Abstract: Embodiments disclosed herein provide a control device and a method executing thereon for allocating network bandwidth to users accessing a controlled network. In response to a user connecting to the control device using a user device, the control device obtains a user bandwidth allocation profile for that user based on user credentials. The user bandwidth allocation profile may be stored local or remote to the control device. A provisioning module running on the control device can map attributes in the user bandwidth allocation profile to a traffic control rule and associate the traffic control rule with the user based on the user credentials and considering information identifying the user device used by the user to connect to the control device. A traffic conditioning module running on the control device can regulate the network bandwidth usage by the user utilizing the traffic control rule associated with the user.

Abstract: Embodiments of systems and methods for detecting aberrant network behavior are disclosed. One embodiment comprises a network interface over which network communications are received from a client. These network communications can then be analyzed to determine if aberrant network behavior is occurring with respect to the client.

Abstract: Embodiments disclosed herein provide systems and methods for provisioning network access for a user in order to provide access control to one or more networks with regard to the user. More particularly, a user may be authenticated and, based on a user profile associated with the authenticated user, provisioning rules may be established for the user such that the user's network access to one or more networks may be controlled based upon the user profile associated with the user. In a network utilized by multiple users, the use of access control based on user profiles associated with the users may prevent any one user or users from accessing one or more networks to the exclusion or detriment of other users because each user may be limited to the network resources provisioned to that user based on the user profile associated with the user.

Abstract: Embodiments disclosed herein provide a system, method, and computer program product for establishing a secure network connection between two computers, a client and a server. The client may send a connection request over a public network to the server. In response, the server may generate a set of credentials, select a controller to automatically run on the client, and send the controller and the set of credentials to the client. The controller automatically executes on the client and utilizes the set of credentials from the server to establish a secure network connection with the server without user intervention. The set of credentials is valid until the secure network connection between the client and the server is severed.

Abstract: A system and method for detecting aberrant network behavior. One embodiment provides a system of detecting aberrant network behavior behind a network access gateway comprising a processor, a first network interface coupled to the processor, a second network interface coupled to the processor, a storage media accessible by the processor and a set of computer instructions executable by the processor. The computer instructions can be executable to observe network communications arriving at the first network interface from multiple clients and determine when the traffic of a particular client is indicative of malware infection or other hostile network activity.

Abstract: One embodiment creates a model of the traffic through a network firewall and uses that model to dynamically manipulate the network firewall. The firewall model defines nodes, connections between the nodes, and firewall rules applicable to the nodes, the connections between the nodes, or a combination thereof. Each of the nodes represents simultaneously a source and a destination for data packets. The firewall rules include dynamic chains of rules having defined places where firewall rules may be dynamically inserted into or deleted from the firewall while the firewall is operating on one or more machines connected to network segments where the nodes reside.

Abstract: A system and method for detecting aberrant network behavior. One embodiment provides a system of detecting aberrant network behavior behind a network access gateway comprising a processor, a first network interface coupled to the processor, a second network interface coupled to the processor, a storage media accessible by the processor and a set of computer instructions executable by the processor. The computer instructions can be executable to observe network communications arriving at the first network interface from multiple clients and determine when the traffic of a particular client is indicative of malware infection or other hostile network activity.