Systems and methods for dynamic zone protection of networks
Disclosed are systems and methods for securing a network using one or more controllers and one or more network nodes. A method may utilize a packet processing engine configured to process incoming network packets, a processing analysis engine configured to perform relatively more complex processing and analysis, and one or more controllers configured to coordinate one or more packet processing engines and one or more processing analysis engines across a network to perform endpoint threat detection and mitigation.
1. A method comprising:
securing a network using one or more controllers and one or more network nodes, the method further comprising:
forwarding, by a packet processing engine, received data packets to one or more processing analysis engines of a first network node;
identifying and comparing, by the packet processing engine, one or more attributes of the received data packets to one or more attributes associated with one or more predetermined data packets of interest;
processing, by the packet processing engine, the received data packets, a session associated with the received data packets, and/or a data flow associated with the received data packets based at least in part on the comparison;
analyzing, by at least one processing analysis engine, the forwarded data packets, a session associated with the forwarded data packets, and/or a data flow associated with the forwarded data packets in parallel with the identifying and comparing step performed by the packet processing engine; and
transmitting, by the at least one processing analysis engine, the analysis of the forwarded data packets, associated session, and/or associated data flow to the one or more controllers and/or one or more additional network nodes of the network.
2. The method of claim 1 , wherein the one or more processing analysis engines include a first processing analysis engine of the first network node of the network and a second processing analysis engine of a second network node of the network.
3. The method of claim 1 , wherein processing the received data packets, the session associated with the received data packets, and/or the data flow associated with the received data packets based on the comparison comprises:
responding to, copying, dropping, routing, and/or modifying, by the packet processing engine, the received data packets, the associated session, and/or the associated data flow based at least in part on the comparison;
executing a program, by the packet processing engine, based at least in part on the comparison; and/or
creating a new data packet, a new session, and/or a new data flow, by the packet processing engine, based at least in part on the comparison.
4. The method of claim 1 , further comprising:
receiving, by the at least one of the one or more processing analysis engines, one or more messages transmitted by an agent node connected to the first network node of the network.
5. The method of claim 4 , wherein the one or more messages describe information captured on a network connected device, one or more networks associated with the network connected device, a file state associated with the network connected device, and/or user information associated with the network connected device.
6. The method of claim 4 , further comprising:
transmitting, by the at least one processing analysis engine, the analysis and the one or more messages to the one or more controllers,
where in the one or more controllers are configured to (i) update the one or more predetermined data packets of interests based on the received analysis and the one or more messages, and (ii) transmit the one or more attributes associated with the updated one or more predetermined data packets of interest to the one or more additional network nodes.
7. The method of claim 1 ,
wherein the one or more attributes associated with the one or more predetermined data packets of interest are stored in a data store of the network node and/or the one or more controllers, and
wherein the network node and/or the one or more controllers are configured to update the stored one or more attributes associated with the one or more predetermined data packets of interest based on the one or more attributes associated with an updated one or more predetermined data packets of interest.
8. A system comprising:
securing a network, the system further comprising:
a first network node comprising a first packet processing engine and one or more processing analysis engines including a first processing analysis engine, wherein the first packet processing engine is configured to:
forward received data packets to the first processing analysis engine, identify and compare one or more attributes of the received data packets to one or more attributes associated with one or more predetermined data packets of interest, and
process the received data packets, a session associated with the received data packets, and/or a data flow associated with the received data packets based at least in part on the comparison, and
wherein the first processing analysis engine is configured to:
analyze the forwarded data packets, a session associated with the forwarded data packets, and/or a data flow associated with the forwarded data packets in parallel with the identifying and comparing step performed by the first packet processing engine, and
transmit the analysis of the forwarded data packets, the associated session, and/or the associated data flow to one or more controllers and/or one or more additional network nodes of the network.
9. The system of claim 8 , further comprising
a second network node comprising a second packet processing engine and a second processing analysis engine,
wherein the first packet processing engine is further configured to forward the received data packet to the first processing analysis engine and the second processing analysis engine, and
wherein the first and second processing analysis engines are configured to analyze the forwarded data packets, the associated session, and/or the associated data flow in parallel with the identifying and comparing step performed by the first packet processing engine.
10. The system of claim 8 , wherein the first packet processing engine is configured to:
process the received data packets, the associated session, and/or the associated data flow by responding to, copying, dropping, routing, and/or modifying the received data packets, the associated session, and/or the associated data flow based at least in part on the comparison;
process the received data packets, the associated session, and/or the associated data flow by executing a program based at least in part on the comparison; and/or
process the received data packets, the associated session, and/or the associated data flow by creating a new data packet, a new session, and/or a new data flow based at least in part on the comparison.
11. The system of claim 8 , further comprising:
an agent node configured to transmit one or more messages to the first processing analysis engine and/or the one or more controllers,
wherein the one or more messages describe information captured on a network connected device, one or more networks associated with the network connected device, a file state associated with the network connected device, and/or user information associated with the network connected device.
12. The system of claim 11 , wherein the first processing analysis engine is configured to analyze the forwarded data packet at least based on the received one or more messages regarding the network connected device in parallel with the identifying and comparing step performed by the first packet processing engine.
13. The system of claim 11 ,
wherein the first processing analysis engine is configured to transmit the analysis and the one or more messages to the one or more controllers, and
wherein the one or more controllers are configured to (i) update the one or more predetermined data packets of interests based on the received analysis and the one or more messages and (ii) transmit the one or more attributes associated with the updated one or more predetermined data packets of interest to the one or more network nodes.
14. The system of claim 8 , further comprising:
a data store configured to store the one or more attributes associated with the one or more predetermined data packets of interest,
wherein the one or more controllers and/or the first network node are configured to update the stored one or more attributes associated with the one or more predetermined data packets of interest based on the one or more attributes associated with an updated one or more predetermined data packets of interest.
15. The system of claim 8 , wherein the first network node comprises the one or more controllers.
16. A system comprising:
securing a network, the system further comprising:
an agent node configured to transmit one or more messages regarding a network connected device to a first processing analysis engine of a first network node and/or one or more controllers,
wherein the network connected device is connected to the first network node of the network; and
the first network node comprising a first packet processing engine and one or more processing analysis engines including a first processing analysis engine,
wherein the first packet processing engine is configured to:
forward received data packets to the first processing analysis engine, identify and compare one or more attributes of the received data packets to one or more attributes associated with one or more predetermined data packets of interest, and
process the received data packets, a session associated with the received data packets, and/or a data flow associated with the received data packets based at least in part on the comparison, and
wherein the first processing analysis engine is configured to:
analyze the forwarded data packet, a session associated with the forwarded data packets, and/or a data flow associated with the forwarded data packets at least based on the received one or more messages regarding the network connected device in parallel with the identifying and comparing step performed by the first packet processing engine, and
transmit the analysis and/or the one or more messages regarding the network connected device to the one or more controllers.
17. The system of claim 16 , further comprising
a second network node comprising a second packet processing engine and a second processing analysis engine,
wherein the first packet processing engine is further configured to forward the received data packet to the first processing analysis engine and the second processing analysis engine, and
wherein the first and second processing analysis engines are configured to analyze the forwarded data packet, the associated session, and/or the associated data flow in parallel with the identifying and comparing step performed by the first packet processing engine.
18. The system of claim 16 , wherein the first packet processing engine is configured to:
process the received data packets, the associated session, and/or the associated data flow by responding to, copying, dropping, routing, and/or modifying the received data packets, the associated session, and/or the associated data flow based at least in part on the comparison;
process the received data packets, the associated session, and/or the associated data flow by executing a program based at least in part on the comparison; and/or
process the received data packets, the associated session, and/or the associated data flow by creating a new data packet, a new session, and/or a new data flow based at least in part on the comparison.
19. The system of claim 16 , wherein the one or more messages describe information captured on the network connected device, one or more networks associated with the network connected device, a file state associated with the network connected device, and/or user information associated with the network connected device.
20. The system of claim 16 , further comprising:
a data store configured to store the one or more attributes associated with the one or more predetermined data packets of interest,
wherein the one or more controllers and/or the first network node are configured to update the stored one or more attributes associated with the one or more predetermined data packets of interest based on the one or more attributes associated with an updated one or more predetermined data packets of interest.