Granted Patent B2

US 10,872,148 · App. 15/044,720 · Granted Dec 22, 2020

Abstract

Claims (32)

1. A computer-implemented method for reducing an impact of data leakage activity in a network, comprising:

generating, by executing an instruction with at least one processor of a first computer, a user prompt including choices for isolating a first node in the network, the user prompt generated in response to detecting a notification that indicates (a) a second computer detected a potential data leakage activity of the first node and (b) a suggested action for isolating the node, at least one of the choices including the suggested action, the first node different than the first computer and the second computer;

determining, by executing an instruction with the at least one processor of the first computer, the first node is in a group of nodes; and

in response to detecting the notification, forming an isolated group, by executing an instruction with the at least one processor of the first computer, by causing at least one device to enforce a policy to isolate the first node and ones of the group of nodes that have exhibited characteristics of the potential data leakage activity from the network, the policy including monitoring traffic flowing out of the isolated group to determine whether additional potential data leakage activity is present.

2. The method of claim 1 , wherein the choices include an option for user selection representing an action to disable the first node.

3. The method of claim 1 , wherein the choices include an option for user selection representing an action to disable an account associated with the first node.

4. The method of claim 1 , wherein the choices include an option for user selection representing an action to lock the first node.

5. The method of claim 1 , wherein the choices include an option for user selection representing an action to quarantine the first node.

6. The method of claim 1 , wherein the first computer includes at least one physical computer.

7. A storage device or storage medium comprising instructions that when executed cause a first computer to at least:

in response to a notification that indicates (1) a second computer detected a potential data leakage activity on a first node in a network and (2) a suggested action for isolating the first node, generate a user prompt including choices for isolating the first node, at least one of the choices including the suggested action, the first node different than the first computer and the second computer;

determine the first node is in a group of nodes; and

in response to detecting the notification, form an isolated group by causing at least one device to enforce a policy to isolate the first node and ones of the group of nodes that have exhibited characteristics of the potential data leakage activity from the network, the policy including monitoring traffic flowing out of the isolated group to determine whether additional potential data leakage activity is present.

8. The storage device or storage medium of claim 7 , wherein the choices include an option for user selection representing an action to disable the first node.

9. The storage device or storage medium of claim 7 , wherein the choices include an option for user selection representing an action to disable an account associated with the first node.

10. The storage device or storage medium of claim 7 , wherein the choices include an option for user selection representing an action to lock the first node.

11. The storage device or storage medium of claim 7 , wherein the choices include an option for user selection representing an action to quarantine the first node.

12. The storage device or storage medium of claim 7 , wherein the first computer includes at least one physical computer.

13. The storage device or storage medium of claim 7 , wherein the first computer includes a mobile device.

14. The storage device or storage medium of claim 13 , wherein the mobile device is mobile phone.

15. A system, comprising:

one or more processors of a first computer; and

a memory, coupled to the one or more processors, including instructions that, when executed by the one or more processors, cause the one or more processors to at least:

in response to a notification that indicates (1) a second computer detected a potential data leakage activity on a first node in a network and (2) a suggested action for isolating the first node, generate a user prompt including choices for isolating the first node, at least one of the choices including the suggested action, the first node different than the first computer and the second computer;

determine the first node is in a group of nodes; and

in response to detecting the notification, form an isolated group by causing at least one device to enforce a policy to isolate the first node and ones of the group of nodes that have exhibited characteristics of the potential data leakage activity from the network, the policy including monitoring traffic flowing out of the isolated group to determine whether additional potential data leakage activity is present.

16. The system of claim 15 , wherein the choices include an option for user selection representing an action to disable the first node.

17. The system of claim 15 , wherein the choices include an option for user selection representing an action to disable an account associated with the first node.

18. The system of claim 15 , wherein the choices include an option for user selection representing an action to lock the first node.

19. The system of claim 15 , wherein the choices include an option for user selection representing an action to quarantine the first node.

20. The system of claim 15 , wherein the system includes a mobile device.

21. The system of claim 20 , wherein the mobile device is mobile phone.

Assignments (10)