Granted Patent B1

US 9,571,516 · App. 14/536,455 · Granted Feb 14, 2017

Abstract

Claims (53)

1. A method of assessing a cloud service usage level of an enterprise operating an enterprise data network, the method comprising:

receiving, at an on-premises processor configured within the enterprise data network, network event logs associated with network traffic traveling to and from the enterprise data network, the network event logs comprising network event data describing network events traveling to and from the enterprise data network, the network event data comprising a source indicator, a destination indicator, a time of the network event, and a request parameter;

processing, at the on-premises processor, the network event logs to generate processed network event data containing network event data related to cloud service usage;

transmitting the processed network event data to an off-premises usage analysis system configured outside of the enterprise data network;

assessing, using the off-premises usage analysis system, cloud service usage behavior and pattern of the enterprise based on the processed network event data; and

generating, using the off-premises usage analysis system, a cloud service usage analytic based on the cloud service usage behavior and pattern of the enterprise, the cloud service usage analytic describing the use of cloud-based services from one or more cloud service providers by the enterprise,

wherein processing, at the on-premises processor, the network event logs to generate processed network event data containing network event data related to cloud service usage comprises:

analyzing the network event logs to identify network events related to the use of cloud-based services;

filtering the network event logs to include only network event data relating to the use of cloud-based services;

tokenizing the filtered network event data to remove identifying information relating to the enterprise or to users of the enterprise and to replace the identifying information with random identifiers;

applying a compression algorithm to the tokenized and filtered network event data; and

providing the compressed, tokenized and filtered network event data as the processed network even data.

2. The method of claim 1 , wherein tokenizing the filtered network event data to remove identifying information relating to the enterprise or to users of the enterprise further comprises:

generating an anonymity file comprising a mapping of each identifying information and corresponding random identifier.

3. The method of claim 2 , further comprising:

displaying the cloud service usage analytic on a web browser, the cloud service usage analytic including tokenized data;

receiving the anonymity file and storing the anonymity file in a web storage of the web browser; and

displaying the identifying information in place of the corresponding random identifier using the mapping in the anonymity file.

4. The method of claim 1 , wherein generating, using the off-premises usage analysis system, a cloud service usage analytic comprises:

generating one or more cloud service usage analytics including identification of cloud service providers being used, identities of users using each of the identified cloud service providers, times of usage, the volume of transactions, and the service category of the cloud service providers.

5. The method of claim 1 , wherein generating, using the off-premises usage analysis system, a cloud service usage analytic comprises:

generating one or more cloud service usage analytics including a detected number of cloud service providers being used, a detected number of high risk service providers being used, a detected number of users or unique IP addresses using each cloud service, and a detected volume of high risk activities that users of the enterprise engaged in.

6. The method of claim 1 , wherein assessing cloud service usage behavior and pattern of the enterprise based on the processed network event data and generating the cloud service usage analytic based on the cloud service usage behavior and pattern of the enterprise comprises:

correlating the processed network event data to unique users as identified by the random identifiers;

correlating, using data from a cloud service registry, the processed network event data to one or more cloud service providers;

analyzing the processed network event data to detect anomaly in the network event data; and

generating one or more cloud service usage analytic based the correlated user data and detected anomaly.

7. The method of claim 6 , wherein analyzing the processed network event data to detect anomaly in the network event data comprises:

analyzing the processed network event data to detect for unusual activities of a user, or a certain usage pattern, or a large amount of data download by a user of the enterprise.

8. A system for assessing a cloud service usage level of an enterprise operating an enterprise data network, the system comprising:

a log processor deployed within the enterprise data network to receive network event logs associated with network traffic traveling to and from the enterprise data network and to process the network event logs to generate processed network event data containing network event data related to cloud service usage, the network event logs comprising network event data describing network events traveling to and from the enterprise data network, the network event data comprising a source indicator, a destination indicator, a time of the network event, and a request parameter; and

a usage analysis system deployed outside of the enterprise data network to receive the processed network event data from the log processor, the usage analysis system being configured to assess cloud service usage behavior and pattern of the enterprise based on the processed network event data and to generate a cloud service usage analytic based on the cloud service usage behavior and pattern of the enterprise, the cloud service usage analytic describing the use of cloud-based services from one or more cloud service providers by the enterprise;

wherein the log processor is configured to analyze the network event logs to identify network events related to the use of cloud-based services, to filter the network event logs to include only network event data relating to the use of cloud-based services, to tokenize the filtered network event data to remove identifying information relating to the enterprise or to users of the enterprise and to replace the identifying information with random identifiers, to apply a compression algorithm to the tokenized and filtered network event data, and to provide the compressed, tokenized and filtered network event data as the processed network even data.

9. The system of claim 8 , wherein the log processor is configured to generate an anonymity file comprising a mapping of each identifying information and corresponding random identifier.

10. The system of claim 8 , wherein the usage analysis system is configured to generate one or more cloud service usage analytics including identification of cloud service providers being used, identities of users using each of the identified cloud service providers, times of usage, the volume of transactions, and the service category of the cloud service providers.

11. The system of claim 8 , wherein the usage analysis system is configured to generate one or more cloud service usage analytics including a detected number of cloud service providers being used, a detected number of high risk service providers being used, a detected number of users or unique IP addresses using each cloud service, and a detected volume of high risk activities that users of the enterprise engaged in.

12. The system of claim 8 , wherein the usage analysis system is configured to correlate the processed network event data to unique users as identified by the random identifiers, to correlating, using data from a cloud service registry, the processed network event data to one or more cloud service providers, to analyze the processed network event data to detect anomaly in the network event data, and to generate one or more cloud service usage analytic based the correlated user data and detected anomaly.

13. The system of claim 12 , wherein the usage analysis system is further configured to analyze the processed network event data to detect for unusual activities of a user, or a certain usage pattern, or a large amount of data download by a user of the enterprise.

14. A method of identifying cloud service providers from the network traffic of an enterprise operating an enterprise data network, the method comprising:

receiving, at an on-premises processor configured within the enterprise data network, network event logs associated with network traffic traveling to and from the enterprise data network;

processing, at the on-premises processor and using data from a cloud service registry, the network event logs to generate processed network event data containing network event data related to cloud service usage;

obtaining, using the on-premises processor and from the network event logs, destination IP addresses of network events destined to one or more known cloud service providers;

determining, using the on-premises processor, whether a network event uses a secure socket layer protocol;

in response to a network event using a secure socket layer protocol, collecting, using the on-premises processor, the destination IP addresses into a queue;

scanning, using the on-premises processor, the destination IP addresses in the queue to identify the cloud service provider to which the destination IP address is destined;

classifying, using the on-premises processor, each destination IP address in the queue as a public website, an existing cloud service provider, a tenant specific cloud service, an unknown website and an unable to connect;

in response to a destination IP address in the queue being classified as a public website, storing, using the on-premises processor, the destination IP address in an exclude list in the cloud service registry, the network event associated with the destination IP address being excluded from the processed network event data;

in response to a destination IP address in the queue being classified as an existing cloud service provider, storing, using the on-premises processor, the destination IP address in the cloud service registry associated with the existing cloud service provider; and

in response to a destination IP address in the queue being classified as a tenant specific cloud service, storing, using the on-premises processor, the destination IP address in the cloud service registry associated with the tenant cloud service provider.

15. The method of claim 14 , wherein scanning, using the on-premises processor, the destination IP addresses in the queue to identify the cloud service provider to which the destination IP address is destined comprises:

scanning, using the on-premises processor, a certificate associated with each of the destination IP addresses to identify the cloud service provider from a common name field in the certificate.

16. The method of claim 14 , wherein scanning, using the on-premises processor, the destination IP addresses in the queue to identify the cloud service provider to which the destination IP address is destined comprises:

for each destination IP address, discovering, using a secure socket layer protocol handshake, a common name and domain of the cloud service provider associated with the destination IP address.

Assignments (16)