Patent ID: 7237267

Claim:
A policy-based network security management system, the system comprising: a security management controller comprising one or more processors; a computer-readable medium carrying one or more sequences of instructions for policy-based network security management, wherein execution of the one or more sequences of instructions by the one or more processors causes the one or more processors to perform the steps of: receiving a set of data regarding a user of a network, wherein the set of data is a first set of data that is collected over a first duration of time; receiving a second set of data that is collected over a second duration of time, wherein the first duration of time is shorter than the second duration of time; creating and storing a risk level of the user based on the second set of data, wherein the second duration of time is sufficient to collect historical data regarding past malicious activities of the user, and wherein the risk level is a discrete value representing a long-term measurement of the likelihood of the user harming the network; creating and storing a current alert level based on the first set of data, wherein the first duration of time is of a length appropriate for assessing current activities of the user, and wherein the current alert level is a discrete value representing a current measurement of the likelihood of the user negatively affecting the network; automatically deciding on a course of action based on the risk level and the current alert level, wherein the course of action may be adverse to the user although the current alert level is insufficient to establish whether the user is performing a malicious action; and sending signals to one or more network elements in the network to implement the course of action.