Abstract: A method including determining, by a virtual private network (VPN) server providing VPN services to one or more user devices, an average threshold level associated with an aggregate amount of VPN data communicated with a host device during a reference period; determining, by the VPN server, an observed average aggregate amount of VPN data communicated with the host device during an operation period; comparing, by the VPN server, the observed average aggregate amount with the average threshold level; and selectively transmitting, by the VPN server, a notification to the one or more devices indicating that the one or more user devices is to manage transmission of data from the one or more user devices based at least in part on a result of comparing the observed average aggregate amount with the average threshold level. Various other aspects are contemplated.

Abstract: A method determining, by an infrastructure device in communication with a user device, authentic feature information that indicates a characteristic associated with an authentic feature included in an authentic communication associated with an authentic entity, with which the user device intends to communicate over a network; and transmitting, by the infrastructure device to the user device, authentic entity information that includes the authentic feature information and an association between the characteristic associated with the authentic feature and authentic communication information associated with the authentic communication. Various other aspects are contemplated.

Abstract: A method comparing, by a user device, an observed characteristic with a determined characteristic, the observed characteristic indicating a current feature included in a current communication associated with a current entity with which the user device is communicating and the determined characteristic indicating an authentic feature included in an authentic communication associated with an authentic entity with which the user device intends to communicate; selectively matching, by the user device based on a result of comparing the observed characteristic with the determined characteristic, current communication information associated with the current communication with authentic communication information associated with the authentic communication; and determining, by the user device based on a result of selectively matching the current communication information with the authentic communication information, that the current entity is the authentic entity or that the current entity is not the authentic entity.

Abstract: A method including configuring a virtual private network (VPN) server to determine, while providing VPN services to one or more user devices, an aggregate amount of VPN data communicated by the VPN server with a host device; and configuring the VPN server to transmit VPN data information indicating the aggregate amount of VPN data communicated by the VPN server with the host device. Various other aspects are contemplated.

Abstract: A method including determining aggregate amounts of VPN data communicated by VPN servers with a host device during sample durations of time within a reference period; determining difference amounts indicating differences in the aggregate amounts of VPN data communicated by VPN servers with the host device during successive sample durations of time; determining average aggregate amounts of VPN data communicated by VPN servers with the host device based at least in part on averaging the difference amounts; determining a largest average aggregate amount, from among the average aggregate amounts, as an average threshold level; and selectively adjusting an amount of VPN data communicated by VPN servers with the host device based at least in part on a result of comparing the average threshold level with an observed average aggregate amount of VPN data communicated by VPN servers with the host device. Various other aspects are contemplated.

Abstract: A method including determining, by a virtual private network (VPN) server providing VPN services to one or more user devices, an aggregate amount of VPN data communicated by the VPN server with a host device; and transmitting, by the VPN server to an infrastructure device, VPN data information indicating the aggregate amount of VPN data communicated by the VPN server with the host device. Various other aspects are contemplated.

Abstract: A method including determining, by an infrastructure device associated with a virtual private network (VPN), an average threshold level associated with an aggregate amount of VPN data communicated by one or more VPN servers with a host device during a reference period; determining, by the infrastructure device, an observed average aggregate amount of VPN data communicated by the one or more VPN servers with the host device during an operation period; comparing, by the infrastructure device, the observed average aggregate amount with the average threshold level; and selectively adjusting, by the infrastructure device, an amount of VPN data communicated by the one or more VPN servers with the host device during the operation period based at least in part on a result of comparing the observed average aggregate amount with the average threshold level. Various other aspects are contemplated.

Abstract: A method including configuring a VPN server to determine aggregate amounts of VPN data communicated with a host device during sample durations of time within a reference period; configuring the VPN server to determine difference amounts indicating differences in the aggregate amounts of VPN data communicated with the host device during successive sample durations of time; configuring the VPN server to determine average aggregate amounts of VPN data communicated with the host device based at least in part on averaging the difference amounts; configuring the VPN server to determine a largest average aggregate amount as an average threshold level; and configuring the VPN server to selectively adjust an amount of VPN data communicated with the host device based at least in part on a result of comparing the average threshold level with an observed average aggregate amount of VPN data communicated with the host device. Various other aspects are contemplated.

Abstract: A method including determining, by a virtual private network (VPN) server providing VPN services to one or more user devices, an average threshold level associated with an aggregate amount of VPN data communicated with a host device during a reference period; determining, by the VPN server, an observed average aggregate amount of VPN data communicated with the host device during an operation period; comparing, by the VPN server, the observed average aggregate amount with the average threshold level; and selectively adjusting, by the VPN server, an amount of VPN data communicated with the host device during the operation period based at least in part on a result of comparing the observed average aggregate amount with the average threshold level. Various other aspects are contemplated.

Abstract: A method including transmitting, by an infrastructure device to a user device, a determined characteristic of an authentic feature included in an authentic network communication associated with an authentic entity, with which the user device intends to communicate over a network; determining, by the user device, an observed characteristic of a current feature included in a current network communication associated with a current entity with which the user device is communicating over the network; comparing, by the user device, the observed characteristic with the determined characteristic; and determining, by the user device, that the current network communication is authentic or that the current network communication is not authentic based at least in part on a result of comparing the observed characteristic with the determined characteristic. Various other aspects are contemplated.

Abstract: A method including operating, by an infrastructure device, a port associated with a server in a deactivated mode; receiving, by the infrastructure device, a communication from a user device in association with obtaining communication services from the server; pre-authenticating, by the infrastructure device, the user device for obtaining the communication services based at least in part on information indicated in the communication; and operating, by the infrastructure device, the port associated with the server in an activated mode to enable the user device to establish a connection with the server based at least in part on pre-authenticating the user device. Various other aspects are contemplated.

Abstract: A method including determining, by a VPN server having established VPN connections with one or more user devices, aggregate amounts of VPN data communicated with a host device; determining difference amounts indicating differences in the aggregate amounts of VPN data communicated with the host device; determining average aggregate amounts of VPN data communicated with the host device based at least in part on averaging the difference amounts; determining a largest average aggregate amount as an average threshold level; and selectively transmitting a notification to the one or more devices indicating that the one or more user devices is to manage transmission of data from the one or more user devices based at least in part on a result of comparing the average threshold level with an observed average aggregate amount of VPN data communicated with the host device during an operation period. Various other aspects are contemplated.

Abstract: A method including determining, by a VPN server, aggregate amounts of VPN data communicated with a host device during sample durations of time within a reference period; determining, by the VPN server, difference amounts indicating differences in the aggregate amounts of VPN data communicated with the host device during successive sample durations of time; determining, by the VPN server, average aggregate amounts of VPN data communicated with the host device based on averaging the difference amounts; determining, by the VPN server, a largest average aggregate amount, from among the average aggregate amounts, as an average threshold level; and selectively adjusting, by the VPN server, an amount of VPN data communicated with the host device based at least in part on a result of comparing the average threshold level with an observed average aggregate amount of VPN data communicated with the host device. Various other aspects are contemplated.

Abstract: Alert manager software dynamically assembles a security alert as various security scenarios are tested to reach a verdict. Each executed scenario may contribute a scenario-specific message, so the resulting compound security alert indicates an actual line of reasoning used in reaching the respective verdict. The described systems and methods apply, inter alia, to the analysis of high-volume network flows in corporate networks. In some embodiments, flows are pre-tagged with extra metadata to facilitate detection of malware and/or intrusion.

Abstract: A system and method for preparing network flows for analysis by decomposing such flows into a plurality of elements which are then tagged. Tagged elements may optionally comprise any type of element according to any type of network flow standard, including but not limited to the IPFIX or Netflow standards, or may optionally be derived from such elements.

Abstract: Alert manager software dynamically assembles a security alert as various security scenarios are tested to reach a verdict. Each executed scenario may contribute a scenario-specific message, so the resulting compound security alert indicates an actual line of reasoning used in reaching the respective verdict. The described systems and methods apply, inter alia, to the analysis of high-volume network flows in corporate networks. In some embodiments, flows are pre-tagged with extra metadata to facilitate detection of malware and/or intrusion.

Abstract: A system and method for preparing network flows for analysis by decomposing such flows into a plurality of elements which are then tagged. Tagged elements may optionally comprise any type of element according to any type of network flow standard, including but not limited to the IPFIX or Netflow standards, or may optionally be derived from such elements.