In one embodiment, a device including a processor, and a memory to store data used by the processor, wherein the processor is operative to run a manufacturer usage description (MUD) controller operative to obtain a MUD profile of an Internet of Things (IoT) device from a MUD server, the MUD profile of the IoT device including: access rights of the IoT device, and any one or more of the following a default device username and/or a default device password of the IoT device, a recommended/required device password complexity of the IoT device, at least one service that should be enabled/disabled on the IoT device, and/or allowed security protocols and/or ciphers for communication to and/or from the IoT device, enforce security of the IoT device according to the MUD profile of the IoT device. Related apparatus and methods are also described.

The invention relates to an information security protection method and apparatus, and a computer-readable storage medium. The information security protection method comprises the steps of: allocating a train control and monitoring system to an intranet region, and performing region boundary security protection on the train control and monitoring system; performing communication network security protection on the train control and monitoring system; and performing terminal device security protection on the train control and monitoring system. The invention deeply integrates an application service of a train control and monitoring system, and defence-in-depth is performed on the train control and monitoring system from a plurality of dimensions such as region boundary security, communication network security and terminal device security, such that attacks initiated from an intranet and an extranet of the system can be effectively handled, and thus, the information security protection capability of the train control and monitoring system is improved.

In one embodiment, a server instructs one or more networking devices in a local area network (LAN) to form a virtual network overlay in the LAN that redirects traffic associated with a particular node in the LAN to the server. The server receives the redirected traffic associated with the particular node. The server trains a machine learning-based behavioral model for the particular node based on the redirected traffic. The server controls whether a particular redirected traffic flow associated with the node in the LAN is sent to a destination of the traffic flow using the trained behavioral model.

A detection system includes an obtainer that obtains a first log, the first log being a log of communication in a first network; a determiner that determines whether the first log obtained by the obtainer includes anomaly information indicating anomalous communication in a second network; and a controller that, when the determiner has determined that the first log includes the anomaly information, performs control of notifying of an anomaly in the second network.

Systems and methods described herein provide a cyber risk assessment service. A computing device determines weights for techniques of a cyber security framework based on historical industry impact. The computing device associates an enterprise network with an industry identifier, obtains customer risk data for the enterprise network, and normalizes and/or combines the customer risk data to form normalized risk scores. The computing device maps the customer risk data to corresponding techniques in the cyber security framework, generates technique scores based on the mapping and the normalized risk scores, and generates weighted technique scores using some of the weights selected based on the industry identifier. The computing device calculates an overall security score for the enterprise network based on the weighted technique scores, identifies a corrective recommendation for the overall security score, and provides the overall security score and the corrective recommendation for presentation to a user.

A system for monitoring the communication with a connected Internet of Things (IoT) device is provided. The system includes a first computing device including a least one processor in communication with at least one memory device. The at least one memory device stores a plurality of instructions, which when executed by the at least one processor cause the at least one processor to execute an IoT device communication application. The IoT device communication application monitors the IoT device. The instructions also cause the at least one processor to store IoT device data including a current location of the IoT device, determine an optimal communication path between the IoT device communication application and the IoT device based on the IoT device data, and transfer execution of the IoT device communication application to a second computing device based on the optimal communication path.

Systems and methods for improving the catch rate of attacks/malware by a cooperating group of network security devices are provided. According to one embodiment, a security management device configured in a protected network, maintains multiple dynamic IP address lists including an NGFW deep detection list, a DDoS deep detection list, a NGFW block list and a DDoS block list. The security management device, continuously updates the lists based on updates provided by a cooperating group of network security devices based on network traffic observed by the network security devices. In response to receipt of a request from a NGFW device or a DDoS mitigation device associated with the protected network, the security management device provides the requestor with the requested dynamic IP address lists for use in connection with processing network traffic by the requestor.

In general, embodiments described herein relate to methods and systems for automating the configuration of network devices. More specifically, embodiments of the invention relate to using configuration commands that specify protocol-specified relationships in order to generate granular (or specific) filtering rules (also referred to as rules). The rules are subsequently programmed into the network device.

Systems, methods, and computer-readable media are provided for generating a unique ID for a sensor in a network. Once the sensor is installed on a component of the network, the sensor can send attributes of the sensor to a control server of the network. The attributes of the sensor can include at least one unique identifier of the sensor or the host component of the sensor. The control server can determine a hash value using a one-way hash function and a secret key, send the hash value to the sensor, and designate the hash value as a sensor ID of the sensor. In response to receiving the sensor ID, the sensor can incorporate the sensor ID in subsequent communication messages. Other components of the network can verify the validity of the sensor using a hash of the at least one unique identifier of the sensor and the secret key.

In one embodiment, a device in a network receives traffic data regarding a plurality of observed traffic flows. The device maps one or more characteristics of the observed traffic flows from the traffic data to traffic characteristics associated with a targeted deployment environment. The device generates synthetic traffic data based on the mapped traffic characteristics associated with the targeted deployment environment. The device trains a machine learning-based traffic classifier using the synthetic traffic data.