Patent ID: 9185122
Filing Date: 2015-11-10
Classification: H04L

Abstract:
1. A method of managing security in a network, the method comprising: providing a plurality of security policies associated with a plurality of network data anomalies at a network management system, each one of the plurality of security policies defining a network data anomaly specific mitigation response for each one of the plurality of network data anomalies; detecting a first network data anomaly at the network management system; selecting a threat assessment system to assess the first network data anomaly; issuing, by the network management system, a command to a source data port where the first network data anomaly was detected to mirror network data received at the source data port to the selected threat assessment system; receiving, from the selected threat assessment system, a confirmation of the first network data anomaly; determining at the network management system whether a first one of the plurality of security policies defines a first network data anomaly specific mitigation response to the first network data anomaly; and issuing a first mitigation command from the network management system to at least one network system to implement the first network data anomaly specific mitigation response for a pre-defined period of time in accordance with the first security policy based on the determination.