PATENT CLAIM ANALYSIS

Application Number: 15861367
Application Type: Utility
Filing Date: 2018-01
Publication Date: 2018-05
Patent Classification: ["726", "025000"]

Abstract:
Blocking high-risk IP connections in real-time while allowing tailoring of an acceptable risk profile to match the security requirements of network resources. By acquiring IP threat information about IP addresses, traffic from IP addresses posing unacceptable levels of risk is blocked. A computer executed method is disclosed for sorting a plurality of internet protocol (IP) addresses. The method includes dividing the range of IP addresses into a plurality of clusters representing a plurality of contiguous sub-ranges, assigning each IP address to the cluster associated with the sub-range that includes that IP address, and assigning the IP addresses in each cluster to one of a plurality of pages. A network appliance incorporating aspects of the method is also disclosed.

Claim (Index 17):
A system for protecting a network from a security threat in real-time, the system comprising:\n a memory storing a plurality of Internet Protocol (IP) addresses, timing information associated with each of the plurality of IP addresses, a risk category associated with each of the plurality of IP addresses, a risk confidence level associated with each of the plurality of IP addresses, and a plurality of threat information, the threat information including a determination of source characteristics and destination characteristics associated with each of the plurality of IP addresses; a graphical user interface (GUI) for displaying a plurality of risk categories associated with the plurality of IP addresses on a display, and for receiving input from a user, the input including a risk acceptance level for each of the plurality of risk categories; a non-transitory computer-readable storage medium having stored thereon computer processor-executable instructions; a threat processor executing the computer-executable instructions, said instructions comprising:\n receiving a plurality of IP addresses associated with a particular risk category from one or more internet risk intelligence providers; \n when the one or more received IP addresses are associated with more than one risk category, assigning a source/destination weighting factor for each risk category based on the source characteristics and the destination characteristics associated with the received IP addresses associated therewith; \n adjusting a confidence level for each of the received IP addresses based on the source/destination weighting factor for each risk category; \n determining an aggregate risk score for all the IP addresses based on the adjusted confidence levels; \n storing the aggregate risk score in a memory device; \n receiving an acceptable risk level for each category from the user, wherein the aggregate risk score is a function of a number of instances the risk confidence level for each of the received IP addresses has exceeded the acceptable risk level during a time interval based on the timing information associated therewith; \n comparing the stored aggregate risk score with the received acceptable risk level from the user; and \n allowing communications from any IP addresses having an acceptable risk level to pass through the network's firewall.

Metadata:
- Claim Count in Document: 41.0
- Percentile: 86.0
- Lexical Diversity: 1.75342
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['15481030', '14208998', '13855510', '12509957', '14147402']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2656565015593722
- 35 USC 102 Novelty (BERT): 0.5917034161543767
- Combined Prediction Score: 0.2982611930188726
- Mean Citation Score: 333.479642
- Max Citation Score: 505.52365
- Similarity Product: 447.120676408261

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 1
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test