can monitor and / or perform actions with respect to wired to wireless to wired session migration and / or multi-vendor network segmentation). In some implementations, the policy implementer can perform actions related to tracking and / or policy orchestration of endpoint hosts representing threats based on tagging endpoint hosts representing threats with unique IDs. The unique ID can enable the policy implementer platform to track endpoint hosts representing threats even when the endpoint hosts are assigned different network addresses (e.g., IP addresses) based on where and how the endpoint hosts reattach to new network segments after migrating through the network.

[0037] like Figure 1GAs shown in the figure by reference numeral 150, the policy implementation platform can provide the host threat information to the management device to reduce the repeated analysis of the management device, reduce the management device from falsely identifying the endpoint host as a threat, provide a consistent security posture for the entire network, etc. In some implementations, since the management device can monitor the network and implement security policies for the network, the policy implementation platform can provide the management device with the host threat information determined by the policy implementation platform. In some implementations, the host threat information can include information determined based on monitoring the host threat business across the network based on the unique ID, as described above in conjunction with Figure 1F described.

[0038] like Figure 1H In some implementations, the policy implementer platform may provide security policy orchestration for the specific host threat generated by the specific endpoint host to provide a consistent security posture for the network. In some implementations, the information identifying the specific host threat may include a list of network addresses (e.g., IP addresses) associated with the specific host threat, as the specific host threat may receive multiple network addresses as the specific host threat migrates through the network.

[0039] like Figure 1H As further shown in the figure by reference numeral 160, the policy implementer platform can identify the network elements associated with the specific host threat. In some implementations, the policy implementer platform can use network topology information to identify the network elements associated with the specific host threat. For example, based on the network topology information and the unique ID associated with the specific host threat, the policy implementer platform can identify the network elements (e.g., router 3, switch 1, switch 5, switch 7, firewall 2, and firewall 3) as network elements associated with the unique ID and the specific host threat. In some implementations, the policy implementer platform can use the unique ID associated with the specific host threat to identify the network elements associated with the specific host threat by determining which network elements processed the unique ID.

[0040] like Fig. 1I In some implementations, the policy implementer platform may determine a control system associated with a network element identified as being associated with a particular host threat. In some implementations, the control system associated with the identified network element may implement a host threat policy (e.g., a threat policy action) to combat the particular host threat. In some implementations, the policy implementer platform may utilize network topology information to determine a control system associated with the identified network element. For example, Fig. 1IAs further shown in FIG. 1 and based on the network topology information, the policy implementer platform can determine that control system 1 is associated with router 3, switch 1, switch 5, switch 7, firewall 2, and firewall 3. In some implementations, a particular host threat can be associated with other network elements associated with other control systems. In such an implementation, the policy implementer platform can determine multiple control systems associated with the network element identified as being associated with the particular host threat.

[0041] like Fig. 1I , and as further shown by reference numeral 170, the policy implementer platform can determine, from the identified network elements, a policy implementation group of network elements that are mapped to a list of network addresses (e.g., IP addresses) associated with a particular host threat. In some implementations, the policy implementer platform can determine, for the IP addresses in the list and for the IP subnet-based policy implementation group, an IP address within a network subnet mask (e.g., an IP address discovered for an identified control system). In such an implementation, the policy implementer platform can map the network subnet mask to a layer 3 network device (e.g., of an open source interconnect (OSI) model) (e.g., configured with an integrated routing and bridging (IRB) and / or virtual LAN (VLAN) extensions). In some implementations, the policy implementer platform can determine whether the network subnet mask has an available policy. In some implementations, for a location-based policy implementation group, the policy implementer platform can determine whether the identified network element has an available policy. For example, as Fig. 1I As further shown in FIG. 1 , the policy implementer platform may determine router 3 , switch 1 , switch 7 , and firewall 2 as a policy implementation group of network elements.

[0042] like Figure 1J In some implementations, the policy implementer platform may identify a threat policy action to be implemented for a particular host threat, as shown in Figure 175. In some implementations, the policy implementer platform may identify whether a threat defense policy exists from the policy implementation group of the network element, and may identify any threat profiles associated with the threat defense policy. In such implementations, the policy implementer platform may identify a corresponding threat policy action to be implemented for a threat profile associated with a particular host threat. In some implementations, if a threat defense policy exists, the policy implementer platform may identify one or more threat policy actions associated with the threat defense policy. In some implementations, if a threat defense policy does not exist, the policy implementer platform may create a new threat defense policy (e.g., utilizing a threat policy action) to combat a particular host threat.

[0043] like Figure 1KAs shown in the figure 180, the policy implementation platform can cause the threat policy action to be implemented by the network element of the policy implementation group. In some implementations, the policy implementation platform can provide information indicating that the network element of the policy implementation group will implement the threat policy action to counter the threat of a specific host to the control system associated with the network element of the policy implementation group. In such an implementation, the control system can provide instructions to the network element of the policy implementation group to implement the threat policy action to counter the threat of a specific host. The network element of the policy implementation group can receive the instruction and can implement the threat policy action based on the instruction. For example, the policy implementation platform can provide information indicating that the router 3, switch 1, switch 7 and firewall 2 will implement the threat policy action to counter the threat of a specific host to the control system 1. In such an implementation, the control system 1 can provide instructions to implement the threat policy action to counter the threat of a specific host to the router 3, switch 1, switch 7 and firewall 2. Router 3, switch 1, switch 7 and firewall 2 can receive the instruction and can implement the threat policy action based on the instruction. In some implementations, threat policy actions may include dropping traffic from a specific host threat, isolating traffic from a specific host threat, logging traffic from a specific host threat for further analysis, redirecting traffic from a specific host threat to a device that can perform a deeper analysis of the specific host threat, and the like.

[0044] Some implementations described herein may relate to the problem of host threat mobility in a multi-vendor network. Additionally or alternatively, some implementations described herein may relate to host threat policy orchestration for a given IP feed generated by an endpoint host. Additionally or alternatively, some implementations described herein may provide a way to uniquely identify endpoint hosts in a network, such as when a host threat feed identifies multiple endpoint hosts with the same IP address as a potential risk by IP address (e.g., this may be required for threat remediation).

[0045] Some implementations described herein may identify a specific endpoint host session in a specific network segment (e.g., based on an IP address in a threat feed). Additionally or alternatively, some implementations described herein may associate specific policy actions against groups of endpoint hosts, and may implement the policy actions on specific control systems. For example, a threat feed may identify an IP address as a threat, and based on the IP address, some implementations described herein may identify the correct endpoint host for implementing the policy action based on the endpoint host's unique ID. In this manner, some implementations described herein are able to implement policy actions against an endpoint host regardless of whether the endpoint host's IP address has changed or will change (e.g., due to disconnecting from and reconnecting to a network, migrating through a network, etc.).

[0046] Additionally or alternatively, in an enterprise network or campus branch deployment (e.g., where the branch networks are configured with similar IP addressing schemes with overlapping IP addresses), the policy enforcement platform can create a set of secure network elements to uniquely associate with the branch network, and can dynamically determine the correct endpoint host to implement threat remediation actions that match the IP address of the threat host feed of the specific set of secure network elements. This can prevent the policy enforcement platform from implementing policy actions for incorrect endpoint sessions in the event that multiple endpoint sessions are active for the same IP address.

[0047] In this way, several different stages of the process for implementing threat policy actions based on the network address of the host threat can be automated, which can eliminate human subjectivity and waste in the process, and can improve the speed and efficiency of the process and save computing resources (e.g., processor resources, memory resources, etc.). In addition, the implementation described herein uses a rigorous computerized process to perform tasks or roles that were not previously performed or were previously performed using subjective human intuition or input. For example, currently, there is no technology for implementing threat policy actions based on the network address of the host threat. Finally, the automation of the process for implementing threat policy actions based on the network address of the host threat saves computing resources (e.g., processor resources, memory resources, etc.) that would otherwise be wasted in trying to resist host threats across the network.

[0048] As mentioned above, Figures 1A to 1K Provided as an example only. Other examples are possible and may be related to Figures 1A to 1K The examples described are different.

[0049] Figure 2 2 is a diagram of an example environment 200 in which the systems and / or methods described herein may be implemented. Figure 2 As shown in FIG, environment 200 may include user device 210, policy implementer platform 220, network 230, management device 240, LAN device 250, WLAN device 260, control system 270, and network device 280. The devices of environment 200 may be interconnected via wired connections, wireless connections, or a combination of wired and wireless connections.

[0050] The user device 210 includes one or more devices capable of receiving, generating, storing, processing, and / or providing information, such as the information described herein. For example, the user device 210 may include a mobile phone (e.g., a smart phone, a wireless phone, etc.), a laptop computer, a tablet computer, a desktop computer, a handheld computer, a gaming device, a wearable communication device (e.g., a smart watch, smart glasses, etc.), or a similar type of device. In some implementations, the user device 210 may receive information from and / or transmit information to one or more other devices of the environment 200.

[0051] The policy implementation platform 220 includes one or more devices that can implement threat policy actions based on the network address of the host threat. In some implementations, the policy implementation platform 220 can be designed to be modular so that certain software components can be swapped in or out according to specific needs. In this way, the policy implementation platform 220 can be easily and / or quickly reconfigured for different purposes. In some implementations, the policy implementation platform 220 can receive information from one or more other devices of the environment 200 and / or transmit information to it.

[0052] In some implementations, as shown, the policy implementer platform 220 can be hosted in a cloud computing environment 222. It is worth noting that while the implementations described herein describe the policy implementer platform 220 as being hosted in a cloud computing environment 222, in some implementations, the policy implementer platform 220 may not be cloud-based (i.e., may be implemented outside of a cloud computing environment, such as within one or more server devices), or may be partially cloud-based.

[0053] Cloud computing environment 222 includes an environment that hosts policy implementer platform 220. Cloud computing environment 222 can provide computing, software, data access, storage, etc. services that do not require end-user knowledge of the physical location and configuration of the systems and / or devices hosting policy implementer platform 220. As shown, cloud computing environment 222 can include a set of computing resources 224 (collectively, "computing resources 224" and individually, "computing resource 224").

[0054] The computing resources 224 include one or more personal computers, workstation computers, server devices, or other types of computing and / or communication devices. In some implementations, the computing resources 224 can host the policy implementer platform 220. Cloud resources can include computing instances executed in the computing resources 224, storage devices provided in the computing resources 224, data transmission devices provided by the computing resources 224, etc. In some implementations, the computing resources 224 can communicate with other computing resources 224 via wired connections, wireless connections, or a combination of wired and wireless connections.

[0055] like Figure 2 As further shown in FIG. 1 , the computing resources 224 include a set of cloud resources, such as one or more applications (“APP”) 224 - 1 , one or more virtual machines (“VM”) 224 - 2 , a virtualized storage device (“VS”) 224 - 3 , one or more hypervisors (“HYP”) 224 - 4 , and the like.

[0056] Applications 224-1 include one or more software applications that can be provided to or accessed by user device 210. Applications 224-1 can eliminate the need to install and execute software applications on user device 210. For example, applications 224-1 can include software associated with policy implementer platform 220 and / or any other software that can be provided via cloud computing environment 222. In some implementations, one application 224-1 can send / receive information to / from one or more other applications 224-1 via virtual machine 224-2.

[0057] Virtual machine 224-2 includes a software implementation of a machine (e.g., a computer) that executes programs such as a physical machine. Virtual machine 224-2 can be a system virtual machine or a process virtual machine, depending on the use and correspondence of virtual machine 224-2 to any real machine. System virtual machines can provide a complete system platform that supports the execution of a complete operating system ("OS"). Process virtual machines can execute a single program and can support a single process. In some implementations, virtual machine 224-2 can execute on behalf of a user (e.g., a user of user device 210 or an operator of policy implementer platform 220) and can manage the infrastructure of cloud computing environment 222, such as data management, synchronization, or long-term data transfer.

[0058] The virtualized storage device 224-3 includes one or more storage systems and / or one or more devices that use virtualization technology within the storage system or device of the computing resource 224. In some implementations, in the context of the storage system, the virtualization type may include block virtualization and file virtualization. Block virtualization may refer to the abstraction (or separation) of logical storage from physical storage, so that the storage system can be accessed without considering physical storage or heterogeneous structures. Separation can allow administrators of the storage system to flexibly manage the storage of end users. File virtualization can eliminate the dependency between data accessed at the file level and the location where the file is physically stored. This can achieve optimization of storage usage, server consolidation and / or non-disruptive file migration performance.

[0059] Hypervisor 224-4 can provide hardware virtualization technology that allows multiple operating systems (e.g., "guest operating systems") to execute simultaneously on a host computer (such as computing resource 224). Hypervisor 224-4 can present a virtual operating platform to the guest operating systems and can manage the execution of the guest operating systems. Multiple instances of various operating systems can share virtualized hardware resources.

[0060] The network 230 includes one or more wired and / or wireless networks. For example, the network 230 may include a cellular network (e.g., a fifth generation (5G) network, a long term evolution (LTE) network, a third generation (3G) network, a code division multiple access (CDMA) network, etc.), a public land mobile network (PLMN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., a public switched telephone network (PSTN)), a private network, an ad hoc network, an intranet, the Internet, a fiber-based network, etc., and / or a combination of these or other types of networks.

[0061] The management device 240 includes one or more devices capable of receiving, generating, storing, processing, and / or providing the information described herein. For example, the management device 240 may include a server (e.g., in a data center or cloud computing environment), a data center (e.g., a multi-server micro data center), a workstation computer, a VM provided in a cloud computing environment, or a similar type of device. In some implementations, the management device 240 may receive information from and / or provide information to one or more other devices of the environment 200. In some implementations, the management device 240 may be a physical device implemented within a housing such as a chassis. In some implementations, the management device 240 may be a virtual device implemented by one or more computer devices of a cloud computing environment or a data center. In some implementations, the management device 240 may identify a host threat feed generated by an endpoint host (e.g., a user device 210) and may analyze and / or manage the host threat feed.

[0062] LAN device 250 includes one or more devices capable of receiving, generating, storing, processing, and / or providing information as described herein. For example, LAN device 250 may include a network device (e.g., as described herein), a user device (e.g., as described herein), a server device, etc. In some implementations, LAN device 250 may receive information from and / or provide information to one or more other devices of environment 200. In some implementations, LAN device 250 may be a physical device implemented within a housing such as a chassis. In some implementations, LAN device 250 may be a virtual device implemented by one or more computer devices of a cloud computing environment or data center.

[0063] The WLAN device 260 includes one or more devices capable of receiving, generating, storing, processing, and / or providing the information described herein. For example, the WLAN device 260 may include a network device (e.g., as described herein), a user device (e.g., as described herein), a server device, etc. In some implementations, the WLAN device 260 may receive information from and / or provide information to one or more other devices of the environment 200. In some implementations, the WLAN device 260 may be a physical device implemented in a housing such as a chassis. In some implementations, the WLAN device 260 may be a virtual device implemented by one or more computer devices of a cloud computing environment or a data center.

[0064] The control system 270 includes one or more devices capable of receiving, generating, storing, processing and / or providing the information described herein. For example, the control system 270 may include a server (e.g., in a data center or cloud computing environment), a data center (e.g., a multi-server micro data center), a workstation computer, a VM provided in a cloud computing environment, or a similar type of device. In some implementations, the control system 270 may receive information from and / or provide information to one or more other devices of the environment 200. In some implementations, the control system 270 may be a physical device implemented in a housing such as a chassis. In some implementations, the control system 270 may be a virtual device implemented by one or more computer devices of a cloud computing environment or a data center. In some implementations, the control system 270 may include an element management system (EMS) that manages network elements (e.g., LAN devices 250, WLAN devices 260, network devices 280, etc.) and performs fault management, configuration, billing, performance, and security, etc.

[0065] The network device 280 includes one or more devices (e.g., one or more traffic transmission devices) capable of receiving, providing, storing, generating, and / or processing the information described herein. For example, the network device 280 may include a firewall, a router, a policy implementer, a gateway, a switch, a hub, a bridge, a reverse proxy, a server (e.g., a proxy server), a security device, an intrusion detection device, a load balancer, or the like. In some implementations, the network device 280 may receive information from and / or provide information to one or more other devices of the environment 200. In some implementations, the network device 280 may be a physical device implemented within a housing such as a chassis. In some implementations, the network device 280 may be a virtual device implemented by one or more computer devices of a cloud computing environment or a data center.

[0066] Figure 2 The number and arrangement of devices and networks shown are provided as examples. In practice, there may be Figure 2More devices and / or networks, fewer devices and / or networks, different devices and / or networks, or differently arranged devices and / or networks than shown. Figure 2 Two or more of the devices shown may be implemented in a single device, or Figure 2 The single device shown may be implemented as multiple distributed devices. Additionally or alternatively, one set of devices (eg, one or more devices) of environment 200 may perform one or more functions described as being performed by another set of devices of environment 200.

[0067] Figure 3 2 is a diagram of example components of a device 300. The device 300 may correspond to a user device 210, a policy implementer platform 220, a computing resource 224, a management device 240, a LAN device 250, a WLAN device 260, a control system 270, and / or a network device 280. In some implementations, the user device 210, the policy implementer platform 220, the computing resource 224, the management device 240, the LAN device 250, the WLAN device 260, the control system 270, and / or the network device 280 may include one or more devices 300 and / or one or more components of the device 300. Figure 3 As shown in , device 300 may include a bus 310 , a processor 320 , a memory 330 , a storage component 340 , an input component 350 , an output component 360 , and a communication interface 370 .

[0068] The bus 310 includes components that allow communication between components of the device 300. The processor 320 is implemented in hardware, firmware, or a combination of hardware and software. The processor 320 is a central processing unit (CPU), a graphics processing unit (GPU), an accelerated processing unit (APU), a microprocessor, a microcontroller, a digital signal processor (DSP), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or other types of processing components. In some implementations, the processor 320 includes one or more processors that can be programmed to perform functions. The memory 330 includes a random access memory (RAM), a read-only memory (ROM), and / or other types of dynamic or static storage devices (e.g., flash memory, magnetic memory, and / or optical memory) that store information and / or instructions used by the processor 320.

[0069] The storage component 340 stores information and / or software related to the operation and use of the device 300. For example, the storage component 340 may include a hard disk (e.g., a magnetic disk, an optical disk, a magneto-optical disk, and / or a solid-state disk), a compact disk (CD), a digital versatile disk (DVD), a floppy disk, a cassette, a magnetic tape, and / or other types of non-transitory computer-readable media, and corresponding drives.

[0070] Input components 350 include components that allow device 300 to receive information, such as via user input (e.g., a touch screen display, a keyboard, a keypad, a mouse, buttons, switches, and / or a microphone). Additionally or alternatively, input components 350 may include sensors for sensing information (e.g., a global positioning system (GPS) component, an accelerometer, a gyroscope, and / or an actuator). Output components 360 include components that provide output information from device 300 (e.g., a display, a speaker, and / or one or more light emitting diodes (LEDs)).

[0071] The communication interface 370 includes transceiver-like components (e.g., a transceiver and / or a separate receiver and transmitter) that enable the device 300 to communicate with other devices (such as via a wired connection, a wireless connection, or a combination of wired and wireless connections). The communication interface 370 can allow the device 300 to receive information from another device and / or provide information to another device. For example, the communication interface 370 may include an Ethernet interface, an optical interface, a coaxial interface, an infrared interface, a radio frequency (RF) interface, a universal serial bus (USB) interface, a wireless local area network interface, a cellular network interface, etc.

[0072] Device 300 can perform one or more processes described herein. Device 300 can perform these processes based on processor 320 executing software instructions stored by non-transitory computer-readable media such as memory 330 and / or storage component 340. Computer-readable media is defined herein as non-transitory memory devices. Memory devices include memory space within a single physical storage device or memory space distributed across multiple physical storage devices.

[0073] The software instructions may be read into the memory 330 and / or storage component 340 from another computer-readable medium or from another device via the communication interface 370. When executed, the software instructions stored in the memory 330 and / or storage component 340 may cause the processor 320 to perform one or more processes described herein. Additionally or alternatively, hardwired circuitry may be used in place of or in combination with software instructions to perform one or more processes described herein. Thus, the implementations described herein are not limited to any specific combination of hardware circuitry and software.

[0074] Figure 3 The number and arrangement of components shown are provided as examples. In practice, the device 300 may include Figure 3 More components, fewer components, different components, or differently arranged components than shown. Additionally or alternatively, one set of components (e.g., one or more components) of device 300 can perform one or more functions described as being performed by another set of components of device 300.

[0075] Figure 4 is a flow chart of an example process 400 for implementing a threat policy action based on the network address of a host threat. In some implementations, Figure 4 One or more process blocks of may be performed by a policy implementer platform (e.g., policy implementer platform 220). In some implementations, Figure 4 One or more process blocks of may be performed by another device or group of devices, such as management device 240 and / or control system 270, separate from or including policy implementer platform 220.

[0076] like Figure 4 As shown in , process 400 may include receiving information identifying a specific host threat to a network, wherein the information identifying the specific host threat includes a list of network addresses associated with the specific host threat (block 410). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may receive information identifying a specific host threat to a network, as described above in conjunction with Figures 1A to 2 In some implementations, the information identifying the specific host threat may include a list of network addresses associated with the specific host threat.

[0077] like Figure 4 As further shown in FIG. 4 , process 400 may include identifying network elements of the network that are associated with a particular host threat to the network (block 420). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, memory 330, etc.) may identify network elements of the network that are associated with a particular host threat to the network, as described above in conjunction with Figures 1A to 2 described.

[0078] like Figure 4 As further shown in FIG. 4 , process 400 may include determining a network control system associated with the identified network element (block 430). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, storage component 340, etc.) may determine a network control system associated with the identified network element, as described above in conjunction with Figures 1A to 2 described.

[0079] like Figure 4 As further shown in FIG. 4 , process 400 may include determining a policy implementation group of network elements in the identified network elements that map to a list of network addresses associated with a particular host threat, wherein the network control system is associated with the policy implementation group of the network elements (block 440). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, memory 330, etc.) may determine a policy implementation group of network elements in the identified network elements that map to a list of network addresses associated with a particular host threat, as described above in conjunction with Figures 1A to 2In some implementations, a network control system can be associated with a policy enforcement group of network elements.

[0080] like Figure 4 As further shown in FIG. 4 , process 400 may include determining a threat policy action to be implemented for a particular host threat (block 450). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, storage component 340, etc.) may determine a threat policy action to be implemented for a particular host threat, as described above in conjunction with Figures 1A to 2 described.

[0081] like Figure 4 As further shown in FIG. 4 , process 400 may include causing the threat policy action to be implemented by the policy implementation group of the network element via the network control system (block 460). For example, the policy implementation platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may cause the threat policy action to be implemented by the policy implementation group of the network element via the network control system, as described above in conjunction with Figures 1A to 2 described.

[0082] Process 400 may include additional implementations, such as any single implementation or any combination of implementations described below and / or described in conjunction with one or more other processes described elsewhere herein.

[0083] In some implementations, the policy implementer platform may receive network topology information associated with the network and may generate a data structure including information identifying capabilities of each network element of the network based on the network topology information. In some implementations, when identifying the network elements, the policy implementer platform may identify the network elements associated with a particular host threat to the network based on the data structure.

[0084] In some implementations, the policy implementer platform may receive host threat feed information associated with endpoint hosts in communication with a network, and may generate a data structure including information identifying sessions associated with the endpoint hosts based on the host threat feed information, wherein a particular host threat may be caused by one of the endpoint hosts. In some implementations, when identifying network elements, the policy implementer platform may identify network elements associated with a particular host threat to the network based on the data structure. In some implementations, the policy implementer platform may identify a network control system associated with the endpoint host, and may add information identifying the network control system associated with the endpoint host to the data structure.

[0085] In some implementations, the policy implementer platform may receive host threat feed information associated with endpoint hosts in communication with the network, wherein a particular host threat may be caused by one of the endpoint hosts. The policy implementer platform may cause host threat traffic outside the network to be blocked at a perimeter network element of the network based on the host threat feed information, and / or may cause host threat traffic inside the network to be blocked at a switching layer of the network based on the host threat feed information.

[0086] In some implementations, the policy implementer platform may receive host threat feed information associated with an endpoint host in communication with a network, and may tag the host threat identified by the host threat feed information with a specific identifier. In some implementations, the information identifying the specific host threat may identify the specific host threat based on a specific identifier associated with the specific host threat in the specific identifier. In some implementations, the policy implementer platform may monitor host threat traffic across the network based on the specific identifier.

[0087] although Figure 4 An example block diagram of process 400 is shown, but in some implementations, process 400 may include Figure 4 More blocks, fewer blocks, different blocks, or differently arranged blocks than those depicted in the process 400. Additionally or alternatively, two or more blocks of process 400 may be executed in parallel.

[0088] Figure 5 is a flow chart of an example process 500 for implementing a threat policy action based on the network address of a host threat. In some implementations, Figure 5 One or more process blocks of may be performed by a policy implementer platform (e.g., policy implementer platform 220). In some implementations, Figure 5 One or more process blocks of may be performed by another device or group of devices, such as management device 240 and / or control system 270, separate from or including policy implementer platform 220.

[0089] like Figure 5 As shown in , process 500 may include receiving host threat feed information associated with an endpoint host in communication with a network (block 510). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may receive host threat feed information associated with an endpoint host in communication with a network, as described above in conjunction with Figures 1A to 2 described.

[0090] like Figure 5As further shown in FIG. 5 , process 500 may include identifying a specific host threat to the network from the host threat feed information, wherein the specific host threat may be caused by one of the endpoint hosts, and the specific host threat may be associated with a list of network addresses of the network (block 520). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, memory 330, etc.) may identify a specific host threat to the network from the host threat feed information, as described above in conjunction with Figures 1A to 2 In some implementations, the specific host threat can be caused by one of the endpoint hosts, and the specific host threat can be associated with a list of network addresses of the network.

[0091] like Figure 5 As further shown in FIG. 5 , process 500 may include identifying network elements of the network that are associated with a particular host threat to the network (block 530). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, storage component 340, etc.) may identify network elements of the network that are associated with a particular host threat to the network, as described above in conjunction with Figures 1A to 2 described.

[0092] like Figure 5 As further shown in FIG. 5 , process 500 may include determining a network control system associated with the identified network element (block 540). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, memory 330, etc.) may determine a network control system associated with the identified network element, as described above in conjunction with Figures 1A to 2 described.

[0093] like Figure 5 As further shown in FIG. 5 , process 500 may include determining a policy implementation group of network elements in the identified network elements that map to a list of network addresses associated with a particular host threat, wherein the network control system may be associated with the policy implementation group of the network elements (block 550). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, storage component 340, etc.) may determine a policy implementation group of network elements in the identified network elements that map to a list of network addresses associated with a particular host threat, as described above in conjunction with Figures 1A to 2 In some implementations, a network control system can be associated with a policy enforcement group of network elements.

[0094] like Figure 5 As further shown in FIG. 5 , process 500 may include determining a threat policy action to be implemented for a particular host threat (block 560). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, memory 330, etc.) may determine a threat policy action to be implemented for a particular host threat, as described above in conjunction with Figures 1A to 2described.

[0095] like Figure 5 As further shown in FIG. 5 , process 500 may include causing the threat policy action to be implemented by the policy implementation group of the network element via the network control system (block 570). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may cause the threat policy action to be implemented by the policy implementation group of the network element via the network control system, as described above in conjunction with Figures 1A to 2 described.

[0096] Process 500 may include additional implementations, such as any single implementation or any combination of implementations described below and / or described in conjunction with one or more other processes described elsewhere herein.

[0097] In some implementations, the policy implementer platform may generate a data structure including information identifying sessions associated with the endpoint host based on the host threat feed information. In some implementations, when identifying the network element, the policy implementer platform may identify the network element associated with a particular host threat to the network based on the data structure.

[0098] In some implementations, the policy implementer platform may receive network topology information associated with the network and may generate a data structure including information identifying capabilities of each network element of the network based on the network topology information. In some implementations, when identifying the network elements, the policy implementer platform may identify the network elements associated with a particular host threat to the network based on the data structure.

[0099] In some implementations, the policy implementer platform may identify a network control system associated with the endpoint host, and may generate a data structure including information identifying the network control system associated with the endpoint host based on identifying the network control system. In some implementations, the policy implementer platform may cause host threat traffic external to the network to be blocked at a perimeter network element of the network based on the host threat feed information, and / or may cause host threat traffic internal to the network to be blocked at a switching layer of the network based on the host threat feed information.

[0100] In some implementations, the policy implementer platform may tag the host threats identified by the host threat feed information with specific identifications. In some implementations, each specific identification may be based on a media access control (MAC) address, session information, and / or a hardware identifier associated with one of the endpoint hosts. In some implementations, when identifying a specific host threat, the policy implementer platform may identify the specific host threat based on a specific identification in the specific identifications that is associated with the specific host threat.

[0101] In some implementations, the policy enforcer platform may monitor host threat traffic across the network based on a specific identification, and may provide information associated with the host threat traffic to a management device to allow the management device to analyze the host threat traffic.

[0102] although Figure 5 An example block diagram of process 500 is shown, but in some implementations, process 500 may include Figure 5 More blocks, fewer blocks, different blocks, or differently arranged blocks than those depicted in the process 500. Additionally or alternatively, two or more blocks of process 500 can be executed in parallel.

[0103] Figure 6 is a flow chart of an example process 600 for implementing a threat policy action based on the network address of a host threat. In some implementations, Figure 6 One or more process blocks of may be performed by a policy implementer platform (e.g., policy implementer platform 220). In some implementations, Figure 6 One or more process blocks of may be performed by another device or group of devices, such as management device 240 and / or control system 270, separate from or including policy implementer platform 220.

[0104] like Figure 6 As shown in , process 600 may include receiving network topology information associated with a network (block 610). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may receive network topology information associated with a network, as described above in conjunction with Figures 1A to 2 described.

[0105] like Figure 6 As further shown in FIG. 6 , process 600 may include generating a data structure including information identifying capabilities of each network element of the network based on the network topology information (block 620). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, memory 330, etc.) may generate a data structure including information identifying capabilities of each network element of the network based on the network topology information, as described above in conjunction with Figures 1A to 2 described.

[0106] like Figure 6 As further shown in FIG. 6 , process 600 may include receiving information identifying a specific host threat to a network, wherein the information identifying the specific host threat may include a list of network addresses associated with the specific host threat (block 630). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may receive information identifying a specific host threat to a network, as described above in conjunction with Figures 1A to 2In some implementations, the information that can identify a specific host threat can include a list of network addresses associated with the specific host threat.

[0107] like Figure 6 As further shown in FIG. 6 , process 600 may include identifying a network element associated with a particular host threat to the network based on the data structure (block 640). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, memory 330, etc.) may identify a network element associated with a particular host threat to the network based on the data structure, as described above in conjunction with Figures 1A to 2 described.

[0108] like Figure 6 As further shown in FIG. 6 , process 600 may include determining a network control system associated with the identified network element (block 650). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, storage component 340, etc.) may determine a network control system associated with the identified network element, as described above in conjunction with Figures 1A to 2 described.

[0109] like Figure 6 As further shown in FIG. 6 , process 600 may include determining a policy implementation group of network elements in the identified network elements that map to a list of network addresses associated with a particular host threat, wherein the network control system may be associated with the policy implementation group of the network elements (block 660). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, memory 330, etc.) may determine a policy implementation group of network elements in the identified network elements that map to a list of network addresses associated with a particular host threat, as described above in conjunction with Figures 1A to 2 In some implementations, a network control system can be associated with a policy enforcement group of network elements.

[0110] like Figure 6 As further shown in FIG. 6 , process 600 may include determining a threat policy action to be implemented for a particular host threat (block 670). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, storage component 340, etc.) may determine a threat policy action to be implemented for a particular host threat, as described above in conjunction with Figures 1A to 2 described.

[0111] like Figure 6 As further shown in FIG. 6 , process 600 may include causing the threat policy action to be implemented by the policy implementation group of the network element via the network control system (block 680). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may cause the threat policy action to be implemented by the policy implementation group of the network element via the network control system, as described above in conjunction with Figures 1A to 2 described.

[0112] Process 600 may include additional implementations, such as any single implementation or any combination of implementations described below and / or described in conjunction with one or more other processes described elsewhere herein.

[0113] In some implementations, the policy implementer platform may receive host threat feed information associated with endpoint hosts in communication with the network, and may generate another data structure including information identifying sessions associated with the endpoint hosts based on the host threat feed information, wherein a particular host threat may be caused by one of the endpoint hosts. In some implementations, when identifying the network element, the policy implementer platform may identify the network element associated with the particular host threat to the network based on the data structure and the another data structure.

[0114] In some implementations, the policy implementer platform may receive host threat feed information associated with endpoint hosts in communication with the network, wherein a particular host threat may be caused by one of the endpoint hosts. In some implementations, the policy implementer platform may cause host threat traffic outside the network to be blocked at a perimeter network element of the network based on the host threat feed information, and / or may cause host threat traffic inside the network to be blocked at a switching layer of the network based on the host threat feed information.

[0115] In some implementations, the policy implementer platform may receive host threat feed information associated with an endpoint host in communication with a network, and may tag the host threat identified by the host threat feed information with a specific identifier. In some implementations, the information identifying the specific host threat may identify the specific host threat based on a specific identifier in the specific identifier associated with the specific host threat.

[0116] In some implementations, the policy implementer platform can monitor host threat services across the network based on specific identifiers. In some implementations, the policy implementer platform can provide information associated with the host threat services to the management device to prevent the management device from performing repeated analysis on the host threat services.

[0117] although Figure 6 Example blocks of process 600 are shown, but in some implementations, process 600 may include Figure 6 More blocks, fewer blocks, different blocks, or differently arranged blocks than those depicted in the process 600. Additionally or alternatively, two or more blocks of process 600 may be executed in parallel.

[0118] Some implementations described herein provide a policy implementation platform for implementing threat policy actions based on the network address of the host threat. For example, the policy implementation platform can receive information that identifies a specific host threat to the network and includes a list of network addresses associated with the specific host threat. The policy implementation platform can identify a network element associated with a specific host threat to the network, and can determine a network control system associated with the identified network element. The policy implementation platform can determine a policy implementation group of a network element mapped to a list of network addresses associated with a specific host threat in the identified network element, and the network control system can be associated with the policy implementation group of the network element. The policy implementation platform can determine the threat policy action to be implemented for a specific host threat, and can cause the threat policy action to be implemented by the policy implementation group of the network element via the network control system.

[0119] The foregoing disclosure provides illustration and description, but is not intended to be exhaustive or to limit the implementations to the precise forms disclosed. Modifications and variations are possible in light of the above disclosure or may be acquired from practice of implementations.

[0120] As used herein, the term "component" is intended to be broadly interpreted as hardware, firmware, or a combination of hardware and software.

[0121] It is clear that the systems and / or methods described herein can be implemented in various forms of hardware, firmware, or a combination of hardware and software. The actual dedicated control hardware or software code used to implement these systems and / or methods does not limit the implementation. Therefore, the operation and behavior of the systems and / or methods are described herein without reference to specific software code - it should be understood that software and hardware can be designed to implement the systems and / or methods based on the description herein.

[0122] Even though particular combinations of features are stated in the claims and / or disclosed in the specification, these combinations are not intended to limit the disclosure of possible implementations. In fact, many of these features may be combined in ways not specifically stated in the claims and / or disclosed in the specification. Although each of the dependent claims listed below may directly depend on only one claim, the disclosure of possible implementations includes the combination of each dependent claim with every other claim in the claim set.

[0123] Unless clearly described as such, the elements, actions or instructions used in this article should not be interpreted as being critical or necessary. In addition, as used in this article, the articles "a" and "an" are intended to include one or more projects, and can be used interchangeably with "one or more". In addition, as used in this article, the term "set" is intended to include one or more projects (for example, related projects, unrelated projects, combinations of related projects and unrelated projects, etc.), and can be used interchangeably with "one or more". In the case of only one project, the term "one" or similar language is used. In addition, as used in this article, the terms "has", "have", "having" and the like are intended to be open terms. In addition, unless otherwise expressly stated, the phrase "based on" is intended to represent "based at least in part on".

Claims

1. A method for monitoring host threat services, comprising: receiving, by a device, host threat feed information associated with an endpoint host, the endpoint host being in communication with a network; marking, by the device, at least one specific identifier among a plurality of specific identifiers to mark at least one host threat among a plurality of host threats identified by the host threat feed information, The at least one specific identification is based on one of the following: Media Access Control MAC address, Session information, or a hardware identifier associated with one of the endpoint hosts; and The device monitors host threat services across the network based on the at least one specific identification.

2. The method according to claim 1, further comprising: The information associated with the host threat service is provided to a management device to prevent the management device from repeatedly analyzing the host threat service.

3. The method according to claim 1, further comprising: identifying the specific host threat among the multiple host threats based on a specific identification among the multiple specific identifications that is associated with the specific host threat; The information identifying the specific host threat includes a list of network addresses associated with the specific host threat.

4. The method according to claim 3, further comprising: Based on the host threat feed information, host threat services outside the network are blocked at peripheral network elements of the network; as well as Based on the host threat feed information, host threat traffic inside the network is blocked at a switching layer of the network.

5. The method according to claim 3, further comprising: identifying at least one network element among a plurality of network elements of the network, the at least one network element being associated with the particular host threat to the network; determining a network control system associated with the identified at least one network element; determining a policy enforcement group for at least one network element, the policy enforcement group mapping to the list of network addresses associated with the particular host threat; determining a threat policy action to be implemented for the specific host threat; as well as The threat policy action is caused to be implemented by the policy implementation group of the at least one network element via the network control system.

6. The method according to claim 3, further comprising: generating a data structure based on the host threat feed information, the data structure including information identifying a session associated with the endpoint host, The specific host threat is caused by one of the endpoint hosts; and Wherein identifying the at least one network element comprises: The at least one network element associated with the particular host threat to the network is identified based on the data structure.

7. The method according to claim 1, further comprising: identifying a network control system associated with the endpoint host; as well as Information identifying the network control system associated with the endpoint host is added to a data structure.

8. A device for monitoring host threat services, comprising: one or more memories; as well as One or more processors to: receiving host threat feed information associated with an endpoint host, the endpoint host being in communication with a network, wherein the host threat feed information includes information identifying a network address associated with the threat feed; marking at least one host threat among a plurality of host threats identified by the host threat feed information using at least one specific identifier among a plurality of specific identifiers, The at least one specific identification is based on one of the following: Media Access Control MAC address, Session information, or a hardware identifier associated with one of the endpoint hosts, and wherein a subset of the endpoint hosts representing a threat are marked using the at least one specific identifier; as well as Host threat traffic across the network is monitored based on the at least one specific identification.

9. The apparatus of claim 8, wherein the one or more processors are further configured to: Information associated with the host threat service is provided to a management device to permit the management device to analyze the host threat service.

10. The apparatus of claim 8, wherein the one or more processors are further configured to: The information associated with the host threat service is provided to a management device to prevent the management device from repeatedly analyzing the host threat service.

11. The apparatus of claim 8, wherein the one or more processors are further configured to: adding information identifying the plurality of specific identifiers to the data structure, Wherein the data structure includes information identifying an endpoint host and a session associated with the endpoint host.

12. The apparatus of claim 8, wherein the one or more processors are further configured to: identifying the specific host threat based on a specific identifier among the multiple specific identifiers that is associated with a specific host threat among the multiple host threats, The information identifying the specific host threat includes a list of network addresses associated with the specific host threat.

13. The apparatus of claim 12, wherein the one or more processors are further configured to: Based on the host threat feed information, host threat services outside the network are blocked at peripheral network elements of the network; and Based on the host threat feed information, host threat traffic inside the network is blocked at a switching layer of the network.

14. The apparatus of claim 12, wherein the one or more processors are further configured to: receiving the specific host threat based on the at least one specific identification; identifying at least one network element associated with the specific host threat based on the network topology information and the at least one specific identification; and A network control system associated with the at least one network element is identified.

15. A non-transitory computer-readable medium storing instructions, the instructions comprising: One or more instructions that, when executed by one or more processors, cause the one or more processors to: receiving host threat feed information associated with an endpoint host, the endpoint host being in communication with a network, wherein the host threat feed information includes information identifying a network address associated with the threat feed; marking at least one host threat among a plurality of host threats identified by the host threat feed information using at least one specific identifier among a plurality of specific identifiers, The at least one specific identification is based on one of the following: Media Access Control MAC address, Session information, or a hardware identifier associated with one of the endpoint hosts, and wherein a subset of the endpoint hosts representing a threat are marked using the at least one specific identifier; identifying the specific host threat based on a specific identifier among the multiple specific identifiers that is associated with a specific host threat among the multiple host threats; determining a threat policy action to be implemented for the specific host threat; as well as The threat policy action is caused to be implemented.

16. The non-transitory computer readable medium of claim 15, wherein the instructions further comprise: one or more instructions that, when executed by the one or more processors, cause the one or more processors to: identifying at least one network element associated with the specific host threat based on the network topology information and the at least one specific identification; identifying a network control system associated with the at least one network element; as well as The threat policy action is caused to be implemented, via the network control system, by a policy implementation group associated with the at least one network element.

17. The non-transitory computer readable medium of claim 16, wherein the instructions further comprise: one or more instructions that, when executed by the one or more processors, cause the one or more processors to: generating a data structure based on the host threat feed information, the data structure including information identifying a session associated with the endpoint host, and wherein the one or more instructions causing the one or more processors to identify the at least one network element cause the one or more processors to: The at least one network element associated with the particular host threat to the network is identified based on the data structure.

18. The non-transitory computer readable medium of claim 15, wherein the instructions further comprise: one or more instructions that, when executed by the one or more processors, cause the one or more processors to: monitoring host threat services across the network based on the multiple specific identifiers; as well as Information associated with the host threat service is provided to a management device to permit the management device to analyze the host threat service.

19. The non-transitory computer readable medium of claim 15, wherein the instructions further comprise: one or more instructions that, when executed by the one or more processors, cause the one or more processors to: identifying a network control system associated with the endpoint host; as well as A data structure is generated based on identifying the network control system, the data structure including information identifying the network control system associated with the endpoint host.

20. The non-transitory computer readable medium of claim 15, wherein the instructions further comprise: one or more instructions that, when executed by the one or more processors, cause the one or more processors to: monitoring host threat services across the network based on the multiple specific identifiers; as well as The information associated with the host threat service is provided to a management device to prevent the management device from repeatedly analyzing the host threat service.

Images