Patent Document ID: 20170195351
Application ID: 15462840
Patent Status: 0

Claim One:
1. A method comprising: maintaining, by a monitoring unit executing on a network security device protecting a private network, a plurality of policies in a form of rules, wherein each policy of the plurality of policies specifies a behavior and a corresponding score; maintaining, by the monitoring unit, a current reputation score for each monitored client device of a plurality of monitored client devices within the private network by: observing, by the monitoring unit, network traffic associated with the monitored client device, including a plurality of network interactions or attempted network interactions between the monitored client device and one or more resources within the private network or one or more resources external to the private network; and updating, by the monitoring unit, the current reputation score for the monitored client device, by determining a score for the network traffic based upon a matching policy of the plurality of polices and revising the current reputation score based upon the current reputation score and the determined score; and when the current reputation score for a particular monitored client device of the plurality of monitored client devices meets a predetermined threshold, classifying, by the monitoring unit, the particular monitored client device as potentially being malicious.