Systems and methods for dynamic zone protection of networks
Disclosed are systems and methods for securing a network using one or more controllers and one or more network nodes. A method may utilize a packet processing engine configured to process incoming network packets, a processing analysis engine configured to perform relatively more complex processing and analysis, and one or more controllers configured to coordinate one or more packet processing engines and one or more processing analysis engines across a network to perform endpoint threat detection and mitigation.
1. A method of securing a network using one or more controllers and one or more network nodes, the method comprising:
receiving data packets at a packet processing engine of a first network node of the network;
forwarding, by the packet processing engine, the received data packets to one or more processing analysis engines of the first network node;
retrieving, by the packet processing engine, one or more attributes associated with one or more predetermined data packets of interest;
identifying and comparing, by the packet processing engine, one or more attributes of the received data packets to the one or more attributes associated with the one or more predetermined data packets of interest;
processing, by the packet processing engine, the received data packets, a session associated with the received data packets, and/or a data flow associated with the received data packets based at least in part on the comparison;
analyzing, by at least one processing analysis engine, the forwarded data packets, a session associated with the forwarded data packets, and/or a data flow associated with the forwarded data packets in parallel with the identifying and comparing step performed by the packet processing engine; and
transmitting, by the at least one processing analysis engine, the analysis of the forwarded data packets, associated session, and/or associated data flow to the one or more controllers and/or one or more additional network nodes of the network;
wherein the one or more controllers are configured to control the first network node to (i) update the one or more predetermined data packets of interests based on the received analysis and (ii) transmit one or more attributes associated with the updated one or more predetermined data packets of interest to the one or more additional network nodes and/or one or more agent nodes.
2. The method of claim 1 , wherein the one or more processing analysis engines include a first processing analysis engine of the first network node of the network and a second processing analysis engine of a second network node of the network.
3. The method of claim 1 , wherein processing the received data packets, the session associated with the received data packets, and/or the data flow associated with the received data packets based on the comparison comprises:
responding to, copying, dropping, routing, and/or modifying, by the packet processing engine, the received data packets, the associated session, and/or the associated data flow based at least in part on the comparison;
executing a program, by the packet processing engine, based at least in part on the comparison; and/or
creating a data packet, a session, and/or a data flow, by the packet processing engine, based at least in part on the comparison.
4. The method of claim 1 , further comprising:
receiving, by the at least one of the one or more processing analysis engines, one or more messages transmitted by an agent node connected to the first network node of the network.
5. The method of claim 4 , wherein the one or more messages describe information captured on a network connected device, one or more networks associated with the network connected device, a file state associated with the network connected device, and/or user information associated with the network connected device.
6. The method of claim 4 , further comprising:
transmitting, by the at least one processing analysis engine, the analysis and the one or more messages to the one or more controllers,
where in the one or more controllers are configured to (i) update the one or more predetermined data packets of interests based on the received analysis and the one or more messages, and (ii) transmit the one or more attributes associated with the updated one or more predetermined data packets of interest to the one or more additional network nodes.
7. The method of claim 1 , wherein the one or more attributes associated with the one or more predetermined data packets of interest are stored in a data store of the network node and/or the one or more controllers, and
wherein the network node and/or the one or more controllers are configured to update the stored one or more attributes associated with the one or more predetermined data packets of interest based on the one or more attributes associated with the updated one or more predetermined data packets of interest.
8. A system for securing a network, the system comprising:
a first network node comprising a first packet processing engine and one or more processing analysis engines including a first processing analysis engine, wherein the first packet processing engine is configured to:
receive and forward data packets to the first processing analysis engine,
retrieve one or more attributes associated with one or more predetermined data packets of interest,
identify and compare one or more attributes of the received data packets to the one or more attributes associated with the one or more predetermined data packets of interest, and
process the received data packets, a session associated with the received data packets, and/or a data flow associated with the received data packets based at least in part on the comparison, and
wherein the first processing analysis engine is configured to:
analyze the forwarded data packets, a session associated with the forwarded data packets, and/or a data flow associated with the forwarded data packets in parallel with the identifying and comparing step performed by the first packet processing engine, and
transmit the analysis of the forwarded data packets, associated session, and/or associated data flow to one or more controllers and/or one or more additional network nodes of the network; and
one or more controllers configured to control at least the first network node to: (i) update the one or more predetermined data packets of interests based on the received analysis and (ii) transmit one or more attributes associated with the updated one or more predetermined data packets of interest to the one or more additional network nodes.
9. The system of claim 8 , further comprising a second network node comprising a second packet processing engine and a second processing analysis engine, wherein the first packet processing engine is further configured to forward the received data packet to the first processing analysis engine and the second processing analysis engine, and
wherein the first and second processing analysis engines are configured to analyze the forwarded data packets, associated session, and/or associated data flow in parallel with the identifying and comparing step performed by the first packet processing engine.
10. The system of claim 8 , wherein the first packet processing engine is configured to:
process the received data packets, associated session, and/or associated data flow by responding to, copying, dropping, routing, and/or modifying the received data packets, the associated session, and/or the associated data flow based at least in part on the comparison;
process the received data packets, associated session, and/or associated data flow by executing a program based at least in part on the comparison; and/or
process the received data packets, associated session, and/or associated data flow by creating a data packet, a session, and/or a data flow based at least in part on the comparison.
11. The system of claim 8 , further comprising:
an agent node configured to transmit one or more messages to the first processing analysis engine and/or the one or more controllers, wherein the one or more messages describe information captured on a network connected device, one or more networks associated with the network connected device, a file state associated with the network connected device, and/or user information associated with the network connected device.
12. The system of claim 11 , wherein the first processing analysis engine is configured to analyze the forwarded data packet at least based on the received one or more messages regarding the network connected device in parallel with the identifying and comparing step performed by the first packet processing engine.
13. The system of claim 11 , wherein the first processing analysis engine is configured to transmit the analysis and the one or more messages to one or more controllers, and
wherein the one or more controllers are configured to (i) update the one or more predetermined data packets of interests based on the received analysis and the one or more messages and (ii) transmit the one or more attributes associated with the updated one or more predetermined data packets of interest to the one or more network nodes.
14. The system of claim 8 , further comprising:
a data store configured to store the one or more attributes associated with the one or more predetermined data packets of interest,
wherein the one or more controllers and/or the first network node are configured to update the stored one or more attributes associated with the one or more predetermined data packets of interest based on the one or more attributes associated with the updated one or more predetermined data packets of interest.
15. The system of claim 8 , wherein the first network node comprises the one or more controllers.
16. A system for a securing a network, the system comprising:
an agent node configured to transmit one or more messages regarding a network connected device to a first processing analysis engine of a first network node and/or one or more controllers, wherein the network connected device is connected to the first network node of the network;
the first network node comprising a first packet processing engine and one or more processing analysis engines including a first processing analysis engine, wherein the first packet processing engine is configured to:
receive and forward a plurality of data packets to the first processing analysis engine,
retrieve one or more attributes associated with one or more predetermined data packets of interest,
identify and compare one or more attributes of the received data packets to the one or more attributes associated with the one or more predetermined data packets of interest, and
process the received data packets, a session associated with the received data packets, and/or a data flow associated with the received data packets based at least in part on the comparison, and
wherein the first processing analysis engine is configured to:
analyze the forwarded data packet, a session associated with the forwarded data packets, and/or a data flow associated with the forwarded data packets at least based on the received one or more messages regarding the network connected device in parallel with the identifying and comparing step performed by the first packet processing engine, and
transmit the analysis and/or the one or more messages regarding the network connected device to the one or more controllers; and
the one or more controllers configured to control at least the first network node to: (i) update the one or more predetermined data packets of interests based on the received analysis and the one or more messages regarding the network connected device and (ii) transmit one or more attributes associated with the updated one or more predetermined data packets of interest to the one or more network nodes.
17. The system of claim 16 , further comprising a second network node comprising a second packet processing engine and a second processing analysis engine, wherein the first packet processing engine is further configured to forward the received data packet to the first processing analysis engine and the second processing analysis engine, and
wherein the first and second processing analysis engines are configured to analyze the forwarded data packet, associated session, and/or associated data flow in parallel with the identifying and comparing step performed by the first packet processing engine.
18. The system of claim 16 , wherein the first packet processing engine is configured to:
process the received data packets, associated session, and/or associated data flow by responding to, copying, dropping, routing, and/or modifying the received data packets, the associated session, and/or the associated data flow based at least in part on the comparison;
process the received data packets, associated session, and/or associated data flow by executing a program based at least in part on the comparison; and/or
process the received data packets, associated session, and/or associated data flow by creating a data packet, a session, and/or a data flow based at least in part on the comparison.
19. The system of claim 16 , wherein the one or more messages describe information captured on the network connected device, one or more networks associated with the network connected device, a file state associated with the network connected device, and/or user information associated with the network connected device.
20. The system of claim 16 , further comprising:
a data store configured to store the one or more attributes associated with the one or more predetermined data packets of interest,
wherein the one or more controllers and/or the first network node are configured to update the stored one or more attributes associated with the one or more predetermined data packets of interest based on the one or more attributes associated with the updated one or more predetermined data packets of interest.