Patent ID: 9609018
Date: 2017-03-28
CPC Classifications: H04L

Claim:
1. A system for controlling the impact of improper network activity on the operations of a wide area network, comprising: a plurality of service provider devices, each service provider device configured to provide communications and data transfer services to a plurality of potential target devices associated with the service provider device, wherein each service provider device includes a policy agent element or process; one or more security service devices, wherein the policy agent element or process of each of the plurality of service provider devices is communicatively coupled to at least one of the one or more of the security service devices; wherein each policy agent element or process is configured to detect an improper network event, and in response to provide the security service device or devices to which it is communicatively coupled with data relating to the improper network event; wherein each of the one or more security service devices is configured to forward received data relating to an improper network event to one or more of the policy agent elements or processes that are communicatively coupled to the security service device, thereby providing the data relating to the improper network event to each service provider device that includes one of the one or more of the policy agent elements or processes that are communicatively coupled to the security service device; wherein upon receipt of the data relating to the improper network event, the policy agent elements or processes are configured to cause the service provider device with which they are associated to inhibit the transfer of traffic intended for a target device identified by the data; wherein each of the policy agent elements or processes is further configured to send metadata for each message caused to be inhibited to the security service device to which it is communicatively coupled, and further, wherein that security service device is further configured to analyze the metadata sent by the policy agent elements or processes and to identify infected devices based at least in part on the metadata, and; wherein the policy agent elements or processes are configured to block access by the identified infected devices to the service provider device with which the policy agent elements or processes are associated.