Patent ID: 7886065
Filing Date: 2011-02-08
Classification: G06F,H04L

Abstract:
1. A method of providing security for a network, comprising: observing, in network traffic associated with a client computer admitted previously to the network, an activity pattern indicative of a reboot event comprising a portion of silence followed by at least one activity associated with a reboot of the client computer, wherein observing the activity pattern comprises detecting the at least one activity based at least in part upon a predetermined reboot signature, the predetermined reboot signature comprising a set of reboot-related events that are unique to the computer client; assessing a security posture of the client computer in response to the observed activity pattern by determining whether at least one of a software installation, a software removal, a registry modification, and an operating system change has occurred on the client computer after the client computer was admitted to the network; restricting access by the client computer to the network in accordance with one or more risk level rules when assessing the security posture, wherein one of the one or more risk level rules comprises only allowing the client computer access to email resources when assessing the security posture of the client computer; and revoking the client computer's admission to the network in response to determining that at least one of the software installation, the software removal, the registry modification, and the operating system change has occurred on the client computer after the client computer was admitted to the network.