NETWORK SECURITY INDICATOR OF COMPROMISE BASED ON HUMAN CONTROL CLASSIFICATIONS

摘要

In one embodiment, a service classifies a device in a network as human-controlled or self-controlled. The service also classifies an online resource as designed for access by human-controlled devices or by self-controlled devices. The service obtains traffic data regarding an attempt by the device to access the online resource via the network. The service determines that the attempt by the device to access the online resource is a security violation, based on the classifications of the device and the online resource. The service initiates a mitigation action in the network for the security violation.