Network intelligence system

Abstract

A network security system takes an active approach to network security. This is accomplished by providing intelligence about other networks. A master network intelligence database is established that uses a plurality of network information agents for gathering information about networks and providing the information to the master network intelligence database. A customer network security system is then able to secure the customer network in dependence upon information received from the master network intelligence. Security information includes at least one of hostility level on the Internet, collected from numerous sites; security event history; spam levels; hosted services; public wireless; organization type; organization associations; peer ISPs; bandwidth connection to the Internet; active security measures; number of users on the network; age of the network; inappropriate content served; industry; geographic placement; open proxy servers; and contact information.

1 . A network security system for providing intelligence about other networks comprising:
 a master network intelligence database including a first communication interface;   a plurality of network information agents for gathering information about networks and providing the information to the master network intelligence database via the communication interface; and   a second communication interface for a customer network security system securing a network in dependence upon information from the master network intelligence database.   
     
     
         2 . A network security system as claimed in  claim 1  wherein the plurality of network information agents includes human network information agents. 
     
     
         3 . A network security system as claimed in  claim 1  wherein the plurality of network information agents includes automated network information agents. 
     
     
         4 . A network security system as claimed in  claim 1  wherein the plurality of network information agents includes network information agents co-located with corporate partners. 
     
     
         5 . A network security system as claimed in  claim 1  wherein the information relates to security of networks. 
     
     
         6 . A network security system as claimed in  claim 5  wherein the security information includes at least one of hostility level on the internet, collected from numerous sites; security event history; spam levels; hosted services; public wireless; organization type; organization associations; peer ISPs; bandwidth connection to the Internet; active security measures; number of users on the network; age of the network; inappropriate content served; industry; geographic placement; open proxy servers; contact information; spoken language; current security audits; desktop security measures; time zone; and security personnel. 
     
     
         7 . A network security system as claimed in  claim 3  wherein the network information agents include means for probing information sources on the Internet and feedings that information into the master network intelligence. 
     
     
         8 . A network security system as claimed in  claim 7  wherein the network information agents comprise content search information agents for reading through newsgroups and gleaning information therefrom. 
     
     
         9 . A network security system as claimed in  claim 7  wherein the network information agents comprise active probing information agents for sending packets to remote networks and gleaning information from the responses received to those packets. 
     
     
         10 . A network security system as claimed in  claim 7  wherein the master network intelligence database establishes reputations for networks in dependence upon information provided thereto. 
     
     
         11 . A network security system as claimed in  claim 10  wherein the information from the master network intelligence database comprise reputations of networks. 
     
     
         12 . A network security system for providing intelligence about other networks comprising:
 a master network intelligence database including first and second communication interfaces;   a plurality of network information agents for gathering information about networks and providing the information to the master network intelligence database via the first communication interface; and   a customer network security system for securing a network in dependence upon information received from the master network intelligence database via the second communication interface.   
     
     
         13 . A network security system as claimed in  claim 12  wherein the customer network security system includes a customer network intelligence database having an interface for communication with the second interface. 
     
     
         14 . A network security system as claimed in  claim 13  wherein the customer network security system includes a policy enforcer for developing rules in dependence upon information from the customer network intelligence database and pushing rules to the customer network devices. 
     
     
         15 . A network security system as claimed in  claim 14  wherein the customer network security system includes a plurality of network information agents for gathering information from the customer network devices. 
     
     
         16 . A network security system as claimed in  claim 12  wherein the plurality of network information agents includes human network information agents. 
     
     
         17 . A network security system as claimed in  claim 12  wherein the plurality of network information agents includes automated network information agents. 
     
     
         18 . A network security system as claimed in  claim 12  wherein the plurality of network information agents includes network information agents co-located with corporate partners. 
     
     
         19 . A network security system as claimed in  claim 12  wherein the information relates to security of networks. 
     
     
         20 . A network security system as claimed in  claim 14  wherein the customer network devices include device agents. 
     
     
         21 .- 44 . (canceled)