Systems and Methods for Network Risk Reduction

[0001] This application claims priority to U.S. Provisional Application Ser. No. 61/746,813, filed Dec. 28, 2012 and titled “Systems and Methods for Network Risk Reduction,” the entirety of which is incorporated herein by reference.

[0002] The present disclosure generally relates to computer-implemented systems and methods for reducing risks associated with network communication for an organization.

[0003] Networks can involve electronic sharing of content. Systems and methods are desirable that can analyze data to reduce risks for an organization in connection with electronic sharing of content with sources external to the organization.

[0004] In one aspect, variable information is extracted from network activity log data on a processing device. The network activity log data includes a content access request from a user in an organization for a network content source. The variable information includes a number of times that content from the network content source has been requested, a volume of organization users that have made a request for content from the network content source, and a period of time for which traffic with respect to the network content source has been detected. The variable information is scored to generate a risk score that indicates for the organization a relative risk associated with the network content source. An access control level is determined for the network content source based on the risk score and a content access policy for the organization. Access of the user in the organization to the network content source is controlled according to the access control level.

[0005] In another aspect a system includes a server device. The server device includes a processor and a non-transitory computer-readable storage medium containing instructions which when executed on the processor cause the processor to perform operations. The operations include:

[0006] extracting variable information from network activity log data that includes a content access request from a user in an organization for a network content source, the variable information including a number of times that content from the network content source has been requested, a volume of organization users that have made a request for content from the network content source, and a period of time for which traffic with respect to the network content source has been detected;

[0007] scoring the variable information to generate a risk score that indicates for the organization a relative risk associated with the network content source;

[0008] determining an access control level for the network content source based on the risk score and a content access policy for the organization; and

[0009] controlling access of the user in the organization to the network content source according to the access control level.

[0010] In another aspect, a computer-program product tangibly embodied in a non-transitory machine readable storage medium is provided that includes instructions configured to cause a data processing apparatus to:

[0011] extract variable information from network activity log data that includes a content access request from a user in an organization for a network content source, the variable information including a number of times that content from the network content source has been requested, a volume of organization users that have made a request for content from the network content source, and a period of time for which traffic with respect to the network content source has been detected;

[0012] score the variable information to generate a risk score that indicates for the organization a relative risk associated with the network content source;

[0013] determine an access control level for the network content source based on the risk score and a content access policy for the organization; and

[0014] control access of the user in the organization to the network content source according to the access control level.

[0015] The details of one or more aspects and examples are set forth in the accompanying drawings and the description below. Other features and aspects will become apparent from the description, the drawings, and the claims.

[0022] Certain aspects include systems and methods for reducing risks associated with network usage, such as accessing content from Internet domain addresses and/or email. Risks may include executable content included in a webpage or email that may deliver malware, spyware, or other undesirable programming to a device within an organization's network. Reducing risk of user browsing and emailing habits, for example, can be achieved at least in part by analyzing Internet browsing and emailing habits of an organization's users (e.g., employees) by way of traffic logs. A safety or risk rating of an internet domain/email sender can be derived by evaluating certain factors determined from the traffic logs. Such factors may include (A) the number of times that users within the organization made requests to the domain/sender, (B) the volume of users within the organization making a request to the domain/sender, and (C) the period of time that requests by users within the organization to the domain/sender have been made.

[0023] By statistically analyzing the factors, a relative score can be derived for an Internet domain (or an email sender or recipient as the case may be). The score can be leveraged in conjunction with existing policy enforcement points, such as proxy servers, to take a defined action. The action can include allowing access to the domain/sender but limiting content that users within the organization are able to receive from the domain/sender until the score associated with the domain/sender increases. For example, users within an organization can be incentivized to access a domain even though the accessible content from that domain might be limited so that the domain will be considered “safe” such that attempting to circumvent security by the user is unnecessary. In some aspects, a score can be computed for a domain and the action can be applied substantially in real time with respect to a request from a user within the organization to that domain.

[0024] A domain can be perceived to be risky at first, but can be later considered “safe” by, for example, more users within an organization accessing the domain over time. For example, the system can ascertain over time with a relatively high degree of assurance that a domain is of higher risk (e.g., not accessed often, accessed only by a few users within the organization, and only over a short period of time) or of less risk (e.g., accessed often by many users within the organization over a longer period of time). Defenses to risks can be driven in part by group dynamics of users within an organization. Systems according to some aspects can evaluate risk according to a number of users within the organization without necessarily being so intrusive as using reports with the exact content accessed by the user.

[0025] By leveraging analysis through an automated system, an organization may be able to restrict active content from a domain or email sender dynamically, thereby reducing the organization's risk exposure. The analysis and scoring for domains and emails can be different for different organizations, depending on what is “known” within an organization and desired policies for an organization. For example, domains frequently accessed by users within organization A may not be accessed, typically, by users within organization B, such as those same domains may be scored lower for organization B. Furthermore, one organization may require domains to be accessed for a longer period of time than another organization before such domains are considered “safe.”

[0026] FIG. 1 is an example of an environment in which certain aspects may be implemented using a data analysis system 102. The data analysis system 102 may be for an organization and can communicate via wireline and/or wireless communication with organization devices used by users within the organization. The organization devices as shown in FIG. 1 include a computer 104, a laptop 106, a mobile computing device 108, and a tablet computer 110. Other types of devices can be used. The data analysis system 102 can communicate through a network 112 with network content sources, such as web server devices 114a-n and email devices 116a-n, that are external to the organization. The web server devices 114a-n can provide web pages that include content in response to requests from users of the organization devices. The email devices 116a-n can provide emails that include content to users of the organization devices. The data analysis system 102 can analyze traffic between the organization devices and the web server devices 114a-n and email devices 116a-n, and may be configured to perform actions such as limiting content that is delivered to organization devices within the organization.

[0027] The data analysis system 102 can include one device or multiple devices that together analyze network activity data and control access to network content sources based on relative risks. FIG. 2 depicts an example of the data analysis system 102 that includes multiple servers. The servers include a content server 202, a log server 204, an analytic server 206, and an enforcement server 208. The content server 202 can receive requests from organization users for content from network content sources. The log server 204 can determine variable information from log data, including the requests for content, received from the content server 202. The analytic server 206 can generate risk scores from the variable information. The enforcement server 208 can determine access control levels for the network content sources based on the risk scores.

[0028] FIG. 3 depicts a block diagram with an example of the analytic server 206. Other implementations may be utilized, such as implementations that include multiple devices, each configured for performing selected functions.

[0029] The analytic server 206 includes a processor 302 that can execute code stored on a tangible computer-readable medium in a memory 304, to cause the analytic server 206 to perform functions. The analytic server 206 may include any device that can process data and execute code that is a set of instructions to perform functions. Examples of the devices include a database server, a web server, desktop personal computer, a laptop personal computer, a server device, a handheld computing device, and a mobile device.

[0030] Examples of the processor 302 include a microprocessor, an application-specific integrated circuit (ASIC), a state machine, or other suitable processor. The processor 302 may include one processor or any number of processors. The processor 302 can access code stored in the memory 304 via a bus. The memory 304 may be any non-transitory computer-readable medium configured for tangibly embodying code and can include electronic, magnetic, or optical devices. Examples of the memory 304 include random access memory (RAM), read-only memory (ROM), a floppy disk, compact disc, digital video device, magnetic disk, an ASIC, a configured processor, or other storage device.

[0031] Instructions can be stored in the memory 304 as executable code. The instructions can include processor-specific instructions generated by a compiler and/or an interpreter from code written in any suitable computer-programming language. The instructions can include one or more applications, such as an analytic engine 306, that, when executed by the processor 302, can cause the analytic server 206 to perform functions. The analytic engine 306 can be executed for scoring variable information (i.e., factors) in accordance with an organization's security policy. Also included in memory 304 may be a datastore 308 that can store information received by the analytic server 206 and information derived by the analytic server 206.

[0032] Each of the content server 202, log server 204, and enforcement server 208 may be similar to the analytic server 206 of FIG. 3. The content server 202 may include a content request engine that generates logs including content requests and associated information. The log server 204 can include an intelligence engine that can derive variable information from the logs. The enforcement server 208 can include an action engine that can limit access to content from a network content source based on a risk score.

[0033] FIG. 4 is a data flow diagram that includes an example of processes of the data analysis system 102 in connection with an organization user request for content from a network content source. The data flow diagram is described with reference to FIGS. 1-3, but other implementations can be used.

[0034] A content access request 402 from an organization device controlled by an organization user can be received by the content server 202 in the data analysis system 102. The content access request 402 may be a request for content from a web server device or for email from an email device and can include the username of the organization user making the request.

[0035] The content server 202 performs a process 404 of forming activity log data using the content access request. The activity log data 406 can include network activity for users within the organization. Network activity can include requests for web content and/or requests for receiving emails from sources outside of the organization. In some aspects, the content server 202 generates the activity log data 406 as flat file proxy activity logging data.

[0036] The log server 204 performs a process 408 of extracting variable information from activity log data. Variable information 410 can include the number of times that content from the network content source has been requested, the volume of organization users that have made a request for content from the network content source, and a period of time for which traffic with respect to the network content source has been detected.

[0037] FIG. 5 depicts a data flow diagram of an example of a process for extracting variable information from activity log data. The activity log data can include current activity log data 502 and historical activity log data 504. The current activity log data 502 may be network activity substantially contemporaneous to process, or otherwise the most current request for content from the network content source. The historical activity log data 504 may be network activity that has occurred previously for a pre-set amount of time prior to the most current request for content from the network content source.

[0038] The log server 204 performs a process 506 of sorting the activity log data. For example, the log server 204 can execute filtering process on the activity log data to identify the activity log data associated with the same network content source as the network content source from which content is currently being requested. The output of the sorting process may be data attributes about the network content source, such as the domain name and Internet Protocol (“IP”) address of the network content source (or identification of the email sender or recipient, as the case may be) 508, usernames of the organization users that have or are requesting content from the network content source 510, and the times and dates of the requests 512.

[0039] The log server 204 performs a process 514 of determining variable information from the data attributes. The variable information can include the number of times content is requested from the network content source such as the web domain or email sender 516, the volume of users requesting content from the network content source 518, and the period of time for which network traffic is detected for the network content source 520. Other types of variable information, such as whether a domain was accessed using the domain name or an IP address inserted into a web browser, may alternatively or also be derived. The log server 204 may derive the variable information from the data attributes by, for example, applying fuzzy logic or another data analytic process to the data attributes.

[0040] Returning to FIG. 4, the analytic server 206 performs a process 412 of scoring the variable information to generate a risk score 414. In some aspects, the risk score 414 is determined by multiplying each type of variable information by a pre-selected weight and then multiplying each type of weighted variable information. The analytic engine 306 of the analytic server 206 can score the variable information in accordance with a security policy of an organization that may specify, for example, the relative weight that should be applied to each type of variable information. The score can be used to assess the relative safety of the domain, email sender, or other type of network content source.

[0041] The enforcement server 208 performs a process 418 of determining a content access level for the network content source based on the risk score 414 and a content access policy 416 of the organization. The content access level can include allowing full access to content from the network content source, allowing access to some, but not all, content from the network content source, or preventing access to content from the network content source. The content access policy 416 may specify a risk threshold of the organization. In some aspects, the content access level is determined by comparing the risk score 414 to the risk threshold in the content access policy 416 of the organization. The enforcement server 208 can output a content access control command 420 that can implement the content access level for the network content source, such as by limiting the content that the organization user can receive from the network content source.

[0042] In some aspects, many users making requests to a network content source over the course of a significant amount of time can result in the data analysis system 102 determining that the network content source is a safe content source such that full access to content from the network content source is allowed for users within the organization. A network content source may be initially classified as unsafe such that the data analysis system 102 limits the content that an organization user can receive from the network content source. At a later time, the score for the network content source may change based on the values of the one or more of the types of variables and cause the classification of the network content source to change to “safe,” such that the data analysis system 102 allows all or most content to be received from the network content source.

[0043] FIG. 6 is a risk pyramid depicting an example of a continuum of safety that may be associated with a network content source outside of an organization's network. As the number of users requesting the network content source increases, the volume of users requesting the network content source increases, and the amount of time, such as the number of days, during which the network content source is accessed increases, the network content source can be classified from more risk, to less risk, and then to a safe classification. The data analysis system 102 can limit content from being received from the network content source at a level that depends on the risk level associated with the network content source. For example, if the network content source is classified as highly risky (e.g., at the bottom of the continuum), more content and more types of content can be prevented from being received from the network content source as compared to a network content source that is classified as less risky, but not yet as a safe network content source.

[0044] Each of the types of variables may have a different slope than the linear slopes represented in the pyramid. The slope, for example, can represent the weighting that can be applied to the factors based on an organization's access policy, which may associate more weight to one type of variable than other types of variables. For example, a type of variable associated with a low weight may have a steeper slope such that less extensive increases are needed for that type of variable for a network content source to become closer to being classified as a safe network content source. The weight can be equated to the relative risk tolerance on an organization-by-organization basis.

[0045] In some aspects, an increase in all three types of variables is needed for a network content source to become closer to being classified as a safe network content source. For example, an increase in the number of times that a network content source is requested and in the volume of users requesting the network content source without an increase in the period of time for such requests may not improve the relative risk rating for the network content source. Furthermore, a network content source may also become more risky over time if, for example, levels in one or more of the types of variables decreases.

[0046] Certain aspects of the subject matter and the functional operations described in this specification can be implemented in digital electronic circuitry, or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structural equivalents, or in combinations of one or more of them. Certain aspects of the subject matter described in this specification can be implemented as one or more computer program products, i.e., one or more modules of computer program instructions encoded on a computer readable medium for execution by, or to control the operation of, data processing apparatus.

[0047] The computer readable medium can be a machine readable storage device, a machine readable storage substrate, a memory device, a composition of matter effecting a machine readable propagated communication, or a combination of one or more of them. The term “data processing device” encompasses all apparatus, devices, and machines for processing data, including by way of example a programmable processor, a computer, or multiple processors or computers. The device can include, in addition to hardware, code that creates an execution environment for the computer program in question, e.g., code that constitutes processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more of them.

[0048] A computer program (also known as a program, software, software application, script, or code), can be written in any form of programming language, including compiled or interpreted languages, and it can be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. A computer program does not necessarily correspond to a file in a file system. A program can be stored in a portion of a file that holds other programs or data (e.g., on or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files that store one or more modules, sub programs, or portions of code). A computer program can be deployed to be executed on one computer or on multiple computers that are located at one site or distributed across multiple sites and interconnected by a communication network.

[0049] The processes and logic flows described in this specification can be performed by one or more programmable processors executing one or more computer programs to perform functions by operating on input data and generating output. The processes and logic flows can also be performed by, and a device can also be implemented as, special purpose logic circuitry, e.g., an FPGA (field programmable gate array) or an ASIC.

[0050] Processors suitable for the execution of a computer program include, by way of example, both general and special purpose microprocessors, and any one or more processors of any kind of digital computer. Generally, a processor will receive instructions and data from a read only memory or a random access memory or both. The essential elements of a computer are a processor for performing instructions and one or more memory devices for storing instructions and data. Generally, a computer will also include, or be operatively coupled to receive data from or transfer data to, or both, one or more mass storage devices for storing data, e.g., magnetic, magneto optical disks, or optical disks. However, a computer need not have such devices. Moreover, a computer can be embedded in another device, e.g., a mobile telephone, a personal digital assistant (PDA), a mobile audio player, a Global Positioning System (GPS) receiver, to name just a few. Computer readable media suitable for storing computer program instructions and data include all forms of nonvolatile memory, media, and memory devices, including by way of example semiconductor memory devices, e.g., EPROM, EEPROM, and flash memory devices; magnetic disks, e.g., internal hard disks or removable disks; magneto optical disks; and CD ROM and DVD ROM disks. The processor and the memory can be supplemented by, or incorporated in, special purpose logic circuitry.

[0051] To provide for interaction with a user, certain aspects of the subject matter described in this specification can be implemented on a computer having a display device, e.g., a CRT (cathode ray tube) to LCD (liquid crystal display) monitor, for displaying information to the user and a keyboard and a pointing device, e.g., a mouse or a trackball, by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback, e.g., visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any from, including acoustic, speech, or tactile input.

[0052] Certain aspects of the subject matter described in this specification can be implemented in a computing system that includes a back end component, e.g., as a data server, or that includes a middleware component, e.g., an application server, or that includes a front end component, e.g., a client computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the subject matter described in this specification, or any combination of one or more such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication, e.g., a communication network. Examples of communication networks include a local area network (“LAN”) and a wide area network (“WAN”), e.g., the Internet.

[0053] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client server relationship to each other.

[0054] While this specification contains many specifics, these should not be construed as limitations on the scope or of what may be claimed in an application or patent claiming priority hereto or otherwise, but rather as descriptions of features specific to particular aspects. Certain features that are described in this specification in the context or separate aspects can also be implemented in combination in a single implementation. Conversely, various features that are described in the context of a single aspect can also be implemented in multiple aspects separately or in any suitable subcombination. Moreover, although features may be described above as acting in certain combinations and even initially claimed as such, one or more features from a claimed combination can in some cases be excised from the combination, and the claimed combination may be directed to a subcombination or variation of a subcombination.

[0055] Similarly, while operations are depicted in the drawings in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed, to achieve desirable results. In certain circumstances, multitasking and parallel processing may be advantageous. Moreover, the separation of various system components in the aspects and examples described above should not be understood as requiring such separation in all aspects and examples, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.