Method, device and medium for performing actions on an endpoint host

Abstract

Embodiments of the present application relate to tracking host threats in a network and implementing threat policy actions for the host threats. A device receives network segmentation information identifying a network segment associated with a network, and receives endpoint host session information identifying a session associated with an endpoint host that communicates with the network. The device generates a data structure including information associating the network segment with the session associated with the endpoint host based on the network segmentation information and the endpoint host session information. The device updates the data structure based on a change in the location of the endpoint host within the network segment based on a change tag of the session associated with the endpoint host, and identifies a specific endpoint host among the endpoint hosts that has changed its location within the network segment based on the data structure. The device determines a threat policy action to be implemented for the specific endpoint host, and causes the threat policy action to be implemented by the network for the specific endpoint host.

Description

[0001] Divisional Application Instructions

[0002] This application is a divisional application of a Chinese invention patent application with an application date of March 14, 2019, priority dates of March 23, 2018 and June 29, 2018, application number 201910194546.8, and name “Tracking host threats in the network and implementing threat strategy actions against host threats”.

[0003] CROSS-REFERENCE TO RELATED APPLICATIONS

[0004] This application claims priority under 35 U.S.C. §119 to U.S. Provisional Patent Application Nos. 62 / 647,431 and 62 / 647,460, filed on March 23, 2018, the contents of which are incorporated herein by reference in their entirety. Technical Field

[0005] Embodiments of the present application relate to tracking host threats in a network and implementing threat policy actions against the host threats. Background Art

[0006] As malware becomes more sophisticated, threat defense solutions can provide sufficient threat detection to implement infected endpoint host security controls at the perimeter of the network. However, in the case of adaptive network changes where threats are injected from both external endpoint host threats and internal endpoint host threats, security controls at the perimeter of the network may be insufficient. For example, an endpoint host threat that is connected to the network at a specific network segment and blocked at the network perimeter may bypass security controls when the endpoint host threat moves laterally to different network segments, different campuses, different sites, etc., because the network address (e.g., Internet Protocol (IP) address, Media Access Control (MAC) address, etc.) associated with the endpoint host threat may change. Summary of the invention

[0007] According to some implementations, a device may include one or more memories and one or more processors for receiving network segmentation information identifying a network segment associated with a network, and receiving endpoint host session information identifying a session associated with an endpoint host that communicates with the network. The one or more processors may generate a data structure including information associating the network segment with the session associated with the endpoint host based on the network segmentation information and the endpoint host session information. The one or more processors may update the data structure based on changes in the sessions associated with the endpoint hosts and based on changes in the location of the endpoint hosts within the network segment, and may identify a particular one of the endpoint hosts that has changed its location within the network segment based on the data structure. The one or more processors may determine a threat policy action to be implemented for the particular endpoint host, and may cause implementation of the threat policy action by the network for the particular endpoint host.

[0008] According to some implementations, a non-transitory computer-readable medium may store instructions that include one or more instructions that, when executed by one or more processors of a device, cause the one or more processors to: receive host threat feed information associated with an endpoint host in communication with a network, and receive network segmentation information identifying a network segment associated with the network. The one or more instructions may cause the one or more processors to receive endpoint host session information identifying a session associated with the endpoint host, and generate a data structure including information identifying a host threat feed associated with the endpoint host and information associating a network segment with a session associated with the endpoint host based on the host threat feed information, the network segmentation information, and the endpoint host session information. The one or more instructions may cause the one or more processors to update the data structure based on changes in sessions associated with the endpoint host and based on changes in the location of the endpoint host within the network segment, and identify a specific endpoint host among the endpoint hosts that has changed its location within the network segment based on the data structure. The one or more instructions may cause the one or more processors to determine a threat policy action to be implemented for a specific endpoint host, and cause the threat policy action to be implemented by the network for the specific endpoint host.

[0009] According to some implementations, a method may include receiving network topology information identifying capabilities of network elements of a network, and receiving network segmentation information identifying network segments associated with the network. The method may include receiving endpoint host session information identifying sessions associated with endpoint hosts that communicate with the network, and generating a data structure including information associating network segments with sessions associated with the endpoint hosts based on the network topology information, the network segmentation information, and the endpoint host session information. The method may include updating the data structure based on changes in sessions associated with the endpoint hosts and based on changes in the locations of the endpoint hosts within the network segment, and identifying, based on the data structure, a particular one of the endpoint hosts that has changed locations within the network segment. The method may include determining a threat policy action to be implemented for the particular endpoint host, and causing the threat policy action to be implemented for the particular endpoint host by one or more network elements of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figures 1A to 1K is a diagram of an example implementation described herein;

[0011] Figure 2 is a diagram of an example environment in which the systems and / or methods described herein may be implemented;

[0012] Figure 3 yes Figure 2 diagrams of example components of one or more devices;

[0013] Figure 4 is a flow chart of an example process for tracking host threats in a network and implementing threat policy actions against the host threats;

[0014] Figure 5 is a flow chart of an example process for tracking host threats in a network and implementing threat policy actions against the host threats; and

[0015] Figure 6 is a flow chart of an example process for tracking host threats in a network and implementing threat policy actions against the host threats. DETAILED DESCRIPTION

[0016] The following detailed description of example implementations refers to the accompanying drawings.The same reference numbers in different drawings may identify the same or similar elements.

[0017] Threat remediation systems that are unaware of the mobility of potential endpoint host threats in the network introduce several challenges. For example, threat identification is limited to detection in the data path of endpoint host threats that communicate with the network through perimeter network devices, lateral propagation of endpoint host threats inside the network cannot be detected and further expansion cannot be controlled, and once endpoint host threats move to different network segments, endpoint host threats may gain additional access rights and privileges, thereby compromising unprotected network segments. As a result, threat remediation systems are unable to consistently and effectively monitor, identify, and remediate endpoint host threats in real time throughout the network.

[0018] Some implementations described herein provide a policy implementer platform that tracks host threats in a network and implements threat policy actions for host threats. For example, the policy implementer platform can receive network segmentation information that identifies a network segment associated with a network, and can receive endpoint host session information that identifies a session with an endpoint host associated with network communications. The policy implementer platform can generate a data structure including information that associates a network segment with a session associated with an endpoint host based on the network segmentation information and the endpoint host session information. The policy implementer platform can update the data structure based on changes in sessions associated with the endpoint host and based on changes in the location of the endpoint host within the network segment, and can identify a specific endpoint host in the endpoint host that has changed its location within the network segment based on the data structure. The policy implementer platform can determine the threat policy action to be implemented for a specific endpoint host, and can cause the threat policy action to be implemented by the network for a specific endpoint host.

[0019] Figures 1A to 1K is a diagram of an example implementation 100 described herein. Figure 1A As shown in , a user device (e.g., an endpoint host) can be associated with a network, a policy enforcer platform, and a management device. Figure 1A As further shown in , a network may include local area network (LAN) devices that may be provided by multiple different vendors (e.g., multi-vendor LAN devices), wireless local area network (WLAN) devices that may be provided by multiple different vendors (e.g., multi-vendor WLAN devices), network devices that may be provided by multiple different vendors, and / or network control systems (e.g., control systems) that may be provided by multiple different vendors. In some implementations, each control system may control and / or manage a network segment of the network. For example, a control system associated with a particular vendor may utilize devices associated with the particular vendor to control a network segment.

[0020] like Figure 1A, and as further indicated by reference numeral 105, the policy implementer platform may receive network topology information associated with the network from one or more control systems. In some implementations, the network topology information may include information identifying devices associated with the network (e.g., multi-vendor LAN devices, multi-vendor WLAN devices, network devices, control systems, endpoint hosts, etc.). For example, the network topology information may include information identifying the manufacturer, model, device identifier, throughput, bandwidth, network address, etc. of devices associated with the network, information identifying hardware provided in devices associated with the network, information identifying software provided in devices associated with the network, etc.

[0021] like Figure 1A , and as further shown by reference numeral 110, the policy implementer platform may receive host threat feed information associated with the network from a management device. In some implementations, the management device may include a security information and event management (SIEM) device that combines security information management (SIM) and security event management (SEM) and provides real-time analysis of security alerts generated by applications and devices associated with the network. In some implementations, the host threat feed information may include information identifying a threat feed associated with the network (e.g., a feed provided by an endpoint host and including threats). In some implementations, the host threat feed information may include information identifying a network address (e.g., an IP address) associated with the threat feed.

[0022] like Figure 1B 115, the policy implementer platform may generate a data structure (e.g., a database, table, list, etc.) based on the network topology information, the data structure including information identifying network elements associated with the network (e.g., multi-vendor LAN devices, multi-vendor WLAN devices, network devices, control systems, endpoint hosts, etc.). In some implementations, the data structure may include network topology information associated with the network elements, as described above. In some implementations, the policy implementer platform may utilize the network topology information to determine capabilities associated with the network elements, and may store the information identifying the capabilities associated with the network elements in the data structure. For example, Figure 1B As further shown in , the data structure may include information identifying a network element (e.g., a router, a switch, a firewall, a LAN device, a WLAN device, etc.), information identifying capabilities of the network element (e.g., routing services, switching services, threat defense, routing LAN services, routing WLAN services, etc.), etc. In some implementations, the data structures described herein may be stored in a memory associated with a policy implementer platform.

[0023] In some implementations, the policy implementer platform may utilize the network topology information to determine the capabilities associated with the network elements by analyzing the network topology information and determining the hardware, software, model, throughput, bandwidth, network address, etc. of the devices associated with the network based on analyzing the network topology information. The policy implementer platform may determine the capabilities associated with the network elements based on the hardware, software, model, throughput, bandwidth, network address, etc. of the devices associated with the network.

[0024] In some implementations, the policy implementer platform may utilize one or more artificial intelligence models to process network topology information to determine capabilities associated with network elements. In some implementations, the one or more artificial intelligence models may include one or more of a support vector machine model, an artificial neural network model, a data mining model, a pattern discovery model, and the like.

[0025] The support vector machine model may include a supervised learning model with one or more associated learning algorithms that analyze data for classification and regression analysis. Given a set of training examples, each labeled as belonging to one or the other of two categories, the training method of the support vector machine model builds a model that assigns new examples to one category or the other. The support vector machine model is a representation of the examples as points in space, mapped so that examples of separate categories are divided by clear gaps as wide as possible. New examples are then mapped into the same space and predicted to belong to which category based on which side of the gap they fall.

[0026] Artificial neural network models may include models that use artificial neural networks (e.g., to determine capabilities associated with network elements). Artificial neural networks utilize a collection of connected units or nodes called artificial neurons. Each connection between artificial neurons can transmit a signal from one artificial neuron to another artificial neuron. The artificial neuron that receives the signal can process the signal and then provide the signal to the artificial neuron connected to it. Artificial neurons and connections typically have weights that are adjusted as learning proceeds. The weights can increase or decrease the strength of the signal at the connection. In addition, the artificial neuron can have a threshold value so that the artificial neuron only sends a signal if the aggregate signal meets the threshold value. Typically, artificial neurons are organized in layers, and different layers can perform different types of transformations on their inputs.

[0027] Data mining models may include models that perform anomaly detection (e.g., outlier, change, and / or deviation detection) to identify unusual data records of interest or data errors that require further investigation, perform association rule learning (e.g., dependency modeling) to search for relationships between variables, perform clustering to discover groups and / or structures in similar data without using known structures in the data, perform classification to generalize known structures applied to new data, perform regression to identify functions that model the data with minimal error, perform summarization to provide a more compact representation of the data set, including visualization and report generation, etc.

[0028] Pattern discovery models can include data mining techniques, such as sequential pattern mining. Sequential pattern mining is a type of structured data mining that seeks to identify statistically relevant patterns between data examples where values ​​are passed in sequence. Sequential pattern mining can be categorized as string mining (e.g., which is based on string processing models) and / or item set mining (e.g., which is based on association rule learning). String mining deals with a finite alphabet of items that appear in a sequence, but the sequences themselves may be very long. Item set mining deals with discovering frequent item sets and the order in which frequent item sets appear.

[0029] In some implementations, the policy implementer platform can utilize one or more artificial intelligence models and can utilize the best result determined by one of the artificial intelligence models. In some implementations, the policy implementer platform can utilize multiple artificial intelligence models and can aggregate the results determined by multiple artificial intelligence models.

[0030] like Figure 1B , and as further shown by reference numeral 120, the policy implementer platform may generate a data structure (e.g., a database, table, list, etc.) including information identifying endpoint hosts (e.g., user devices) connected to the network based on the network topology information and / or the host threat feed information. In some implementations, the data structure may include network topology information associated with the endpoint host, as described above. In some implementations, the policy implementer platform may utilize the network topology information and / or the host threat feed information to determine a session associated with the endpoint host, and may store the information identifying the session associated with the endpoint host in the data structure. For example, Figure 1B As further shown in , the data structure may include information identifying an endpoint host (e.g., a computer, smart phone, laptop, tablet, wearable device, etc.), information identifying a session of the endpoint host (e.g., active, inactive, etc.), information identifying a threat score associated with the session (e.g., based on a threat level from 0 to 10, where zero indicates no threat and 10 indicates maximum threat), etc. In some implementations, the threat score may be provided by host threat feed information.

[0031] like Figure 1C In the example shown by reference numeral 125, the policy implementer platform may identify a control system associated with an endpoint host of the data structure including information identifying the endpoint host (eg, Figure 1B ). In some implementations, the policy implementer platform can utilize the network address (e.g., IP address) of the endpoint host to match each endpoint host to a particular network segment. In such an implementation, the policy implementer platform can determine (e.g., based on the network topology information) which control system is associated with (e.g., manages) each particular network segment, and can therefore identify the control system associated with the endpoint host. In some implementations, the policy implementer platform can add information identifying the associated control system to the data structure, which includes information identifying the endpoint host. For example, as Figure 1C As further shown in FIG. 1 , control system 1 may be associated with a computer and a smart phone, control system 2 may be associated with a tablet computer, control system 3 may be associated with a laptop computer, and control system 4 may be associated with a wearable device.

[0032] refer to Figure 1D In some implementations and based on the host threat feed information (e.g., based on a threat score associated with the host threat feed), a policy implementer may coordinate threat enforcement actions by blocking endpoint host traffic at a perimeter network device (e.g., a firewall) of the network for external host threat traffic provided between LAN devices and / or WLAN devices, network devices, and endpoint hosts (e.g., north-south communication). Additionally or alternatively, a policy implementer may coordinate threat enforcement actions by blocking endpoint host traffic at a switching layer of the network for internal host threat traffic provided between LAN devices and / or between WLAN devices (e.g., east-west communication).

[0033] like Figure 1D In some implementations, the policy implementer platform may provide information to a control system associated with the peripheral network device indicating that the peripheral network device is to block the external host threat service. In such an implementation, the control system may provide an instruction to the peripheral network device to block the external host threat service. The peripheral network device may receive the instruction and may block the external host threat service based on the instruction. For example, since the tablet computer and the wearable device have active sessions with threat scores of 8 and 9, respectively (e.g., as shown in FIG. 1 ), the peripheral network device may be configured to block the external host threat service. Figure 1C ), so the policy enforcement platform can determine that the tablet computer and the wearable device represent external host threat services, and can cause the peripheral network devices associated with the tablet computer and the wearable device to block services received from the tablet computer and the wearable device, such as Figure 1D As further shown in .

[0034] like Figure 1D As further shown by reference numeral 135, the policy implementer platform can cause internal host threat traffic to be blocked at the switching layer of the network. In some implementations, the policy implementer platform can provide information to a control system associated with the switching layer (e.g., communications between LAN devices and / or WLAN devices) indicating that the LAN device and / or WLAN device will block the internal host threat traffic. In such an implementation, the control system can provide instructions to the LAN device and / or WLAN device to block the internal host threat traffic. The LAN device and / or WLAN device can receive the instruction and can block the internal host threat traffic based on the instruction. For example, the policy implementer platform can determine that a tablet computer and a wearable device generate internal host threat traffic in the LAN and / or WLAN, and can cause the LAN device and / or WLAN device associated with the LAN and / or WLAN to block such traffic.

[0035] like Figure 1E As shown in the figure by reference numeral 140, the policy implementer platform can tag the host threat with a unique identification (ID). In some implementations, each unique ID can include a MAC address associated with a network interface card (NIC) associated with the endpoint host representing the threat, session information associated with the endpoint host representing the threat (e.g., user login session details), a device identifier associated with the endpoint host representing the threat (e.g., model, serial number, etc.), a combination of the foregoing, etc. In this way, the policy implementer platform can also track the endpoint host representing the threat even when the endpoint host is assigned a different network address (e.g., IP address) based on the location and manner in which the endpoint host reattaches to a new network segment after migrating (e.g., lateral migration) through the network.

[0036] In some implementations, such as Figure 1E As further shown in , the policy enforcement platform can mark only those endpoint hosts that represent a threat using a unique ID. For example, since a tablet computer and a wearable device have active sessions with threat scores of 8 and 9, respectively (e.g., Figure 1C ), the policy enforcement platform can tag the tablet computer and the wearable device with unique IDs (e.g., unique ID 1 and unique ID 2, respectively). In this way, the policy enforcement platform can track the movement of the tablet computer and the wearable device through the network. In some implementations, the policy enforcement platform can add information identifying the unique ID to the data structure, which includes information identifying the endpoint host and the session associated with the endpoint host (e.g., as shown in Figure 1B ).

[0037] like Figure 1F As shown in the figure numeral 145, the policy implementer platform can monitor host threat traffic across the network based on the unique ID. In some implementations, the policy implementer can automate the monitoring and tracking of lateral propagation of endpoint hosts representing threats on the network, and can continue to implement actions against endpoint hosts representing threats (e.g., can monitor and / or perform actions with respect to wired to wireless to wired session migration and / or multi-vendor network segmentation). In some implementations, the policy implementer can perform actions related to tracking and / or policy orchestration of endpoint hosts representing threats based on tagging endpoint hosts representing threats with unique IDs. The unique ID can enable the policy implementer platform to track endpoint hosts representing threats even when the endpoint hosts are assigned different network addresses (e.g., IP addresses) based on where and how the endpoint hosts reattach to new network segments after migrating through the network.

[0038] like Figure 1G As shown in the figure by reference numeral 150, the policy implementation platform can provide the host threat information to the management device to reduce the repeated analysis of the management device, reduce the management device from falsely identifying the endpoint host as a threat, provide a consistent security posture for the entire network, etc. In some implementations, since the management device can monitor the network and implement security policies for the network, the policy implementation platform can provide the management device with the host threat information determined by the policy implementation platform. In some implementations, the host threat information can include information determined based on monitoring the host threat business across the network based on the unique ID, as described above in conjunction with Figure 1F described.

[0039] like Figure 1H As shown in Figure 155, the policy implementer platform may receive network segmentation information and endpoint host session information from the management device. In some implementations, the network segmentation information may include information identifying a network segment of the network, such as a LAN of the network, a WLAN of the network, a set of network devices of the network, etc. In some implementations, the endpoint host session information may include information identifying an endpoint host in communication with the network, a session associated with the endpoint host, etc.

[0040] In some implementations, the policy implementer platform may not receive network segmentation information and / or endpoint host session information from a management device. In such implementations, the policy implementer platform may dynamically determine network segmentation information and / or endpoint host session information based on network topology information and / or host threat feed information. For example, the policy implementer platform may dynamically discover (e.g., based on network topology information) network segmentation for layer 2 and layer 3 devices (e.g., of the Open Source Interconnect (OSI) model), including network devices (e.g., switches, perimeter firewalls, etc.). In such implementations, the policy implementer platform may utilize network topology information and / or host threat feed information to identify endpoint hosts (e.g., user devices) connected to the network and determine sessions associated with the endpoint hosts.

[0041] like Figure 1H In the example and further indicated by reference numeral 160, the policy implementer platform may generate a data structure (e.g., a database, a table, a list, etc.) including information identifying the endpoint host session and the associated network segment based on the network segment information and / or the endpoint host session information. Figure 1H As further shown in , the data structure may include information identifying an endpoint host (e.g., a computer, a smart phone, a laptop, a tablet computer, a wearable device, etc.) and information identifying a session (e.g., active, inactive, etc.) of the endpoint host. In some implementations, the policy implementer platform may utilize the network segmentation information and / or the endpoint host session information to determine network address information (e.g., an IP address, a MAC address, a port identifier, etc.) associated with the endpoint host, and may store the information identifying the network address information associated with the endpoint host in the data structure. In some implementations, the policy implementer platform may utilize the network segmentation information and / or the endpoint host session information to determine a network segment associated with the endpoint host, and may store the information identifying the network segment associated with the endpoint host in the data structure.

[0042] For example, Figure 1H As further shown in , the data structure can include information identifying the following: an endpoint host (e.g., a computer, a smart phone, a laptop, a tablet, a wearable device, etc.), a session associated with the endpoint host (e.g., active or inactive), an IP address associated with the endpoint host (e.g., IP2, IP7, IP5, IP1, IP3, etc.), a MAC address associated with the endpoint host (e.g., MAC1, MAC3, MAC2, MAC7, MAC6, etc.), a port identifier associated with the endpoint host (e.g., port 4, port 3, port 6, port 9, port 7, etc.), a network segment associated with the endpoint host (e.g., LAN device 2, WLAN device 1, WLAN device 2, LAN device 3, LAN device 1, etc.), etc.

[0043] like Fig. 1I As shown in the figure by reference numeral 165, the policy implementer platform can update the data structure based on changes in the host session and / or based on the movement of the endpoint host across or within the network segment. In some implementations, the policy implementer platform can periodically refresh the information in the data structure based on detected changes in the session state. For example, Fig. 1I As further shown in , if the policy enforcer platform detects that the host session of the computer changes from active to inactive, and the host session of the smartphone changes from inactive to active, the policy enforcer platform can update the data structure to reflect such changes.

[0044] In some implementations, the policy enforcer platform may maintain information identifying the movement of endpoint hosts across or within network segments in a data structure. Fig. 1I As further shown in , if the policy enforcer platform detects that the laptop moves from WLAN device 2 to WLAN device 4, and the wearable device moves from LAN device 1 to LAN device 5, the policy enforcer platform can update the data structure to reflect such movements.

[0045] In some implementations, for networks with specific wired access switches and / or wireless networks, the policy implementer platform can dynamically integrate with various supported third-party control systems to enhance the information provided in the data structure, such as information related to network segmentation and / or endpoint host sessions. In some implementations, the policy implementer platform can continuously track the lateral movement of endpoint host threats across the network, and can maintain the original threat policy actions for endpoint host threats on the network. For example, for endpoint host threats, in the case of implementing threat policy actions, the policy implementer platform can maintain a unique ID for the endpoint host threat in order to track the endpoint host threat. In some implementations, the policy implementer platform can be bound to the original IP address of the endpoint host threat, and can periodically query the endpoint host threat session to determine changes in the location of the endpoint host threat within the network segment.

[0046] like Figure 1JIn some implementations, any change in the location of the endpoint host within the network segment may trigger the automatic implementation of the new threat policy action. In some implementations, the policy implementer platform may determine the new policy action based on the movement of the endpoint host across network segments or within the network segment. For example, if the endpoint host moves from a LAN of a network to a WLAN of the network, the policy implementer platform may determine that such movement indicates a particular type of threat, and a new threat policy action may be implemented to combat the particular type of threat. In another example, the policy implementer platform may determine that the movement to the WLAN of the network requires a new threat policy action designed to handle threats in the WLAN rather than the LAN.

[0047] In some implementations, the policy implementer platform can provide (e.g., to a management device) information identifying endpoint host threats, movement of endpoint host threats, etc., so that the management device can make the following intelligent decisions: using the current unique host ID to update the threat feed, reducing duplication of threat feeds for the same endpoint host, etc.

[0048] like Figure 1K As shown in the figure by reference numeral 175, the policy implementer platform can enable the implementation of a new threat policy action for the relocated endpoint host. In some implementations, the policy implementer platform can provide information to the control system associated with the relocated endpoint host indicating that the network element associated with the control system will implement the new threat policy action. In such an implementation, the control system can provide instructions to the network element associated with the control system to implement the new threat policy action. The network element associated with the control system can receive the instruction and can implement the new threat policy action based on the instruction. In some implementations, the new threat policy action can include dropping traffic from the relocated endpoint host, isolating traffic from the relocated endpoint host, logging traffic from the relocated endpoint host for further analysis, redirecting traffic from the relocated endpoint host to a device that can perform a deeper analysis of the traffic, etc.

[0049] Some implementations described herein may relate to the problem of host threat mobility in a multi-vendor network. Additionally or alternatively, some implementations described herein may relate to host threat policy orchestration for a given IP feed generated by an endpoint host. Additionally or alternatively, some implementations described herein may provide a way to uniquely identify endpoint hosts in a network, such as when a host threat feed identifies multiple endpoint hosts with the same IP address as a potential risk by IP address (e.g., this may be required for threat remediation).

[0050] Some implementations described herein may identify specific endpoint host sessions in a specific network segment (e.g., based on an IP address in a threat feed). Additionally or alternatively, some implementations described herein may associate specific policy actions against groups of endpoint hosts, and may implement the policy actions on specific control systems. For example, a threat feed may identify an IP address as a threat, and based on the IP address, some implementations described herein may identify the correct endpoint host for implementing the policy action based on the endpoint host's unique ID. In this manner, some implementations described herein are able to implement policy actions against an endpoint host regardless of whether the endpoint host's IP address has changed or will change (e.g., due to disconnecting from and reconnecting to a network, migrating through a network, etc.).

[0051] Additionally or alternatively, in an enterprise network or campus branch deployment (e.g., where the branch networks are configured with similar IP addressing schemes with overlapping IP addresses), the policy enforcement platform can create a set of secure network elements to uniquely associate with the branch network, and can dynamically determine the correct endpoint host to implement threat remediation actions that match the IP address of the threat host feed of the specific set of secure network elements. This can prevent the policy enforcement platform from implementing policy actions for incorrect endpoint sessions in the event that multiple endpoint sessions are active for the same IP address.

[0052] In this way, several different stages of the process for tracking host threats in a network and implementing threat policy actions for host threats can be automated, which can eliminate human subjectivity and waste in the process, and can improve the speed and efficiency of the process and save computing resources (e.g., processor resources, memory resources, etc.). In addition, the implementation described herein uses a strict computerized process to perform tasks or roles that were not previously performed or were previously performed using subjective human intuition or input. For example, currently, there is no technology for tracking host threats in a network and implementing threat policy actions for host threats. Finally, the automation of the process for tracking host threats in a network and implementing threat policy actions for host threats saves computing resources (e.g., processor resources, memory resources, etc.) that would otherwise be wasted when trying to resist host threats on the network.

[0053] As mentioned above, Figures 1A to 1K Provided as an example only. Other examples are possible and may be related to Figures 1A to 1K The examples described are different.

[0054] Figure 2 2 is a diagram of an example environment 200 in which the systems and / or methods described herein may be implemented. Figure 2As shown in FIG, environment 200 may include user device 210, policy implementer platform 220, network 230, management device 240, LAN device 250, WLAN device 260, control system 270, and network device 280. The devices of environment 200 may be interconnected via wired connections, wireless connections, or a combination of wired and wireless connections.

[0055] The user device 210 includes one or more devices capable of receiving, generating, storing, processing, and / or providing information, such as the information described herein. For example, the user device 210 may include a mobile phone (e.g., a smart phone, a wireless phone, etc.), a laptop computer, a tablet computer, a desktop computer, a handheld computer, a gaming device, a wearable communication device (e.g., a smart watch, smart glasses, etc.), or a similar type of device. In some implementations, the user device 210 may receive information from and / or transmit information to one or more other devices of the environment 200.

[0056] The policy implementation platform 220 includes one or more devices capable of tracking host threats in the network and implementing threat policy actions for host threats. In some implementations, the policy implementation platform 220 can be designed to be modular so that certain software components can be swapped in or out according to specific needs. In this way, the policy implementation platform 220 can be easily and / or quickly reconfigured for different purposes. In some implementations, the policy implementation platform 220 can receive information from one or more other devices of the environment 200 and / or transmit information to it.

[0057] In some implementations, as shown, the policy implementer platform 220 can be hosted in a cloud computing environment 222. It is worth noting that while the implementations described herein describe the policy implementer platform 220 as being hosted in a cloud computing environment 222, in some implementations, the policy implementer platform 220 may not be cloud-based (i.e., may be implemented outside of a cloud computing environment, such as within one or more server devices), or may be partially cloud-based.

[0058] Cloud computing environment 222 includes an environment that hosts policy implementer platform 220. Cloud computing environment 222 can provide computing, software, data access, storage, etc. services that do not require end-user knowledge of the physical location and configuration of the systems and / or devices hosting policy implementer platform 220. As shown, cloud computing environment 222 can include a set of computing resources 224 (collectively, "computing resources 224" and individually, "computing resource 224").

[0059] The computing resources 224 include one or more personal computers, workstation computers, server devices, or other types of computing and / or communication devices. In some implementations, the computing resources 224 can host the policy implementer platform 220. Cloud resources can include computing instances executed in the computing resources 224, storage devices provided in the computing resources 224, data transmission devices provided by the computing resources 224, etc. In some implementations, the computing resources 224 can communicate with other computing resources 224 via wired connections, wireless connections, or a combination of wired and wireless connections.

[0060] like Figure 2 As further shown in FIG. 1 , the computing resources 224 include a set of cloud resources, such as one or more applications (“APP”) 224 - 1 , one or more virtual machines (“VM”) 224 - 2 , a virtualized storage device (“VS”) 224 - 3 , one or more hypervisors (“HYP”) 224 - 4 , and the like.

[0061] Applications 224-1 include one or more software applications that can be provided to or accessed by user device 210. Applications 224-1 can eliminate the need to install and execute software applications on user device 210. For example, applications 224-1 can include software associated with policy implementer platform 220 and / or any other software that can be provided via cloud computing environment 222. In some implementations, one application 224-1 can send / receive information to / from one or more other applications 224-1 via virtual machine 224-2.

[0062] Virtual machine 224-2 includes a software implementation of a machine (e.g., a computer) that executes programs such as a physical machine. Virtual machine 224-2 can be a system virtual machine or a process virtual machine, depending on the use and correspondence of virtual machine 224-2 to any real machine. System virtual machines can provide a complete system platform that supports the execution of a complete operating system ("OS"). Process virtual machines can execute a single program and can support a single process. In some implementations, virtual machine 224-2 can execute on behalf of a user (e.g., a user of user device 210 or an operator of policy implementer platform 220) and can manage the infrastructure of cloud computing environment 222, such as data management, synchronization, or long-term data transfer.

[0063] The virtualized storage device 224-3 includes one or more storage systems and / or one or more devices that use virtualization technology within the storage system or device of the computing resource 224. In some implementations, in the context of the storage system, the virtualization type may include block virtualization and file virtualization. Block virtualization may refer to the abstraction (or separation) of logical storage from physical storage, so that the storage system can be accessed without considering physical storage or heterogeneous structures. Separation can allow administrators of the storage system to flexibly manage the storage of end users. File virtualization can eliminate the dependency between data accessed at the file level and the location where the file is physically stored. This can achieve optimization of storage usage, server consolidation and / or non-disruptive file migration performance.

[0064] Hypervisor 224-4 can provide hardware virtualization technology that allows multiple operating systems (e.g., "guest operating systems") to execute simultaneously on a host computer (such as computing resource 224). Hypervisor 224-4 can present a virtual operating platform to the guest operating systems and can manage the execution of the guest operating systems. Multiple instances of various operating systems can share virtualized hardware resources.

[0065] The network 230 includes one or more wired and / or wireless networks. For example, the network 230 may include a cellular network (e.g., a fifth generation (5G) network, a long term evolution (LTE) network, a third generation (3G) network, a code division multiple access (CDMA) network, etc.), a public land mobile network (PLMN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a telephone network (e.g., a public switched telephone network (PSTN)), a private network, an ad hoc network, an intranet, the Internet, a fiber-based network, etc., and / or a combination of these or other types of networks.

[0066] The management device 240 includes one or more devices capable of receiving, generating, storing, processing, and / or providing the information described herein. For example, the management device 240 may include a server (e.g., in a data center or cloud computing environment), a data center (e.g., a multi-server micro data center), a workstation computer, a VM provided in a cloud computing environment, or a similar type of device. In some implementations, the management device 240 may receive information from and / or provide information to one or more other devices of the environment 200. In some implementations, the management device 240 may be a physical device implemented within a housing such as a chassis. In some implementations, the management device 240 may be a virtual device implemented by one or more computer devices of a cloud computing environment or a data center. In some implementations, the management device 240 may identify a host threat feed generated by an endpoint host (e.g., a user device 210) and may analyze and / or manage the host threat feed.

[0067] LAN device 250 includes one or more devices capable of receiving, generating, storing, processing, and / or providing information as described herein. For example, LAN device 250 may include a network device (e.g., as described herein), a user device (e.g., as described herein), a server device, etc. In some implementations, LAN device 250 may receive information from and / or provide information to one or more other devices of environment 200. In some implementations, LAN device 250 may be a physical device implemented within a housing such as a chassis. In some implementations, LAN device 250 may be a virtual device implemented by one or more computer devices of a cloud computing environment or data center.

[0068] The WLAN device 260 includes one or more devices capable of receiving, generating, storing, processing, and / or providing the information described herein. For example, the WLAN device 260 may include a network device (e.g., as described herein), a user device (e.g., as described herein), a server device, etc. In some implementations, the WLAN device 260 may receive information from and / or provide information to one or more other devices of the environment 200. In some implementations, the WLAN device 260 may be a physical device implemented in a housing such as a chassis. In some implementations, the WLAN device 260 may be a virtual device implemented by one or more computer devices of a cloud computing environment or a data center.

[0069] The control system 270 includes one or more devices capable of receiving, generating, storing, processing and / or providing the information described herein. For example, the control system 270 may include a server (e.g., in a data center or cloud computing environment), a data center (e.g., a multi-server micro data center), a workstation computer, a VM provided in a cloud computing environment, or a similar type of device. In some implementations, the control system 270 may receive information from and / or provide information to one or more other devices of the environment 200. In some implementations, the control system 270 may be a physical device implemented in a housing such as a chassis. In some implementations, the control system 270 may be a virtual device implemented by one or more computer devices of a cloud computing environment or a data center. In some implementations, the control system 270 may include an element management system (EMS) that manages network elements (e.g., LAN devices 250, WLAN devices 260, network devices 280, etc.) and performs fault management, configuration, billing, performance, and security, etc.

[0070] The network device 280 includes one or more devices (e.g., one or more traffic transmission devices) capable of receiving, providing, storing, generating, and / or processing the information described herein. For example, the network device 280 may include a firewall, a router, a policy implementer, a gateway, a switch, a hub, a bridge, a reverse proxy, a server (e.g., a proxy server), a security device, an intrusion detection device, a load balancer, or the like. In some implementations, the network device 280 may receive information from and / or provide information to one or more other devices of the environment 200. In some implementations, the network device 280 may be a physical device implemented within a housing such as a chassis. In some implementations, the network device 280 may be a virtual device implemented by one or more computer devices of a cloud computing environment or a data center.

[0071] Figure 2 The number and arrangement of devices and networks shown are provided as examples. In practice, there may be Figure 2 More devices and / or networks, fewer devices and / or networks, different devices and / or networks, or differently arranged devices and / or networks than shown. Figure 2 Two or more of the devices shown may be implemented in a single device, or Figure 2 The single device shown may be implemented as multiple distributed devices. Additionally or alternatively, one set of devices (eg, one or more devices) of environment 200 may perform one or more functions described as being performed by another set of devices of environment 200.

[0072] Figure 3 2 is a diagram of example components of a device 300. The device 300 may correspond to a user device 210, a policy implementer platform 220, a computing resource 224, a management device 240, a LAN device 250, a WLAN device 260, a control system 270, and / or a network device 280. In some implementations, the user device 210, the policy implementer platform 220, the computing resource 224, the management device 240, the LAN device 250, the WLAN device 260, the control system 270, and / or the network device 280 may include one or more devices 300 and / or one or more components of the device 300. Figure 3 As shown in , device 300 may include a bus 310 , a processor 320 , a memory 330 , a storage component 340 , an input component 350 , an output component 360 , and a communication interface 370 .

[0073] The bus 310 includes components that allow communication between components of the device 300. The processor 320 is implemented in hardware, firmware, or a combination of hardware and software. The processor 320 is a central processing unit (CPU), a graphics processing unit (GPU), an accelerated processing unit (APU), a microprocessor, a microcontroller, a digital signal processor (DSP), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or other types of processing components. In some implementations, the processor 320 includes one or more processors that can be programmed to perform functions. The memory 330 includes a random access memory (RAM), a read-only memory (ROM), and / or other types of dynamic or static storage devices (e.g., flash memory, magnetic memory, and / or optical memory) that store information and / or instructions used by the processor 320.

[0074] The storage component 340 stores information and / or software related to the operation and use of the device 300. For example, the storage component 340 may include a hard disk (e.g., a magnetic disk, an optical disk, a magneto-optical disk, and / or a solid-state disk), a compact disk (CD), a digital versatile disk (DVD), a floppy disk, a cassette, a magnetic tape, and / or other types of non-transitory computer-readable media, and corresponding drives.

[0075] Input components 350 include components that allow device 300 to receive information, such as via user input (e.g., a touch screen display, a keyboard, a keypad, a mouse, buttons, switches, and / or a microphone). Additionally or alternatively, input components 350 may include sensors for sensing information (e.g., a global positioning system (GPS) component, an accelerometer, a gyroscope, and / or an actuator). Output components 360 include components that provide output information from device 300 (e.g., a display, a speaker, and / or one or more light emitting diodes (LEDs)).

[0076] The communication interface 370 includes transceiver-like components (e.g., a transceiver and / or a separate receiver and transmitter) that enable the device 300 to communicate with other devices (such as via a wired connection, a wireless connection, or a combination of wired and wireless connections). The communication interface 370 can allow the device 300 to receive information from another device and / or provide information to another device. For example, the communication interface 370 may include an Ethernet interface, an optical interface, a coaxial interface, an infrared interface, a radio frequency (RF) interface, a universal serial bus (USB) interface, a wireless local area network interface, a cellular network interface, etc.

[0077] Device 300 can perform one or more processes described herein. Device 300 can perform these processes based on processor 320 executing software instructions stored by non-transitory computer-readable media such as memory 330 and / or storage component 340. Computer-readable media is defined herein as non-transitory memory devices. Memory devices include memory space within a single physical storage device or memory space distributed across multiple physical storage devices.

[0078] The software instructions may be read into the memory 330 and / or storage component 340 from another computer-readable medium or from another device via the communication interface 370. When executed, the software instructions stored in the memory 330 and / or storage component 340 may cause the processor 320 to perform one or more processes described herein. Additionally or alternatively, hardwired circuitry may be used in place of or in combination with software instructions to perform one or more processes described herein. Thus, the implementations described herein are not limited to any specific combination of hardware circuitry and software.

[0079] Figure 3 The number and arrangement of components shown are provided as examples. In practice, the device 300 may include Figure 3 More components, fewer components, different components, or differently arranged components than shown. Additionally or alternatively, one set of components (eg, one or more components) of device 300 may perform one or more functions described as being performed by another set of components of device 300.

[0080] Figure 4 is a flow chart of an example process 400 for tracking host threats in a network and implementing threat policy actions against the host threats. Figure 4 One or more process blocks of may be performed by a policy implementer platform (e.g., policy implementer platform 220). In some implementations, Figure 4 One or more process blocks of may be performed by another device or group of devices, such as management device 240 and / or control system 270, separate from or including policy implementer platform 220.

[0081] like Figure 4 As shown in , process 400 may include receiving network segmentation information identifying a network segment associated with a network (block 410). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may receive network segmentation information identifying a network segment associated with a network, as described above in conjunction with Figure 1A to Figure 2 described.

[0082] like Figure 4As further shown in FIG. 4 , process 400 may include receiving endpoint host session information identifying a session associated with an endpoint host in communication with a network (block 420). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may receive endpoint host session information identifying a session associated with an endpoint host in communication with a network, as described above in connection with Figure 1A to Figure 2 described.

[0083] like Figure 4 As further shown in FIG. 4 , process 400 may include generating a data structure including information associating network segments with sessions associated with endpoint hosts based on the network segment information and the endpoint host session information (block 430). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, storage component 340, etc.) may generate a data structure including information associating network segments with sessions associated with endpoint hosts based on the network segment information and the endpoint host session information, as described above in conjunction with Figure 1A to Figure 2 described.

[0084] like Figure 4 As further shown in FIG. 4 , process 400 may include updating a data structure based on a change in a session associated with an endpoint host and based on a change in a location of the endpoint host within a network segment (block 440). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, memory 330, etc.) may update a data structure based on a change in a session associated with an endpoint host and based on a change in a location of the endpoint host within a network segment, as described above in conjunction with Figure 1A to Figure 2 described.

[0085] like Figure 4 As further shown in FIG. 4 , process 400 may include identifying, based on the data structure, a particular endpoint host among the endpoint hosts that has changed its location within the network segment (block 450). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, storage component 340, etc.) may identify, based on the data structure, a particular endpoint host among the endpoint hosts that has changed its location within the network segment, as described above in conjunction with Figure 1A to Figure 2 described.

[0086] like Figure 4 As further shown in FIG. 4 , process 400 may include determining a threat policy action to be implemented for a particular endpoint host (block 460). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, memory 330, etc.) may determine a threat policy action to be implemented for a particular endpoint host, as described above in conjunction with Figure 1A to Figure 2 described.

[0087] like Figure 4As further shown in FIG. 4 , process 400 may include causing the threat policy action to be implemented by the network for a specific endpoint host (block 470). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may cause the threat policy action to be implemented by the network for a specific endpoint host, as described above in conjunction with Figure 1A to Figure 2 described.

[0088] Process 400 may include additional implementations, such as any single implementation or any combination of implementations described below and / or described in conjunction with one or more other processes described elsewhere herein.

[0089] In some implementations, the policy implementer platform may receive network topology information associated with the network and may generate another data structure including information identifying capabilities of each network element of the network based on the network topology information. In some implementations, when causing the threat policy action to be implemented, the policy implementer platform may cause the threat policy action to be implemented by one or more network elements in the network based on the another data structure.

[0090] In some implementations, the policy enforcer platform may receive host threat feed information associated with the endpoint host and may add information identifying the host threat feed associated with the endpoint host to the data structure based on the host threat feed information.

[0091] In some implementations, the policy implementer platform may identify a network control system associated with the endpoint host and may add information identifying the network control system associated with the endpoint host to the data structure. In some implementations, when causing the threat policy action to be implemented, the policy implementer platform may cause the threat policy action to be implemented by one or more network control systems based on the data structure.

[0092] In some implementations, the policy implementer platform can receive host threat feed information associated with an endpoint host, can block host threat traffic outside the network at perimeter network elements of the network based on the host threat feed information and threat policy actions, and can block host threat traffic inside the network at a switching layer of the network based on the host threat feed information and threat policy actions.

[0093] In some implementations, the policy implementation platform may receive host threat feed information associated with an endpoint host, and may use a specific identifier to mark the host threat identified by the host threat feed information. In some implementations, when determining a threat policy action, the policy implementation platform may determine the threat policy action based on a specific identifier associated with a specific endpoint host in the specific identifier. In some implementations, the policy implementation platform may monitor host threat services across the network based on the specific identifier.

[0094] although Figure 4 An example block diagram of process 400 is shown, but in some implementations, process 400 may include Figure 4 More blocks, fewer blocks, different blocks, or differently arranged blocks than those depicted in the process 400. Additionally or alternatively, two or more blocks of the process 400 may be executed in parallel.

[0095] Figure 5 is a flow chart of an example process 500 for tracking host threats in a network and implementing threat policy actions against the host threats. Figure 5 One or more process blocks of may be performed by a policy implementer platform (e.g., policy implementer platform 220). In some implementations, Figure 5 One or more process blocks of may be performed by another device or group of devices, such as management device 240 and / or control system 270, separate from or including policy implementer platform 220.

[0096] like Figure 5 As shown in , process 500 may include receiving host threat feed information associated with an endpoint host in communication with a network (block 510). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may receive host threat feed information associated with an endpoint host in communication with a network, as described above in conjunction with Figure 1A to Figure 2 described.

[0097] like Figure 5 As further shown in FIG. 5 , process 500 may include receiving network segmentation information identifying a network segment associated with a network (block 520). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may receive network segmentation information identifying a network segment associated with a network, as described above in conjunction with Figure 1A to Figure 2 described.

[0098] like Figure 5 As further shown in FIG. 5 , process 500 may include receiving endpoint host session information identifying a session associated with an endpoint host (block 530). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may receive endpoint host session information identifying a session associated with an endpoint host, as described above in conjunction with FIG. Figure 1A to Figure 2 described.

[0099] like Figure 5As further shown in FIG. 5 , process 500 may include generating a data structure including information identifying a host threat feed associated with an endpoint host and information associating a network segment with a session associated with the endpoint host based on the host threat feed information, the network segmentation information, and the endpoint host session information (block 540). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, memory 330, etc.) may generate a data structure including information identifying a host threat feed associated with an endpoint host and information associating a network segment with a session associated with the endpoint host based on the host threat feed information, the network segmentation information, and the endpoint host session information, as described above in conjunction with Figure 1A to Figure 2 described.

[0100] like Figure 5 As further shown in FIG. 5 , process 500 may include updating a data structure based on a change in a session associated with an endpoint host and based on a change in a location of the endpoint host within a network segment (block 550). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, storage component 340, etc.) may update a data structure based on a change in a session associated with an endpoint host and based on a change in a location of the endpoint host within a network segment, as described above in connection with Figure 1A to Figure 2 described.

[0101] like Figure 5 As further shown in FIG. 5 , process 500 may include identifying, based on the data structure, a particular endpoint host among the endpoint hosts that has changed its location within the network segment (block 560). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, memory 330, etc.) may identify, based on the data structure, a particular endpoint host among the endpoint hosts that has changed its location within the network segment, as described above in conjunction with Figure 1A to Figure 2 described.

[0102] like Figure 5 As further shown in FIG. 5 , process 500 may include determining a threat policy action to be implemented for a particular endpoint host (block 570). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, storage component 340, etc.) may determine a threat policy action to be implemented for a particular endpoint host, as described above in conjunction with Figure 1A to Figure 2 described.

[0103] like Figure 5 As further shown in FIG. 5 , process 500 may include causing the threat policy action to be implemented by the network for a specific endpoint host (block 580). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may cause the threat policy action to be implemented by the network for a specific endpoint host, as described above in conjunction with Figure 1A to Figure 2 described.

[0104] Process 500 may include additional implementations, such as any single implementation or any combination of implementations described below and / or described in conjunction with one or more other processes described elsewhere herein.

[0105] In some implementations, the host threat feed information may include information associated with malware. In some implementations, the policy implementer platform may receive network topology information associated with the network, and may generate another data structure including information identifying capabilities of each network element of the network based on the network topology information. In some implementations, when causing the threat policy action to be implemented, the policy implementer platform may cause the threat policy action to be implemented by one or more network elements in the network based on the another data structure.

[0106] In some implementations, the policy implementer platform may identify a network control system associated with the endpoint host and may add information identifying the network control system associated with the endpoint host to the data structure. In some implementations, when causing the threat policy action to be implemented, the policy implementer platform may cause the threat policy action to be implemented by one or more network control systems based on the data structure.

[0107] In some implementations, the policy implementer platform can enable blocking of host threat traffic outside the network at perimeter network elements of the network based on host threat feed information and threat policy actions, and can enable blocking of host threat traffic inside the network at a switching layer of the network based on host threat feed information and threat policy actions.

[0108] In some implementations, the policy implementer platform may tag host threats identified by the host threat feed information with specific identifiers, each specific identifier based on a media access control (MAC) address, session information, and / or a hardware identifier associated with one of the endpoint hosts. In some implementations, when determining a threat policy action, the policy implementer platform may determine the threat policy action based on a specific identifier associated with a specific endpoint host in the specific identifiers. In some implementations, the policy implementer platform may monitor host threat traffic across the network based on the specific identifiers, and may provide information associated with the host threat traffic to a management device.

[0109] although Figure 5 An example block diagram of process 500 is shown, but in some implementations, process 500 may include Figure 5 More blocks, fewer blocks, different blocks, or differently arranged blocks than those depicted in process 500. Additionally or alternatively, two or more blocks of process 500 may be executed in parallel.

[0110] Figure 6is a flow chart of an example process 600 for tracking host threats in a network and implementing threat policy actions against the host threats. Figure 6 One or more process blocks of may be performed by a policy implementer platform (e.g., policy implementer platform 220). In some implementations, Figure 6 One or more process blocks of may be performed by another device or group of devices, such as management device 240 and / or control system 270, separate from or including policy implementer platform 220.

[0111] like Figure 6 As shown in FIG. 6 , process 600 may include receiving network topology information identifying capabilities of network elements of a network (block 610). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may receive network topology information identifying capabilities of network elements of a network, as described above in conjunction with Figure 1A to Figure 2 described.

[0112] like Figure 6 As further shown in FIG. 6 , process 600 may include receiving network segmentation information identifying a network segment associated with a network (block 620). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may receive network segmentation information identifying a network segment associated with a network, as described above in conjunction with Figure 1A to Figure 2 described.

[0113] like Figure 6 As further shown in FIG. 6 , process 600 may include receiving endpoint host session information identifying a session associated with an endpoint host in communication with a network (block 630). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may receive endpoint host session information identifying a session associated with an endpoint host in communication with a network, as described above in conjunction with Figure 1A to Figure 2 described.

[0114] like Figure 6 As further shown in FIG. 6 , process 600 may include generating a data structure including information associating network segments with sessions associated with endpoint hosts based on the network topology information, the network segmentation information, and the endpoint host session information (block 640). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, memory 330, etc.) may generate a data structure including information associating network segments with sessions associated with endpoint hosts based on the network topology information, the network segmentation information, and the endpoint host session information, as described above in conjunction with Figure 1A to Figure 2 described.

[0115] like Figure 6As further shown in FIG. 6 , process 600 may include updating a data structure based on a change in a session associated with an endpoint host and based on a change in a location of the endpoint host within a network segment (block 650). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, storage component 340, etc.) may update a data structure based on a change in a session associated with an endpoint host and based on a change in a location of the endpoint host within a network segment, as described above in conjunction with Figure 1A to Figure 2 described.

[0116] like Figure 6 As further shown in FIG. 6 , process 600 may include identifying, based on the data structure, a particular endpoint host among the endpoint hosts that has changed its location within the network segment (block 660). For example, the policy implementer platform (e.g., using computing resources 224, processor 320, memory 330, etc.) may identify, based on the data structure, a particular endpoint host among the endpoint hosts that has changed its location within the network segment, as described above in conjunction with Figure 1A to Figure 2 described.

[0117] like Figure 6 As further shown in FIG. 6 , process 600 may include determining a threat policy action to be implemented for a particular endpoint host (block 670). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, storage component 340, etc.) may determine a threat policy action to be implemented for a particular endpoint host, as described above in conjunction with Figure 1A to Figure 2 described.

[0118] like Figure 6 As further shown in FIG. 6 , process 600 may include causing a threat policy action to be implemented by one or more network elements of the network for a specific endpoint host (block 680). For example, a policy implementer platform (e.g., using computing resources 224, processor 320, communication interface 370, etc.) may cause a threat policy action to be implemented by one or more network elements in the network for a specific endpoint host, as described above in conjunction with Figure 1A to Figure 2 described.

[0119] Process 600 may include additional implementations, such as any single implementation or any combination of implementations described below and / or described in conjunction with one or more other processes described elsewhere herein.

[0120] In some implementations, the policy enforcer platform may receive host threat feed information associated with the endpoint host and may add information identifying the host threat feed associated with the endpoint host to the data structure based on the host threat feed information.

[0121] In some implementations, the policy implementer platform can receive host threat feed information associated with an endpoint host, can block host threat services outside the network at perimeter network elements of the network based on the host threat feed information and threat policy actions, and can block host threat services inside the network at a switching layer of the network based on the host threat feed information and threat policy actions.

[0122] In some implementations, the policy implementer platform may receive host threat feed information associated with an endpoint host, and may tag host threats identified by the host threat feed information with specific identifiers. In some implementations, when determining a threat policy action, the policy implementer platform may determine the threat policy action based on a specific identifier associated with a specific endpoint host in the specific identifiers.

[0123] In some implementations, the policy implementer platform can monitor host threat services across the network based on specific identifications, and can provide information associated with the host threat services to the management device to prevent the management device from repeatedly analyzing the host threat services. In some implementations, one or more network elements can be associated with different vendors.

[0124] although Figure 6 Example blocks of process 600 are shown, but in some implementations, process 600 may include Figure 6 More blocks, fewer blocks, different blocks, or differently arranged blocks than those depicted in process 600. Additionally or alternatively, two or more blocks of process 600 may be executed in parallel.

[0125] Some implementations described herein provide an implementation platform for a policy tracking host threats in a network and implementing threat policy actions for host threats. For example, a policy implementer platform may receive network segmentation information identifying a network segment associated with a network, and may receive endpoint host session information identifying a session associated with an endpoint host communicating with the network. The policy implementer platform may generate a data structure including information associating a network segment with a session associated with an endpoint host based on the network segmentation information and the endpoint host session information. The policy implementer platform may update the data structure based on changes in sessions associated with the endpoint host and based on changes in the location of the endpoint host within the network segment, and may identify a specific endpoint host in the endpoint host that has changed its location within the network segment based on the data structure. The policy implementer platform may determine a threat policy action to be implemented for a specific endpoint host, and may cause the threat policy action to be implemented by the network for a specific endpoint host.

[0126] The foregoing disclosure provides illustration and description, but is not intended to be exhaustive or to limit the implementations to the precise forms disclosed. Modifications and variations are possible in light of the above disclosure or may be acquired from practice of implementations.

[0127] As used herein, the term "component" is intended to be broadly interpreted as hardware, firmware, or a combination of hardware and software.

[0128] It is clear that the systems and / or methods described herein can be implemented in various forms of hardware, firmware, or a combination of hardware and software. The actual dedicated control hardware or software code used to implement these systems and / or methods does not limit the implementation. Therefore, the operation and behavior of the systems and / or methods are described herein without reference to specific software code - it should be understood that software and hardware can be designed to implement the systems and / or methods based on the description herein.

[0129] Even though particular combinations of features are stated in the claims and / or disclosed in the specification, these combinations are not intended to limit the disclosure of possible implementations. In fact, many of these features may be combined in ways not specifically stated in the claims and / or disclosed in the specification. Although each of the dependent claims listed below may directly depend on only one claim, the disclosure of possible implementations includes the combination of each dependent claim with every other claim in the claim set.

[0130] Unless clearly described as such, the elements, actions or instructions used in this article should not be interpreted as being critical or necessary. In addition, as used in this article, the articles "a" and "an" are intended to include one or more projects, and can be used interchangeably with "one or more". In addition, as used in this article, the term "set" is intended to include one or more projects (for example, related projects, unrelated projects, combinations of related projects and unrelated projects, etc.), and can be used interchangeably with "one or more". In the case of only one project, the term "one" or similar language is used. In addition, as used in this article, the terms "has", "have", "having" and the like are intended to be open terms. In addition, unless otherwise expressly stated, the phrase "based on" is intended to represent "based at least in part on".

Claims

1. A method for performing an action on an endpoint host, comprising: generating, by a device, a data structure of endpoint hosts, the endpoint hosts being each connected to a network and to at least one of a plurality of network segments of the network; updating, by the device, the data structure based on a change in a session associated with at least one of the endpoint hosts; identifying, by the device based on the data structure, a particular one of the endpoint hosts that changes location within the at least one network segment; Determining, by the device, an action to be performed on the specific endpoint host; identifying, by the device, a network control system that controls the at least one network segment associated with the particular endpoint host; as well as The device causes the network control system to perform the action for the specific endpoint host. The method according to claim 1 , wherein the data structure is generated based on network topology information.

3. The method according to claim 2, further comprising: processing the network topology information to determine capabilities associated with the endpoint host; as well as Information identifying the capabilities associated with the endpoint host is stored in the data structure.

4. The method of claim 3, wherein the network topology information is processed using one or more artificial intelligence models.

5. The method of claim 1 , wherein identifying the network control system comprises: The network control system is identified based on matching the specific endpoint host with a specific network element.

6. The method of claim 1, wherein the action comprises at least one of the following: For external host threat services, blocking endpoint host services at the perimeter network devices of the network, or For internal host threat traffic, endpoint host traffic is blocked at the switching layer of the network.

7. The method according to claim 1, further comprising: receiving host threat feed information associated with the endpoint host; as well as marking the host threat identified by the host threat feed information with a specific identifier, and The action to be performed includes: The action to be performed is determined based on a specific one of the specific identifications that is associated with the specific endpoint host.

8. A device for performing an action on an endpoint host, comprising: one or more memories; as well as one or more processors communicatively coupled to the one or more memories, the one or more processors configured to: A data structure is generated based on the host threat feed information, the network segmentation information, and the endpoint host session information associated with the network, the data structure comprising: identifying information of a host threat feed associated with an endpoint host in communication with the network, and information associating a plurality of network segments identified in the network segment information with sessions associated with the endpoint host; updating the data structure based on a change in a session associated with at least one of the endpoint hosts; identifying, based on the data structure, a particular one of the endpoint hosts that changes location within at least one of the plurality of network segments; determining a threat policy action to be implemented against the particular endpoint host; and Causing enforcement of the threat policy action by the network against the specific endpoint host.

9. The apparatus of claim 8, wherein the one or more processors are further configured to: Trigger automatic enforcement of new threat policy changes based on changes in the location associated with an endpoint host.

10. The apparatus of claim 8, wherein the one or more processors are further configured to: Provides information identifying threats to endpoint hosts to a management device for use in updating threat feeds with current unique host identifiers.

11. The apparatus of claim 8, wherein the one or more processors are further configured to: generating another data structure of network elements based on network topology information associated with the network; determining capabilities associated with the network elements based on the network topology information; and Information identifying the capabilities associated with the network element is stored in the other data structure.

12. The apparatus of claim 8, wherein the one or more processors are further configured to: identifying a network control system associated with the particular endpoint host; and adding to the data structure information identifying the network control system associated with the particular endpoint host, and wherein the one or more processors, when causing the threat policy action to be implemented, are configured to: Implementing the threat policy action by the network control system is caused based on the data structure.

13. The apparatus of claim 8, wherein the one or more processors are further configured to: Tag host threats identified by the host threat feed with specific identifiers, Each of the specific identifications is based on one of the following: Media Access Control MAC address, Session information, or a hardware identifier associated with one of the endpoint hosts, and wherein the one or more processors, when determining the threat policy action, are configured to: The threat policy action is determined based on a specific identification of the specific identifications that is associated with the specific endpoint host.

14. The apparatus of claim 13, wherein the one or more processors are further configured to: Monitoring host threat services across the network based on the specific identification; and The information associated with the host threat service is provided to a management device.

15. A non-transitory computer readable medium for performing an action on an endpoint host, storing a set of instructions, the set of instructions comprising: One or more instructions that, when executed by one or more processors of a device, cause the device to: generating a data structure of connected endpoint hosts, the endpoint hosts each being connected to a network and to at least one network segment of a plurality of network segments of the network; updating the data structure based on a change in a session associated with at least one of the endpoint hosts; identifying, based on the data structure, a particular one of the endpoint hosts that changes location within the at least one network segment; determining an action to be performed on the specific endpoint host; identifying a network control system associated with the particular endpoint host, wherein the network control system controls the network segment associated with the particular endpoint host; as well as The network control system is caused to perform the action on the specific endpoint host.

16. The non-transitory computer readable medium of claim 15, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: Tag host threats identified by the host threat feed with specific identifiers, Each of the specific identifications is based on one of the following: Media Access Control MAC address, Session information, or a hardware identifier associated with one of the endpoint hosts, and wherein the one or more instructions that cause the one or more processors to determine the action to be performed further cause the one or more processors to: The action to be performed is determined based on a specific identification among the specific identifications that is associated with the specific endpoint host.

17. The non-transitory computer readable medium of claim 16, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: Monitoring host threat services across the network based on the specific identification; and The information associated with the host threat service is provided to a management device.

18. The non-transitory computer readable medium of claim 15, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: receiving network topology information associated with the network; and generating another data structure based on the network topology information, the another data structure comprising information identifying capabilities of each network element of the network, and wherein the one or more instructions that cause the one or more processors to cause the actions to be performed further cause the one or more processors to: The action is caused to be performed by one or more network elements of the network based on the further data structure.

19. The non-transitory computer readable medium of claim 18, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: Information identifying capabilities associated with the endpoint host is stored in the other data structure.

20. The non-transitory computer readable medium of claim 19, wherein the network topology information is processed using one or more artificial intelligence models.

Images