# US 10,375,094 B2 · Wireless sensor network security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,094 B2 - Document ID: US10375094B2 - Status: Granted - Kind: B2 - Application number: 15/284,621 - Filed: 2016-10-04 - Published: 2018-04-05 - Granted: 2019-08-06 - Earliest claimed: 2016-10-04 - Assignees: Hitachi, Ltd. - Applicants: Hitachi, Ltd. - Inventors: Takeshi Shibata; Sudhanshu Gaur - Web page: https://patentgrep.com/patent/US10375094B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 67/52: specially adapted for the location of the user terminal - H04L 67/56: Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) - H04L 67/563: Data redirection of data network streams - H04W 12/12: Detection or prevention of fraud - H04W 12/121: Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS] - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - G06F 2221/2151: Time stamp - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract In some examples, a computing device may receive sensed data of a first sensor sent in a first transmission. The computing device may associate a first timestamp with the sensed data. Further, the computing device may receive, from other sensors, first signal strength information including first signal strength data and a first signal property related to the first transmission, and a second timestamp corresponding to detection of the first transmission. The computing device may receive, from other sensors, second signal strength information including second signal strength data and a second signal property related to a second transmission, and a third timestamp corresponding to detection of the second transmission. When the third timestamp is later than the first timestamp and the first signal property matches the second signal property, the computing device may indicate that a sensor that sent the second transmission is associated with an anomaly. ## Claims ### Claim 1 A system comprising: one or more processors; and one or more non-transitory computer-readable media maintaining executable instructions, which, when executed by the one or more processors, program the one or more processors to perform operations comprising: receiving sensed data information sent in a data transmission from a first sensor, the sensed data information including a first sensor identifier (ID) and sensed data of the first sensor; associating a first timestamp with the sensed data information; receiving, from a second sensor, a first information transmission including first signal strength information including first signal strength data and a first signal duration related to a first detected transmission detected by the second sensor, and a second timestamp corresponding to a time of detection of the first detected transmission by the second sensor; receiving, from a third sensor, a second information transmission including second signal strength information including second signal strength data and a second signal duration related to a second detected transmission detected by the third sensor, and a third timestamp corresponding to a time of detection of the second detected transmission by the third sensor; comparing the second timestamp with the third timestamp and the first signal duration with the second signal duration; determining that the first detected transmission and the second detected transmission both correspond to a transmission sent by a same detected sensor based at least in part on the second timestamp being within a threshold time of the third timestamp and the first signal duration matching the second signal duration; based on determining that the first detected transmission and the second detected transmission correspond to the transmission sent by the same detected sensor, determining, based at least partially on the first signal strength data and the second signal strength data, an indicated location of the detected sensor; and when the indicated location of the detected sensor does not correspond to a known sensor location, indicating that the detected sensor is associated with an anomaly. ### Claim 2 (depends on 1) The system as recited in claim 1, the operations further comprising: when at least one of the second timestamp or the third timestamp is at a timing after the first timestamp, indicating that the detected sensor is associated with an anomaly. ### Claim 3 (depends on 1) The system as recited in claim 1, the operations further comprising: searching a sensor inventory data structure for a location corresponding to the indicated location of the detected sensor; and associating a second sensor ID with the indicated location based on matching a location associated with the second sensor ID in the inventory data structure with the indicated location. ### Claim 4 (depends on 1) The system as recited in claim 1, the operations further comprising: receiving, from a fourth sensor, a third information transmission including third signal strength information including third signal strength data and a third signal duration related to a third detected transmission detected by the fourth sensor, and a fourth timestamp corresponding to a time of detection of the third detected transmission by the fourth sensor; based on the fourth timestamp being within a threshold time of the second timestamp and the third timestamp, and the third signal duration matching the first signal duration and the second signal duration, determining the indicated location based on the third signal strength data in addition to the first signal strength data and the second signal strength data. ### Claim 5 (depends on 1) The system as recited in claim 1, the operations further comprising: receiving, from a fourth sensor, a third information transmission including third signal strength information including third signal strength data and a third signal duration related to a third detected transmission detected by the fourth sensor, and a fourth timestamp corresponding to a time of detection of the third detected transmission by the fourth sensor; determining a first location based at least partially on the second signal strength information; determining a second location based at least partially on the third signal strength information; and when the first location is different from the second location, and the second timestamp is within a threshold time of the fourth timestamp, indicating that a sensor associated with at least one of the first location or the second location is associated with an anomaly. ### Claim 6 (depends on 1) The system as recited in claim 1, wherein the first signal strength data is indicative of a distance from the detected sensor to the second sensor. ### Claim 7 (depends on 1) The system as recited in claim 1, the operations further comprising sending a notification to a computing device over a network indicating association of an anomaly with the detected sensor. ### Claim 8 A method comprising: receiving, by a processor, sensed data of a first sensor sent in a first data transmission; associating a first timestamp with the sensed data; receiving, from a second sensor, a first information transmission including first signal strength information including first signal strength data and a first signal duration related to a first detected transmission detected by the second sensor, and a second timestamp corresponding to a time of detection of the first detected transmission by the second sensor; receiving, from a third sensor, a second information transmission including second signal strength information including second signal strength data and a second signal duration related to a second detected transmission detected by the third sensor, and a third timestamp corresponding to a time of detection of the second detected transmission by the third sensor; comparing the second timestamp with the third timestamp and the first signal duration with the second signal duration; determining that the first detected transmission and the second detected transmission both correspond to a transmission sent by a same detected sensor based at least in part on the second timestamp being within a threshold time of the third timestamp and the first signal duration matching the second signal duration; based on determining that the first detected transmission and the second detected transmission correspond to the transmission sent by the same detected sensor, determining, based at least partially on the first signal strength data and the second signal strength data, an indicated location of the detected sensor; and when the indicated location of the detected sensor does not correspond to a known sensor location, indicating an anomaly. ### Claim 9 (depends on 8) The method as recited in claim 8, further comprising: when at least one of the second timestamp or the third timestamp is at a timing after the first timestamp, indicating that the detected sensor is associated with an anomaly. ### Claim 10 (depends on 8) The method as recited in claim 8, further comprising: searching a sensor inventory data structure for a location corresponding to the indicated location of the detected sensor; and associating a second sensor ID with the indicated location based on matching a location associated with the second sensor ID in the inventory data structure with the indicated location. ### Claim 11 (depends on 8) The method as recited in claim 8, further comprising: receiving, from a fourth sensor, a third information transmission including third signal strength information including third signal strength data and a third signal duration related to a third detected transmission detected by a fourth sensor, and a fourth timestamp corresponding to a time of detection of the third detected transmission by the fourth sensor; based on the fourth timestamp being within a threshold time of the second timestamp and the third timestamp, and the third signal duration matching the first signal duration and the second signal duration, determining the indicated location based on the third signal strength data in addition to the first signal strength data and the second signal strength data. ### Claim 12 (depends on 8) The method as recited in claim 8, further comprising: receiving, from a fourth sensor, a third information transmission including third signal strength information including third signal strength data and a third signal duration related to a third detected transmission detected by the fourth sensor, and a fourth timestamp corresponding to at time of detection of the third detected transmission by the fourth sensor; determining a first location based at least partially on the second signal strength information; determining a second location based at least partially on the third signal strength information; and when the first location is different from the second location, and the second timestamp is within a threshold time of the fourth timestamp, indicating that a sensor associated with at least one of the first location or the second location is associated with an anomaly. ### Claim 13 (depends on 8) The method as recited in claim 8, wherein the first signal strength data is indicative of a distance from the detected sensor to the second sensor. ### Claim 14 (depends on 8) The method as recited in claim 8, further comprising sending a notification to a computing device over a network indicating association of an anomaly with the detected sensor. ### Claim 15 One or more non-transitory computer-readable media maintaining instructions which, when executed by one or more processors, cause the one or more processors to perform operations comprising: receiving, by a processor, sensed data of a first sensor sent in a first data transmission; associating a first timestamp with the sensed data; receiving, from a second sensor, a first information transmission including first signal strength information including first signal strength data and a first signal duration related to a first detected transmission detected by the second sensor, and a second timestamp corresponding to a time of detection of the first detected transmission by the second sensor; receiving, from a third sensor, a second information transmission including second signal strength information including second signal strength data and a second signal duration related to a second detected transmission detected by the third sensor, and a third timestamp corresponding to a time of detection of the second detected transmission by the third sensor; comparing the second timestamp with the third timestamp and the first signal duration with the second signal duration; determining that the first detected transmission and the second detected transmission both correspond to a transmission sent by a same detected sensor based at least in part on the second timestamp being within a threshold time of the third timestamp and the first signal duration matching the second signal duration; based on determining that the first detected transmission and the second detected transmission correspond to the transmission sent by the same detected sensor, determining, based at least partially on the first signal strength data and the second signal strength data, an indicated location of the detected sensor; and when the indicated location of the detected sensor does not correspond to a known sensor location, indicating an anomaly. ### Claim 16 (depends on 15) The one or more non-transitory computer-readable media as recited in claim 15, wherein the operations further comprise: when at least one of the second timestamp or the third timestamp is after the first timestamp, indicating that the detected sensor is associated with an anomaly. ### Claim 17 (depends on 15) The one or more non-transitory computer-readable media as recited in claim 15, wherein the operations further comprise: searching a sensor inventory data structure for a location corresponding to the indicated location of the detected sensor; and associating a second sensor ID with the indicated location based on matching a location associated with the second sensor ID in the inventory data structure with the indicated location. ### Claim 18 (depends on 15) The one or more non-transitory computer-readable media as recited in claim 15, wherein the operations further comprise: receiving, from a fourth sensor, a third information transmission including third signal strength information including third signal strength data and a third signal duration related to a third detected transmission detected by the fourth sensor, and a fourth timestamp corresponding to a time of detection of the third detected transmission by the fourth sensor; based on the fourth timestamp being within a threshold time of the second timestamp and the third timestamp, and the third signal duration matching the first signal duration and the second signal duration, determining the indicated location based on the third signal strength data in addition to the first signal strength data and the second signal strength data. ### Claim 19 (depends on 15) The one or more non-transitory computer-readable media as recited in claim 15, wherein the operations further comprise: receiving, from a fourth sensor, a third information transmission including third signal strength information including third signal strength data and a third signal duration related to a third detected transmission detected by the fourth sensor, and a fourth timestamp corresponding to a time of detection of the third detected transmission by the fourth sensor; determining a first location based at least partially on the second signal strength information; determining a second location based at least partially on the third signal strength information; and when the first location is different from the second location, and the second timestamp is within a threshold time of the fourth timestamp, indicating that a sensor associated with at least one of the first location or the second location is associated with an anomaly. ### Claim 20 (depends on 15) The one or more non-transitory computer-readable media as recited in claim 15, wherein the first signal strength data is indicative of a distance from the detected sensor to the first sensor.