Granted Patent B1

US 10,326,676 · App. 16/243,001 · Granted Jun 18, 2019

Inventors: Edmund Hope Driggs (Seattle, WA); Jesse Abraham Rothstein (Seattle, WA)

Assignee: ExtraHop Networks, Inc.

H04L43/0876H04L43/14H04L43/16

Abstract

Claims (96)

1. A method for monitoring network traffic using on one or more network computers over one or more networks, wherein the execution of instructions by the one or more network computers perform the method comprising:

instantiating a monitoring engine to perform actions, including:

providing anomaly information that is associated with one or more anomalies that are associated with monitored network traffic; and

instantiating an inference engine that performs actions, including:

determining one or more users that are associated with the one or more anomalies associated with one or more portions of the monitored network traffic;

determining a communication channel that is associated with the one or more users based on the one or more anomalies and the one or more portions of the monitored network traffic, wherein the communication channel is separate from the monitored network traffic;

employing the communication channel to provide one or more investigative agents to the one or more users;

annotating the anomaly information to include one or more attributes based on one or more metrics that are associated with the one or more portions of the monitored network traffic that is associated with the one or more anomalies;

determining the one or more investigative agents based on the annotated anomaly information;

employing the annotated anomaly information to further determine the communication channel;

collecting investigative information from the one or more investigative agents over the communication channel; and

providing a risk value that is associated with the one or more anomalies based on the investigative information.

2. The method of claim 1 , wherein collecting the investigative information, further comprises, monitoring one or more interactions of the one or more users with the one or more investigative agents.

3. The method of claim 1 , further comprising employing one or more of an anomaly engine on the one or more network computers, one or more network monitoring computers, or one or more services that are separate from the one or more network computers to provide the anomaly information.

4. The method of claim 1 , wherein collecting the investigative information, further comprises:

employing the investigative agent to determine one or more target metrics that are associated with one or more of one or more target entities or the one or more users; and

employing the investigative agent to provide the investigative information to the inference engine using the communication channel.

5. The method of claim 1 , wherein collecting the investigative information, further comprises:

employing the investigative agent to determine one or more target metrics that are associated with one or more interactions with the one or more users; and

employing the investigative agent to provide the one or more target metrics to the inference engine using the communication channel.

6. The method of claim 1 , wherein the inference engine performs further actions, including, determining one or more remediation actions based on the investigative information, wherein the one or more remediation actions includes one or more of quarantining an endpoint, blocking network traffic, or locking a user account.

7. A system for monitoring network traffic in one or more networks:

one or more network computers, comprising:

a transceiver that communicates over the one or more networks;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

instantiating a monitoring engine to perform actions, including:

providing anomaly information that is associated with one or more anomalies that are associated with monitored network traffic; and

instantiating an inference engine that performs actions, including:

determining one or more users that are associated with the one or more anomalies associated with one or more portions of the monitored network traffic;

determining a communication channel that is associated with the one or more users based on the one or more anomalies and the one or more portions of the monitored network traffic, wherein the communication channel is separate from the monitored network traffic;

employing the communication channel to provide one or more investigative agents to the one or more users;

annotating the anomaly information to include one or more attributes based on one or more metrics that are associated with the one or more portions of the monitored network traffic that is associated with the one or more anomalies;

determining the one or more investigative agents based on the annotated anomaly information;

employing the annotated anomaly information to further determine the communication channel;

collecting investigative information from the one or more investigative agents over the communication channel; and

providing a risk value that is associated with the one or more anomalies based on the investigative information; and

one or more client computers, comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

providing one or more of the one or more portions of the monitored network traffic.

8. The system of claim 7 , wherein collecting the investigative information, further comprises, monitoring one or more interactions of the one or more users with the one or more investigative agents.

9. The system of claim 7 , further comprising employing one or more of an anomaly engine on the one or more network computers, one or more network monitoring computers, or one or more services that are separate from the one or more network computers to provide the anomaly information.

10. The system of claim 7 , wherein collecting the investigative information, further comprises:

employing the investigative agent to determine one or more target metrics that are associated with one or more of one or more target entities or the one or more users; and

employing the investigative agent to provide the investigative information to the inference engine using the communication channel.

11. The system of claim 7 , wherein collecting the investigative information, further comprises:

employing the investigative agent to determine one or more target metrics that are associated with one or more interactions with the one or more users; and

employing the investigative agent to provide the one or more target metrics to the inference engine using the communication channel.

12. The system of claim 7 , wherein the inference engine performs further actions, including, determining one or more remediation actions based on the investigative information, wherein the one or more remediation actions includes one or more of quarantining an endpoint, blocking network traffic, or locking a user account.

13. A network computer for monitoring network traffic over one or more networks between two or more computers, comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including:

instantiating a monitoring engine to perform actions, including:

providing anomaly information that is associated with one or more anomalies that are associated with monitored network traffic; and

instantiating an inference engine that performs actions, including:

determining one or more users that are associated with the one or more anomalies associated with one or more portions of the monitored network traffic;

determining a communication channel that is associated with the one or more users based on the one or more anomalies and the one or more portions of the monitored network traffic, wherein the communication channel is separate from the monitored network traffic;

employing the communication channel to provide one or more investigative agents to the one or more users;

annotating the anomaly information to include one or more attributes based on one or more metrics that are associated with the one or more portions of the monitored network traffic that is associated with the one or more anomalies;

determining the one or more investigative agents based on the annotated anomaly information;

employing the annotated anomaly information to further determine the communication channel;

collecting investigative information from the one or more investigative agents over the communication channel; and

providing a risk value that is associated with the one or more anomalies based on the investigative information.

14. The network computer of claim 13 , wherein collecting the investigative information, further comprises, monitoring one or more interactions of the one or more users with the one or more investigative agents.

15. The network computer of claim 13 , further comprising employing one or more of an anomaly engine on the one or more network computers, one or more network monitoring computers, or one or more services that are separate from the one or more network computers to provide the anomaly information.

16. The network computer of claim 13 , wherein collecting the investigative information, further comprises:

employing the investigative agent to determine one or more target metrics that are associated with one or more of one or more target entities or the one or more users; and

employing the investigative agent to provide the investigative information to the inference engine using the communication channel.

17. The network computer of claim 13 , wherein collecting the investigative information, further comprises:

employing the investigative agent to determine one or more target metrics that are associated with one or more interactions with the one or more users; and

employing the investigative agent to provide the one or more target metrics to the inference engine using the communication channel.

18. The network computer of claim 13 , wherein the inference engine performs further actions, including, determining one or more remediation actions based on the investigative information, wherein the one or more remediation actions includes one or more of quarantining an endpoint, blocking network traffic, or locking a user account.

19. A processor readable non-transitory storage media that includes instructions for monitoring network traffic over one or more networks using one or more network monitoring computers, wherein execution of the instructions by the one or more network computers perform the method comprising:

instantiating a monitoring engine to perform actions, including:

providing anomaly information that is associated with one or more anomalies that are associated with monitored network traffic; and

instantiating an inference engine that performs actions, including:

determining one or more users that are associated with the one or more anomalies associated with one or more portions of the monitored network traffic;

determining a communication channel that is associated with the one or more users based on the one or more anomalies and the one or more portions of the monitored network traffic, wherein the communication channel is separate from the monitored network traffic;

employing the communication channel to provide one or more investigative agents to the one or more users;

annotating the anomaly information to include one or more attributes based on one or more metrics that are associated with the one or more portions of the monitored network traffic that is associated with the one or more anomalies;

determining the one or more investigative agents based on the annotated anomaly information;

employing the annotated anomaly information to further determine the communication channel;

collecting investigative information from the one or more investigative agents over the communication channel; and

providing a risk value that is associated with the one or more anomalies based on the investigative information.

20. The media of claim 19 , wherein collecting the investigative information, further comprises, monitoring one or more interactions of the one or more users with the one or more investigative agents.

21. The media of claim 19 , further comprising employing one or more of an anomaly engine on the one or more network computers, one or more network monitoring computers, or one or more services that are separate from the one or more network computers to provide the anomaly information.

22. The media of claim 19 , wherein collecting the investigative information, further comprises:

employing the investigative agent to determine one or more target metrics that are associated with one or more of one or more target entities or the one or more users; and

employing the investigative agent to provide the investigative information to the inference engine using the communication channel.

23. The media of claim 19 , wherein collecting the investigative information, further comprises:

employing the investigative agent to determine one or more target metrics that are associated with one or more interactions with the one or more users; and

employing the investigative agent to provide the one or more target metrics to the inference engine using the communication channel.

24. The media of claim 19 , wherein the inference engine performs further actions, including, determining one or more remediation actions based on the investigative information, wherein the one or more remediation actions includes one or more of quarantining an endpoint, blocking network traffic, or locking a user account.

Assignments (6)

Cited By (8)

US 12,200,001 US 12,225,030 US 12,309,192 US 12,355,816 US 12,483,384 US 12,587,535 US 12,647,441 US 12,652,312