US 12,225,030 B2
Identifying network entities based on beaconing activity
Jeff James Costlow, Kingston, WA (US); Michael Ryan Corder, Seattle, WA (US); Edmund Hope Driggs, Seattle, WA (US); Benjamin Thomas Higgins, Shoreline, WA (US); Michael Kerber Krause Montague, Lake Forest Park, WA (US); Kenneth Perrault, Seattle, WA (US); Jesse Abraham Rothstein, Seattle, WA (US); Jonathan Jacob Scott, Seattle, WA (US); Marc Adam Winners, Seattle, WA (US); and Xue Jun Wu, Seattle, WA (US)
Assigned to ExtraHop Networks, Inc., Seattle, WA (US)
Filed by ExtraHop Networks, Inc., Seattle, WA (US)
Filed on May 26, 2022, as Appl. No. 17/826,011.
Application 17/826,011 is a continuation of application No. 17/351,866, filed on Jun. 18, 2021, granted, now 11,349,861.
Prior Publication US 2022/0407881 A1, Dec. 22, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); H04L 43/062 (2022.01)
CPC H04L 63/1425 (2013.01) [H04L 43/062 (2013.01); H04L 63/1416 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method for monitoring communication over a network between one or more computers, with one or more network monitoring computers (NMCs) that perform actions, comprising:
determining one or more metrics based on monitoring network traffic associated with a plurality of entities in the network;
determining one or more beaconing metrics associated with beaconing activity based on the one or more metrics;
generating a profile for each entity with one or more portions of the one or more beaconing metrics associated with update activity for each entity, wherein the update activity for an entity includes an aggregated characteristic associated with a type of the entity;
employing one or more observed cadences for validation of one or more licenses by one or more unknown applications associated with the one or more entities to infer one or more types of the one or more applications and infer one or more identities for the one or more entities;
characterizing the one or more entities based on its beaconing activity, wherein the beaconing activity includes one or more of communication with one or more endpoints associated with one or more third parties;
determining anomalous activity by the one or more entities or the one or more third parties based on one or more machine learning classifiers trained on captured network traffic to recognize the anomalous activity associated with it's beaconing activity, it's update activity and it's license activity; and
generating one or more reports that include information associated with the one or more entities and its beaconing activity and the anomalous activity.