US 12,261,822 B2
Network threat prediction and blocking
Hal Lonas, Broomfield, CO (US); David Dufour, Broomfield, CO (US); Chip Witt, Broomfield, CO (US); and Patrick Kar Yin Chang, San Jose, CA (US)
Assigned to OPEN TEXT INC., Menlo Park, CA (US)
Filed by Open Text Inc., Menlo Park, CA (US)
Filed on May 7, 2020, as Appl. No. 16/868,669.
Application 16/868,669 is a continuation of application No. 14/745,637, filed on Jun. 22, 2015, granted, now 10,686,759.
Claims priority of provisional application 62/015,436, filed on Jun. 22, 2014.
Prior Publication US 2020/0336459 A1, Oct. 22, 2020
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 29/06 (2006.01); H04L 9/40 (2022.01); H04L 41/069 (2022.01)
CPC H04L 63/0227 (2013.01) [H04L 63/14 (2013.01); H04L 63/1425 (2013.01); H04L 63/1441 (2013.01); H04L 41/069 (2013.01)] 19 Claims
OG exemplary drawing
 
1. A method of predicting network threats, the method comprising:
identifying a first online element as a threat vector from network activity log data based on reputation information of online elements using one or more computing devices, wherein the first online element comprises an internet protocol address;
analyzing relationship data for the threat vector, wherein the relationship data identifies associations between the threat vector and other online elements, wherein each of the other online elements are one of: a file, a uniform resource locator, and a software application;
identifying one or more of the other online elements as a predictive network threat based at least upon an association between the threat vector and the respective other online element, the identifying one or more of the other online elements comprising:
sending a request to a relationship management system, the request identifying the threat vector; and
receiving a response from the relationship management system identifying the respective other online elements; and
providing data regarding the threat vector and the one or more of the other online elements to a firewall device using the one or more computing devices, wherein the firewall blocks network activity associated with the threat vector and the one or more of the other online elements.