Dynamic Intrusion Detection and Defense in Computer Networks

Abstract

Dynamic intrusion detection and prevention in a computer network is provided. The present disclosure describes dynamic intrusion detection and prevention in a computer network. The method includes generating clusters of network sites based on multiple parameters related to operational characteristics and network threats associated with the network sites. A data model is trained on the clusters developed by clustering. The data model is executed to predict a threat frequency for each network threat for each cluster. A difference between the predicted threat frequency of each network threat and a corresponding baseline frequency is determined. Based on the difference between the predicted threat frequency of each network threat and the corresponding baseline frequency, a dynamic rule set is configured for each cluster by integrating rules suitable for preventing each network threat.

Description

Background Art

[0001] Computer networks are susceptible to various types of cyber threats. Monitoring of threat patterns is crucial in computer networks. Intrusion Detection and Prevention Systems (IDPS) are usually implemented to detect the occurrence of different types of cyber threats and prevent them from affecting the performance and security of computer networks. Since all computer networks are different, they are susceptible to different types of cyber threats and therefore different rules need to be implemented to prevent cyber threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0002] The accompanying drawings constitute a part of the specification and are used to provide a further understanding of the present disclosure. Such drawings show exemplary implementations of the present disclosure for describing the principles associated with the present disclosure. In the illustrations of the accompanying drawings, the implementations are described by way of example and not by way of limitation, wherein like reference numerals represent similar elements. It should be noted that references to "one" or "an" implementation in the present disclosure do not necessarily refer to the same implementation, and they refer to at least one. In the drawings:

[0003] Figure 1 An implementation according to the present disclosure is shown, including an environment for a system that performs intrusion detection and prevention;

[0004] Figure 2 A block diagram showing different components of a system for performing intrusion detection and prevention is shown according to an implementation of the present disclosure;

[0005] Figure 3 shows a cluster diagram including a cluster of network sites located in a country according to an implementation of the present disclosure;

[0006] Figure 4 A network attack history graph showing a baseline frequency of DoS attacks occurring on a network site during a predetermined time period is shown according to an implementation of the present disclosure;

[0007] Figure 5A , Figure 5B and Figure 5C shows rule sets of different severity implemented in different situations according to implementations of the present disclosure; and

[0008] Figure 6 A flowchart of a method for performing intrusion detection and prevention according to an implementation of the present disclosure is shown. DETAILED DESCRIPTION

[0009] Typically, rule sets (collections of rules) are used for intrusion detection and prevention (IDP) based on the severity, category, and duration of threats occurring in a computer network. These rule sets can be packaged in different sets, such as strict sets, moderate sets, and lenient sets. A strict rule set can include a large number of rules, such as 20,000 rules. A moderate rule set can include fewer rules, such as 15,000 rules, compared to a strict rule set, while a lenient rule set can include a minimum number of rules, such as 12,000 rules, compared to both the strict rule set and the moderate rule set. The network gateway downloads the rule set and applies one of the rule sets based on the predefined network policy to inspect and block malicious traffic.

[0010] The number of rules in a rule set affects the performance of the IDP engine and the number of false positives detected by the IDP engine. Detecting false positives affects usability because user intervention is required to review, classify, and unlock false positives. Selecting a loose rule set can reduce the number of false positives. However, this results in a reduced detection range of network threats, such as a reduction in the different types of network threats that can be detected. On the other hand, selecting a strict rule set increases the scope of threat detection, but may result in an increase in the number of false positives. Therefore, hard-dividing the rule set into a certain set number (e.g., three) of categories without adapting to the customer's network threat patterns does not optimally balance the trade-off between a high detection range of network threats and a lower number of false positives detected in a computer network. Therefore, there is a need for an IDP system that dynamically handles each category and frequency of threats unique to each or a group of similar network sites.

[0011] In order to achieve a balance between the detection scope of network threats and the number of false positives, the present disclosure provides a process of integrating a dynamic rule set to be applied to prevent each network threat in each cluster.

[0012] The present disclosure describes clustering a plurality of network sites using data clustering techniques. The network sites may correspond to different office locations of an organization, for example, Austin, Chicago, Houston, and San Jose may be different office locations of an organization. The plurality of network sites are clustered using data clustering techniques. The clustering performed by the data clustering technique represents grouping a plurality of network sites in a manner that network sites in the same group are more similar to each other than network sites in other groups. The plurality of network sites are clustered based on a plurality of parameters related to operational characteristics and details of network threats associated with the plurality of network sites. A network threat represents an attempt by an intruder to access the network of an organization without authorization to steal data or perform other malicious activities. A network threat may be associated with different network attacks, such as a denial of service (DoS) attack, a distributed DoS (DDoS) attack, a man-in-the-middle (MITM) attack, a phishing attack, ransomware, a virus, and a worm. An active network attack involves modifying, encrypting, or damaging data associated with different user devices running within a network site. Therefore, details related to different network attacks occurring or attempted on each of the plurality of network sites may be used as details of network threats for clustering the plurality of network sites.

[0013] The data model can be trained on multiple clusters developed by clustering. After training, the data model can be executed to predict the threat frequency of each network threat for each of the multiple clusters. For example, when there are three network site clusters, the threat frequency (probability of future occurrence) of DoS attacks and phishing attacks can be determined for each of the three clusters. Thus, the difference between the predicted threat frequency of each network threat and the corresponding baseline frequency can be determined. Subsequently, a dynamic rule set can be configured for each cluster by integrating rules suitable for preventing each network threat. The count and type of rules integrated to configure the dynamic rule set can depend on the difference between the predicted threat frequency of each network threat and the corresponding baseline frequency associated with each cluster.

[0014] The detailed description set forth below in conjunction with the accompanying drawings is intended to describe various implementations of the present disclosure and is not intended to represent the only implementation to which the details of the present disclosure can be applied. Each implementation described in the present disclosure is provided only as an example or illustration and is not necessarily to be construed as being better or superior to other implementations.

[0015] Figure 1An environment including a system 102 for performing intrusion detection and prevention according to an embodiment of the present disclosure is shown. In one implementation, the system 102 may be implemented on a cloud network and may include a memory 104, a processor 106, and a communication module 108. The system 102 may be configured to perform intrusion detection and prevention on a plurality of network sites 110-2 to 110-n (collectively referred to as network sites 110). In different implementations, the network sites 110 may correspond to different offices of one or more organizations, different project groups of an organization, and the like. The network sites 110 may include a plurality of devices, such as desktops, laptops, tablets, printers, scanners, network sensors, network routers, network switches, and the like. The network sites 110 may be connected to a public network 112, such as the Internet. In some implementations, the devices present in the network sites 110 may communicate with each other through a secure network tunnel. The system 102 may be connected to the network sites 110 through the public network 112.

[0016] The virtual gateway 114 may be configured on the system 102 or on an external device connected to the system 102 and the public network 112. Data generated as a result of the operation of the devices present within the network site 110 may be provided to the system 102 via the virtual gateway 114. Such data may be referred to as telemetry data and may include data accessed by the device, data generated by activities performed using the device, and data communicated between devices. The telemetry data may include raw telemetry information related to the device, such as the operating system (OS), bandwidth usage, and details of the site to which the device belongs. Alternatively or additionally, the telemetry data may include aggregated information such as usage patterns and performance impacts. Upon receipt, the system 102 may store the data in the memory 104. The system 102 may process such data to detect and prevent the occurrence of intrusions on the network site 110. In addition, the non-transitory computer-readable storage medium 116 may be used to store program instructions responsible for performing intrusion detection and defense.

[0017] Figure 2A block diagram of different components of a system 102 for performing intrusion detection and defense is shown according to an implementation of the present disclosure. System 102 includes a memory 104, a processor 106, and an interface 200 (similar to communication module 108). System 102 can send and receive data through interface 200. Memory 104 can store program instructions to perform several functions for performing intrusion detection and defense. Exemplary program instructions stored in memory 104 may include program instructions 202 for clustering network sites, program instructions 204 for training data models, program instructions 206 for executing data models, program instructions 208 for determining the difference between predicted threat frequencies and baseline frequencies, and program instructions 210 for configuring dynamic rule sets.

[0018] Program instructions 202 for clustering network sites can cause the processor 106 to cluster network sites 110. Data clustering techniques can be used to cluster network sites 110 based on several parameters. These parameters can be related to operational characteristics and network threats associated with network sites 110. Program instructions 204 for training data models can cause the processor 106 to train one or more data models on clusters developed by clustering. Program instructions 206 for executing data models can cause the processor 106 to predict the threat frequency for each network threat category for each cluster. Program instructions 208 for determining the difference between the predicted threat frequency and the baseline frequency can cause the processor 106 to determine the difference between the predicted threat frequency and the corresponding baseline frequency of each network threat. Program instructions 210 for configuring dynamic rule sets can cause the processor 106 to configure dynamic rule sets for each cluster by integrating rules applicable to preventing each network threat. The count of the rules integrated to configure the dynamic rule set depends on the difference between the predicted threat frequency of each network threat and the corresponding baseline frequency associated with each cluster. Detailed functions of such programming instructions are provided hereafter.

[0019] In one implementation, the system 102 may use data clustering techniques to process several parameters to cluster the websites 110. The purpose of clustering is to group together different offices of the organization based on similarities in the types of cyber threats they have faced over a predefined period of time in the past. Additionally, in different implementations, smaller office divisions (such as teams within an office or project groups within an office) may also be clustered based on similarities in the types of cyber threats.

[0020] Parameters used during clustering may include a location score of a network segment, software stack embedding, a score based on bandwidth consumption of critical and non-critical applications running across the network segment, a score based on network traffic patterns, a score based on the number of different types of network devices connected in the network segment, a score based on user dispersion, a score based on the reputation of the network segment, a score based on network threats to the network segment, or a score based on network classification and network labeling. System 102 may utilize one or more of these parameters to perform clustering of network sites 110.

[0021] In one implementation, a location score for a network segment (or branch) may be determined by obtaining a broad understanding of the locations of the branches. The location score for a branch may be determined based on geographic location characteristics, such as city type, country, and security index. Additionally or alternatively, the location score for a branch may be determined based on business activities performed at the branch location. Depending on the criticality of the business tasks performed at the branch location, the location may be identified as a high priority location or a low priority location. High priority locations, such as sales team offices and CEO offices, may be identified by an administrator or may be determined based on a visulaRF floor plan map of the organization.

[0022] In one implementation, another parameter may be determined, such as software stack embedding, which includes details of software, configuration, load averages, and size. This parameter may be determined based on the type of operating system (OS) version, key software versions, active / new user accounts, loaded kernel modules, running processes, domain name system (DNS) lookups, network connections, system scheduler changes, daemons, background processes, and persistent processes, startup operations, startup entries, OS registry databases, .plist files, browser extensions, and application and system errors.

[0023] In one implementation, another parameter may be determined based on the percentage of critical applications and the percentage of bandwidth used by non-critical applications, for example, based on a score of bandwidth consumption of critical and non-critical applications running across branches.

[0024] In one implementation, another parameter, such as a score based on network traffic patterns, can be determined using a mathematical formula based on factors including duration, protocol type, service, flags, source bytes, destination bytes, error fragments, packet count, receiver error rate, network traffic peak, connection type, destination type, and application traffic type.

[0025] In one implementation, a score based on branch reputation can be associated with traffic outflow and inflow from various users of a branch. If a branch's traffic frequently flows in or out to social media sites, the branch is more vulnerable to social engineering media attacks. In one case, the score based on branch reputation can be determined using the formula provided below.

[0026] Branch reputation score = (a*w_app+m*w_URL+f*w_file+i*w_ids d*w_dlp)

[0027] In the above formula, "a" represents the total number of unauthorized applications accessed within the branch, "m" represents the total number of malware / vulnerable Uniform Resource Locator (URL) requests seen in the branch, "f" represents the total number of prohibited file attachments and / or Multipurpose Internet Mail Extensions (MIME) types used in emails seen in devices connected in the branch, "i" represents the total number of anomalous intrusions detected on devices connected in the branch, and "d" represents the total number of sensitive data leakage detected for devices connected in the branch. In addition, "w" represents the weight assigned to each category, so that w_app represents the weight of network attacks related to unauthorized application access, w_URL represents the weight of network attacks related to malware / vulnerable URLs, w_file represents the weight of network attacks related to prohibited or blocked file attachments and / or MIME types used in emails, w_ids represents the weight of detected anomalous intrusions, and w_dlp represents the weight of network attacks related to sensitive data leakage.

[0028] In one implementation, another parameter, such as a branch threat-based score (also referred to as a security score), can be determined based on events associated with individual devices (e.g., severity, confidence score, and stage) and cross-event correlation information (e.g., stage changes of events for associated devices or networks in a remote office). Event generation can be performed by marking data streams, which can be based on rule-based conditions, such as domain generation algorithms (DGAs), hypertext transfer protocol (HTTP) header sequence detection, and bitstreams. In addition, marking of data streams can be based on conditions based on third-party data correlation, such as indicators of compromise (IOCs), network security risks, or other data.

[0029] From the event, one or more temporary features may be extracted for determining a score based on the branch threat. In one implementation, the entity threat score may be determined using the formula mentioned below.

[0030] Entity threat score = (0.5*maximum event score) + (0.25*attack stage feature) + (0.15*total score feature) + (0.10*detection type feature)

[0031] In the above formula, the function "max(event score)" can be used to determine the maximum event score, and the maximum event score is used as the main feature fed into the entity threat score modeling. A high threat score is assigned to a particular entity because it hits one or several high-severity, high-confidence events, not because the entity hits too many low-severity, low-confidence events (which may be false positives for different classifiers). The attack stage feature can be determined as the number of attack stages hit by the office / the total number of attack stages. The detection type feature can be determined as the number of detection types hit by the office / the total number of detection types. The total score can be determined as the sum(event score) / max(sum(event score)) of all devices in the office.

[0032] In one implementation, another parameter, such as a score based on network classification and network tagging, can be determined based on network connectivity, such as a network cloud or on-premise network based on local area networks (LANs), wide area networks (WANs), and metropolitan area networks (MANs). In one scenario, network tagging depends on network deployments, such as education, healthcare, retail, enterprise, and service provider. In education deployments, the connections have a primarily floating user and device population with device-based authentication. In healthcare deployments, the connections have sensitive data and networks. In retail deployments, the connections have more digital transformation and Internet of Things (IoT) devices. In enterprise deployments, the connections have Internet Protocol Security (IPSec) tunnels and firewall traffic-aware applications with access control lists (ACLs) and role-based access control (RBAC). In service provider deployments, the connections have multiple tenants and cloud security policies.

[0033] To perform clustering, the system 102 can utilize one or more data clustering techniques, including k-means clustering, mean shift clustering, agglomerative hierarchical clustering, expectation maximization (EM) clustering using a Gaussian mixture model (GMM), density-based spatial clustering of applications with noise (DBSCAN), and sorting points to identify cluster structures (OTIC).

[0034] Figure 3 3 shows a cluster diagram 300 including clusters of websites located in a country according to an implementation of the present disclosure. In one implementation, websites of organizations located in the United States of America are clustered using DBSCAN as a data clustering technique. Such a cluster may be Figure 3The parameters used during clustering and their values ​​are mentioned in Table 1 provided below. The feature values ​​are normalized to a standard scaler before being provided to DBSCAN for clustering.

[0035]

[0036] Table 1

[0037] After generating the website clusters, the system 102 can train one or more data models on the website clusters. In different implementations, the data models can be trained based on data collected from individual websites, a cumulative data set obtained by aggregating data obtained from all websites, or data collected from a cluster of websites.

[0038] One or more data models may be trained using suitable machine learning techniques. For example, deep learning techniques such as convolutional neural networks (CNNs), long short-term memory networks (LSTMs), recurrent neural networks (RNNs), generative adversarial networks (GANS), radial basis function networks (RBFNs), multi-layer perceptrons (MLPs), self-organizing maps (SOMs), deep belief networks (DBNs), restricted Boltzmann machines (RBMs), and / or autoencoders may be used.

[0039] After training, system 102 can execute the data model to predict the threat frequency of each network threat for each network site cluster. It can be noted that the threat frequency of network attacks identified as having occurred on the network site in the past is predicted, and network threats that have not been observed to have occurred on the network site can be ignored. For example, if the types of network attacks identified as having occurred on the network site include denial of service (DoS) attacks, botnet attacks, Trojan horse attacks, and worm attacks, only the threat frequencies of these network attacks are predicted. If a network site or a network site cluster only observes the occurrence of DoS attacks, only the threat frequency of DoS attacks is predicted. In addition, the threat frequency of network threats within a predetermined number of days can be predicted. For example, if the trained data model is executed on January 1, 2021 to predict the threat frequency associated with DoS attacks in the next three days, the results obtained can be shown in Table 2 below.

[0040] data Number of DoS attacks January 2, 2021 17 January 3, 2021 18 January 4, 2021 18

[0041] Table 2

[0042] In one implementation, the system 102 may retrain a data model using data obtained by executing the data model, such as the predicted threat frequency of each network threat. Through such retraining, the prediction accuracy of the data model may be improved.

[0043] During the continuous execution of the data model, the system 102 can determine the difference between the predicted threat frequency of each network threat and the corresponding baseline frequency. The baseline frequency can include a count of different network attacks that occurred on the network site within a predetermined time period. Figure 4 A network attack history chart 400 showing a baseline frequency of DoS attacks occurring on a network site during a predetermined time period (e.g., 15 days) is shown according to an implementation of the present disclosure. The system 102 can determine the baseline frequency as an average of the frequency of the complete data set, an average of the frequency of the data set over the past n days, or by applying a one-class support vector machine (SVM) technique to the data set over n days.

[0044] Based on the difference between the predicted threat frequency of each network threat and the corresponding baseline frequency, the system 102 can configure a dynamic rule set for each cluster by integrating rules applicable to preventing each network threat. The count of rules integrated to configure the dynamic rule set can depend on the difference between the predicted threat frequency of each network threat and the corresponding baseline frequency associated with each cluster. The difference can be compared with a preconfigured threshold. The preconfigured threshold can be set based on the sensitivity of the deployment.

[0045] In one implementation, a 15% deviation from a baseline frequency may be considered a preconfigured threshold. When the predicted threat frequency of a particular network threat is identified as having increased by 15% from its corresponding baseline frequency, more rules may be integrated in a rule set suitable for detecting and preventing such network threats. As rules are integrated or included, the severity of the rule set may increase, for example, a loose rule set may become a moderate rule set, and a moderate rule set may become a strict rule set. Alternatively, when the predicted threat frequency of a particular network threat is identified as having decreased by 15% from its corresponding baseline frequency, existing rules for detecting and preventing such network threats present in the rule set may be removed. As rules are removed, the severity of the rule set may decrease, for example, a strict rule set may become a moderate rule set, and a moderate rule set may become a loose rule set. One or more rule sets determined to be suitable for one or more network sites 110 may be implemented at a central network element such as a virtual gateway 114. Based on the implemented rule sets, virtual gateway 114 , together with system 102 , can perform intrusion detection and intrusion prevention by analyzing data received from network sites 110 .

[0046] Figure 5A , 5B 5C show rule sets 500, 502 and 504 of different severity implemented in different situations according to the implementation of the present disclosure. It can be noted that Figure 5A , Figure 5B and Figure 5CThe y-axis in has a 100-fold scale, i.e., each reading is actually 100 times. Figure 5A It can be observed that when the predicted threat frequency is determined to be low for Trojan attack, botnet attack, and worm attack, and high for DoS attack, a loose rule set (including 10k rules) is applied for Trojan attack, botnet attack, and worm attack, while a moderate rule set (including 15k rules) is applied for DoS attack.

[0047] from Figure 5B It can be observed that when the predicted threat frequency is determined to be low for botnet attacks, high for Trojan attacks and worm attacks, and very high for DoS attacks, a loose rule set (including 10k rules) is applied for botnet attacks, a moderate rule set (including 15k rules) is applied for Trojan attacks and worm attacks, and a strict rule set (including 20k rules) is applied for DoS attacks.

[0048] from Figure 5C It can be observed that in response to determining that the predicted threat frequency is high for DoS attacks and very high for Trojan attacks, botnet attacks, and worm attacks, a moderate rule set (comprising 15k rules) is applied for DoS attacks, and a strict rule set (comprising 20k rules) is applied for Trojan attacks, botnet attacks, and worm attacks.

[0049] In the above manner, the severity of the rule set is modified for each network site cluster based on the type of imminent network threat. This ensures that the number of rules in the rule set remains appropriate to best meet the requirements, such as accurately detecting and defending against network threats. Therefore, using the above method, a balance is achieved between the scope of detecting network threats and reducing false positives.

[0050] Figure 6 A flow chart of a method for performing intrusion detection and defense according to an implementation of the present disclosure is shown. In step 602, a plurality of network sites may be clustered based on a plurality of parameters. The plurality of parameters may be related to operational characteristics and network threats associated with the plurality of network sites. In some implementations, the plurality of parameters may include a location score for a network segment, software stack embedding, a score based on bandwidth consumption of critical applications and non-critical applications running across the network segment, a score based on network traffic patterns, a score based on the number of different types of network devices connected in the network segment, a score based on user dispersion, a score based on the reputation of the network segment, a score based on network threats to the network segment, and a score based on network classification and network labeling.

[0051] At step 604, one or more data models may be trained on the plurality of clusters developed by clustering. The one or more data models may be trained using appropriate machine learning techniques, such as deep learning techniques, such as long short-term memory (LSTM).

[0052] At step 606, one or more data models may be executed to predict a threat frequency for each cyber threat for each of the plurality of clusters. The threat frequency will indicate the likelihood of a particular type of cyber threat occurring on the cluster.

[0053] The difference between the predicted threat frequency and the corresponding baseline frequency for each network threat may be determined at step 608. Such a difference will indicate whether the chance of the network threat occurring is higher or lower than the count of network threat occurrences observed in the past.

[0054] At 610, a dynamic rule set can be configured by integrating rules suitable for preventing each network threat. The count of rules integrated to configure the dynamic rule set depends on the difference between the predicted threat frequency of each network threat and the corresponding baseline frequency associated with each cluster. By configuring the dynamic rule set, a sufficient number of rules can be applied to detect and prevent a specific category of network threats.

[0055] Implementations of the present disclosure may be an article of manufacture in which a machine-readable medium (such as a microelectronic memory) has stored thereon instructions that program one or more data processing components (collectively referred to herein as "processors") to perform the operations described above. In other implementations, some of these operations may be performed by specific hardware components (e.g., dedicated digital filter blocks and state machines) containing hardwired logic. Alternatively, these operations may be performed by any combination of programmed data processing components and fixed hardwired circuit components.

[0056] A non-transient computer-readable storage medium includes program instructions for implementing various operations implemented by a computing device such as a laptop, desktop, or server. The medium may also include data files, data structures, etc., either alone or in combination with program instructions. The medium and program instructions may be those specifically designed and constructed for this purpose, or they may be of a type known and available to those skilled in the art of computer software. Examples of non-transient computer-readable storage media include magnetic media such as hard disks, floppy disks, and tapes; optical media such as compact disk read-only memory (CD-ROM) disks and digital video disks (DVDs); magneto-optical media such as magneto-optical disks; and hardware devices specifically for storing and executing program instructions, such as read-only memory (ROM), random access memory (RAM), flash memory, etc. Examples of program instructions include both machine codes such as those generated by a compiler and files containing higher-level codes that can be executed by a computer using an interpreter. The described hardware devices may act as one or more software modules in order to perform the operations implemented above.

[0057] As used herein, a module, such as a communication module, is intended to include any collection or set of program instructions that can be executed through a network cloud so that the desired tasks are performed by the software. The term "software" as used herein is intended to include such instructions stored in storage media such as RAM, hard disks, optical disks, and is also intended to include so-called "firmware", i.e., software stored on ROM, etc. Such software may be organized in a variety of ways and may include software components organized as libraries, Internet-based programs stored on remote servers, etc., source code, interpreted code, object code, directly executable code, etc. It is contemplated that the software may call system-level code or calls to other software residing on a server or other location to perform certain functions.

[0058] Any combination of the above features and functions may be used, depending on one or more implementations. In the foregoing description, implementations are described with reference to many specific details that may vary from implementation to implementation. Therefore, the description and drawings should be regarded as illustrative rather than restrictive.

[0059] An interface can be used to provide input or obtain output from a server. The interface can be implemented as a command line interface (CLI), a graphical user interface (GUI). In addition, an application programming interface (API) can also be used to interact remotely with a server.

[0060] The processor may include one or more general-purpose processors (e.g., INTEL or Advanced MicroDevices (AMD) microprocessors) and / or one or more special purpose processors (e.g., digital signal processors or Xilinx System on a chip (SOC) Field Programmable Gate Array (FPGA) processor), MIPS / ARM class processor, microprocessor, digital signal processor, application specific integrated circuit, microcontroller, state machine or any type of programmable logic array.

[0061] The memory may include, but is not limited to, one or more non-transitory machine-readable storage devices such as hard drives, magnetic tapes, floppy disks, optical disks, compact disk-read only memory (CD-ROM) and magneto-optical disks, semiconductor memories such as ROM, random access memory (RAM), programmable read-only memory (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), flash memory, magnetic or optical cards, or other types of media / machine-readable media suitable for storing electronic instructions.

[0062] The terms "or" and "and / or" as used herein should be interpreted to include or mean any one or any combination. Thus, "A, B, or C" or "A, B, and / or C" means "any of the following: A; B; C; A and B; A and C; B and C; A, B, and C." An exception to this definition will only occur when a combination of elements, functions, steps, or actions are inherently mutually exclusive in some way.

Claims

1. A method comprising: using data clustering techniques to cluster a plurality of network sites into a plurality of clusters of network sites based on a plurality of parameters, wherein the plurality of parameters are related to operational characteristics and network threats associated with the plurality of network sites; using machine learning, training one or more data models on said plurality of clusters of website sites developed by said clustering, said training of said one or more data models being based on training data; executing, by a system including a hardware processor, the one or more data models to predict a threat frequency of the network threat for each of the plurality of clusters of network sites; determining, by the system, for each of the plurality of clusters of network sites, a threat frequency difference between the predicted threat frequency of the network threat and a corresponding baseline frequency, wherein the determining produces a plurality of threat frequency differences for respective clusters of the plurality of clusters of network sites; as well as The system configures the corresponding dynamic rule set for the corresponding cluster by integrating rules suitable for preventing the network threats in each corresponding cluster of the multiple clusters of network sites into the corresponding dynamic rule set, wherein the count of the rules integrated into the corresponding dynamic rule set depends on the corresponding threat frequency differences among the multiple threat frequency differences.

2. The method of claim 1, wherein the plurality of parameters comprises one or more of: a location score of a network segment, software stack embedding, a score based on bandwidth consumption of applications running across the network segment, a score based on network traffic patterns, a score based on the number of different types of network devices connected in the network segment, a score based on user dispersion, a score based on reputation of the network segment, a score based on network threats to the network segment, or a score based on network classification. 3 . The method of claim 1 , further comprising training the one or more data models based on the predicted threat frequencies of the network threats. 4 . The method of claim 1 , wherein the configuring of the corresponding dynamic rule set comprises adding a new rule to the corresponding dynamic rule set based on the corresponding threat frequency difference exceeding a predetermined threshold. 5 . The method of claim 4 , wherein the configuring of the corresponding dynamic rule set comprises removing an existing rule from the corresponding dynamic rule set based on the corresponding threat frequency difference being less than the predetermined threshold. 6 . The method of claim 1 , wherein the baseline frequency for a given cluster in the plurality of clusters of network sites comprises a count of network attacks in the given cluster. 7 . The method of claim 1 , wherein each of the one or more data models is trained on a separate cluster of the plurality of clusters of network sites.

8. The method of claim 1 , wherein the one or more data models, when executed, predict a threat frequency of a corresponding network threat for each of the plurality of clusters of network sites, and the method comprises: determining, by the system, a threat frequency difference between the predicted threat frequency for the corresponding network threat and a corresponding baseline frequency for each of the plurality of clusters of network sites; as well as The determined threat frequency differences are used by the system to configure the corresponding dynamic rule set for each corresponding cluster of the plurality of clusters of network sites.

9. The method of claim 1, wherein the network threat comprises one or more of the following: a denial of service attack, a man-in-the-middle attack, a phishing attack, ransomware, a virus, or a worm.

10. The method of claim 1, wherein the network threat comprises a hack into a network site.

11. A system comprising: processor; a non-transitory storage medium storing instructions executable on the processor to: using data clustering techniques to cluster a plurality of network sites into a plurality of clusters of network sites based on a plurality of parameters, wherein the plurality of parameters are related to operational characteristics and network threats associated with the plurality of network sites; using machine learning, training one or more data models on the plurality of clusters developed by the clustering, the training of the one or more data models being based on training data; executing the one or more data models to predict a threat frequency of the network threat for each of the plurality of clusters of network sites; determining, for each of the plurality of clusters of network sites, a threat frequency difference between the predicted threat frequency of the network threat and a corresponding baseline frequency, wherein the determining produces a plurality of threat frequency differences for respective clusters of the plurality of clusters of network sites; as well as The corresponding dynamic rule set is configured for the corresponding cluster by integrating rules suitable for preventing the network threats in each corresponding cluster of the multiple clusters of network sites into a corresponding dynamic rule set, wherein the count of the rules integrated into the corresponding dynamic rule set depends on the corresponding threat frequency differences among the multiple threat frequency differences.

12. The system of claim 11, wherein the plurality of parameters are collected by virtual gateway service devices operating in the plurality of network sites and provided to the system on the network.

13. The system of claim 11, wherein the plurality of parameters comprises one or more of: a location score for a network segment, a score based on bandwidth consumption by applications running across the network segment, a score based on network traffic patterns, a score based on the number of different types of network devices connected in the network segment, a score based on the reputation of the network segment, or a score based on network threats to the network segment.

14. The system of claim 11, wherein the configuring of the corresponding dynamic rule set comprises removing an existing rule from the corresponding dynamic rule set based on the corresponding threat frequency difference being less than a predetermined threshold.

15. The system of claim 14, wherein the configuring of the corresponding dynamic rule set comprises adding a new rule to the corresponding dynamic rule set based on the corresponding threat frequency difference exceeding the predetermined threshold.

16. The system of claim 15, wherein adding the new rule to the corresponding dynamic rule set increases the scope of network threat detection in the corresponding cluster.

17. The system of claim 15, wherein removing the existing rule from the corresponding dynamic rule set reduces the scope of network threat detection in the corresponding cluster.

18. The system of claim 11, wherein the plurality of parameters are captured along with time stamps of the plurality of parameters.

19. The system of claim 11, wherein the baseline frequency for a given cluster in the plurality of clusters of network sites comprises a count of network attacks in the given cluster.

20. The system of claim 11, wherein the network threat comprises one or more of: a denial of service attack, a man-in-the-middle attack, a phishing attack, ransomware, a virus, or a worm.

21. The system of claim 11, wherein the network threat comprises a hack into a network site.

22. A non-transitory computer-readable storage medium comprising instructions that, when executed, cause a system to: using data clustering techniques to cluster a plurality of network sites into a plurality of clusters of network sites based on a plurality of parameters, wherein the plurality of parameters are related to operational characteristics and network threats associated with the plurality of network sites; using machine learning, training one or more data models on the plurality of clusters developed by the clustering, the training of the one or more data models being based on training data; executing the one or more data models to predict a threat frequency of the network threat for each of the plurality of clusters of network sites; determining, for each of the plurality of clusters of network sites, a threat frequency difference between the predicted threat frequency of the network threat and a corresponding baseline frequency, wherein the determining produces a plurality of threat frequency differences for respective clusters of the plurality of clusters of network sites; as well as The corresponding dynamic rule set is configured for the corresponding cluster by integrating rules suitable for preventing the network threats in each corresponding cluster of the multiple clusters of network sites into a corresponding dynamic rule set, wherein the count of the rules integrated into the corresponding dynamic rule set depends on the corresponding threat frequency differences among the multiple threat frequency differences.

Images