Endpoint Security Scoring From Passive Network Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems struggle to effectively manage security threats from personal devices on enterprise networks, particularly in environments with bring-your-own-device (BYOD) policies, due to limited visibility into the security states of these devices.
Innovation Solution
A threat management system that monitors network traffic to determine security states of endpoints by analyzing destination and source IP addresses, correlating them with known security addresses, and adjusting security status scores based on this correlation, while passively monitoring encrypted traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network traffic is monitored to determine security states of endpoints, then security assessment accuracy is improved, but system complexity increases
Solution Approach 1:
The patent introduces a server as an intermediary component that centralizes the security assessment functionality. The server receives network traffic data from multiple endpoints, performs the security state determination by comparing IP addresses against known security addresses, and generates security status scores. This intermediary architecture improves measurement precision by consolidating analysis capabilities while managing system complexity through centralized control rather than distributed implementation at each endpoint.
Solution Approach 2:
The system implements feedback by continuously monitoring network traffic and dynamically updating security status scores based on observed patterns. The server compares destination and source IP addresses from network traffic against a database of known security addresses, and adjusts security assessments in real-time based on the correlation results. This feedback mechanism improves security assessment accuracy by adapting to changing network conditions and threat patterns.
2Ease of operation
If encrypted network traffic is passively monitored, then security states are assessed without decryption, but measurement precision is reduced
Solution Approach 1:
The patent extracts only the essential identifying information (IP addresses) from the encrypted network traffic without attempting to decrypt the payload. By focusing solely on source and destination IP addresses that can be obtained from packet headers, the system maintains operational simplicity while still achieving meaningful security assessment. This extraction approach avoids the complexity of decryption while capturing sufficient information to determine whether endpoints are communicating with known security addresses.
3Productivity
If security status scores are adjusted based on IP address correlation, then threat prioritization is improved, but loss of information occurs
Solution Approach 1:
The system transforms raw network traffic data into a simplified parameter (security status score) that reflects the correlation between observed IP addresses and known security addresses. By converting complex network communication patterns into a single prioritization metric, the system improves threat prioritization efficiency. The score adjusts based on the degree of correlation, allowing security teams to quickly identify high-priority threats without being overwhelmed by detailed information about every network interaction.
Data Source
AI summary
Various aspects related to methods, systems, and computer readable media for using network traffic to determine security states on an enterprise network. Network traffic may be monitored and scrutinized to identify potential security threats. The potential security threats may be ranked and presented to a network administrator for further examination of each endpoint, or, automatic remedial actions may be taken based on a security status score of each endpoint.