Patent ID: 7634809

Claim:
A method of monitoring an enterprise network, comprising: retrieving metadata describing the enterprise network from the Internet, wherein the metadata comprises domain name system (DNS) records describing the enterprise network; analyzing the metadata describing the enterprise network, the analyzing comprising analyzing one or more of the DNS records to identify a set of sanctioned servers on the enterprise network; generating a security profile responsive to the metadata, the security profile describing an expected usage of the enterprise network and identifying the set of sanctioned servers on the enterprise network; analyzing traffic on the enterprise network using the security profile to determine whether the traffic indicates that an unsanctioned server is operating on the enterprise network; and reporting an indication of an unsanctioned server operating on the enterprise network, the reporting comprising retrieving configuration information from the security profile describing an action to take responsive to the indication of the unsanctioned server, the action including one or more of: blocking traffic to the unsanctioned server; blocking traffic from the unsanctioned server; and interacting with a network device to secure the network.