US 11,876,819 B2
Methods, systems, and devices for dynamically modeling and grouping endpoints for edge networking
Tomer Weingarten, Mountain View, CA (US); and Almog Cohen, Tel Aviv (IL)
Assigned to SENTINEL LABS ISRAEL LTD., Tel Aviv (IL)
Filed by Sentinel Labs Israel Ltd., Tel Aviv (IL)
Filed on Apr. 21, 2022, as Appl. No. 17/660,179.
Application 17/660,179 is a continuation of application No. 17/069,415, filed on Oct. 13, 2020, granted, now 11,522,894.
Application 17/069,415 is a continuation of application No. 16/525,415, filed on Jul. 29, 2019, granted, now 10,841,325, issued on Nov. 17, 2020.
Application 16/525,415 is a continuation of application No. 16/058,810, filed on Aug. 8, 2018, granted, now 10,462,171, issued on Oct. 29, 2019.
Claims priority of provisional application 62/550,439, filed on Aug. 25, 2017.
Claims priority of provisional application 62/545,917, filed on Aug. 15, 2017.
Claims priority of provisional application 62/542,288, filed on Aug. 8, 2017.
Prior Publication US 2023/0007026 A1, Jan. 5, 2023
Prior Publication US 2023/0148446 A9, May 11, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); H04L 41/046 (2022.01); H04L 41/16 (2022.01); G06F 9/445 (2018.01); G06F 8/61 (2018.01); H04L 41/0893 (2022.01); H04L 67/10 (2022.01); H04L 67/00 (2022.01); H04L 41/12 (2022.01); H04L 41/14 (2022.01)
CPC H04L 63/1425 (2013.01) [G06F 8/61 (2013.01); G06F 9/44526 (2013.01); H04L 41/046 (2013.01); H04L 41/0893 (2013.01); H04L 41/16 (2013.01); H04L 63/08 (2013.01); H04L 63/102 (2013.01); H04L 63/104 (2013.01); H04L 63/1416 (2013.01); H04L 63/1441 (2013.01); H04L 63/205 (2013.01); H04L 67/10 (2013.01); H04L 67/34 (2013.01); H04L 41/12 (2013.01); H04L 41/145 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method for protecting security of an elastic computer network, the elastic computer network comprising one or more endpoint devices and an enterprise network, the computer-implemented method comprising:
monitoring, by a central manager computing system, through each autonomous software agent of a plurality software agents operating on the one or more endpoint devices forming the elastic computer network, one or more network communications of a corresponding endpoint device to obtain endpoint data, wherein the one or more endpoint devices comprise one or more cellphones, servers, virtual machines, laptops, tablets, desktop computers, Internet of Things (IoT) devices, wearable devices, or smart home devices, wherein the one or more endpoint devices are organized into one or more logical groupings;
receiving, by the central manger computing system, the endpoint data transmitted by each software agent through an electronic communications network, wherein the endpoint data is configured to allow the central manager computing system to identify network access behaviors or processor behaviors of the one or more endpoint devices;
analyzing, by the central manager computing system, the endpoint data;
identifying, by the central manager computing system, one or more anomalous indicators on one or more endpoint devices based at least in part on the analyzed endpoint data;
transmitting, by the central manager computing system, one or more alerts through the electronic communications network, the one or more alerts based on the one or more anomalous indicators;
generating, by the central manager computing system, a visualization of one or more network characteristics related to security and network management functionalities, the generating the visualization based at least in part on the identification of the one or more anomalous indicators on the one or more endpoint devices, the visualization configured for display to a user via a dynamic user interface;
receiving, by the central manager computing system from a user via the dynamic user interface, one or more user inputs, the one or more user inputs comprising commands for responding to the one or more anomalous indicators on the one or more endpoint devices; and
responding, by the central manager computing system, to the one or more anomalous indicators based at least in part on the one or more user inputs comprising commands for responding to the one or more anomalous indicators, wherein the responding comprises limiting one or more operating system processes or network communications of the one or more endpoint devices,
wherein the one or more endpoint devices and the central manager computing system comprise one or more electronic processors and one or more electronic data stores.