Patent ID: 11949704
Assignee: FORESCOUT TECHNOLOGIES, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 15:
16. A data communication network comprising:
an intrusion detection system configured to:
parse data traffic associated with a first host and a second host connected to the data communication network to extract protocol field values of a protocol message of the data traffic, the data traffic providing a link forming a network communication between the first host and the second host, wherein no stimulus is injected into the data communication network;
derive, from the extracted protocol field values, attribute values of attributes of one of the first host, the second host, and the link;
select, from a set of models, a model relating to the one of the first host, the second host, and the link, wherein the selected model comprises a plurality of attributes to describe the one of the first host, the second host, and the link, wherein at least one of the attributes is a semantic attribute, the semantic attribute expressing a semantic meaning for the one of the first host, the second host, and the link;
update the selected model with the derived attribute values, in response to the derived attribute values not being featured in the selected model relating to the one of the first host, the second host and the link;
assess whether the updated, selected model complies with a set of attribute-based policies, each attribute-based policy of the set of attribute-based policies defining a security constraint of the data communication network based on at least one of the attributes of the first host, the second host or the link; and
generate an alert signal in case the attribute-based policies indicate that the updated, selected model violates at least one of the attribute-based policies.