Anonymized network data collection and network threat assessment and monitoring systems and methods
View Patent ↗Systems and methods for data collection and processing in a network, including one or more sensors disposed in a network interface and configured to collect raw signal traffic data where each sensor is further configured to parse the raw signal traffic data into network protocols; split the network protocols into content data and metadata; derive contextual metadata from the content data; compile the metadata and the derived metadata to produce anonymized metadata; encrypt the anonymized metadata; and transmit to the encrypted anonymized metadata to a unified data server.
1. A computer implemented method comprising:
obtaining a plurality of network communications from a network, including a first network communication;
identifying a communication protocol related to said first network communication;
identifying a network metadata portion of said first network communication, based at least partially on said communication protocol;
identifying a data portion of said first network communication based at least partially on said communication protocol;
generating anonymized contextual metadata based on said data portion;
combining said network metadata and said anonymized contextual metadata into a first anonymized network communication generating a plurality of encrypted anonymized network communications, including an encrypted version of said first anonymized network communications; and
providing said plurality of encrypted anonymized network communications to a remote server.
2. The method of claim 1 , wherein said contextual metadata is derived from characteristics of said first network communication including authorization traffic, HTTP flow, encryption, VPN activity, encryption certificates, passive fingerprints and application traffic.
3. A non-transitory computer-readable medium have contents which configure a computing system to perform a method, the method comprising:
obtaining a plurality of network communications from a network, including a first network communication;
identifying a communication protocol related to said first network communication;
identifying a network metadata portion of said first network communication, based at least partially on said communication protocol;
identifying a data portion of said first network communication based at least partially on said communication protocol;
generating anonymized contextual metadata based on said data portion;
combining said network metadata and said anonymized contextual metadata into a first anonymized network communication generating a plurality of encrypted anonymized network communications, including an encrypted version of said first anonymized network communications; and
providing said plurality of encrypted anonymized network communications to a remote server.
4. The non-transitory computer-readable medium of claim 3 wherein said contextual metadata is derived from characteristics of said first network communication including authorization traffic, HTTP flow, encryption, VPN activity, encryption certificates, passive fingerprints and application traffic.
5. A system, comprising:
one or more memories; and
processing circuitry coupled to the one or more memories, wherein the processing circuitry, in operation, controls a process, the process comprising:
obtaining a plurality of network communications from a network, including a first network communication;
identifying a communication protocol related to said first network communication;
identifying a network metadata portion of said first network communication, based at least partially on said communication protocol;
identifying a data portion of said first network communication based at least partially on said communication protocol;
generating anonymized contextual metadata based on said data portion;
combining said network metadata and said anonymized contextual metadata into a first anonymized network communication generating a plurality of encrypted anonymized network communications, including an encrypted version of said first anonymized network communications; and
providing said plurality of encrypted anonymized network communications to a remote server.
6. The system of claim 5 wherein said contextual metadata is derived from characteristics of said first network communication including authorization traffic, HTTP flow, encryption, VPN activity, encryption certificates, passive fingerprints and application traffic.