# US 10,484,400 B2 · Dynamic sensors > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,400 B2 - Document ID: US10484400B2 - Status: Granted - Kind: B2 - Application number: 15/655,653 - Filed: 2017-07-20 - Published: 2018-01-25 - Granted: 2019-11-19 - Earliest claimed: 2016-07-20 - Assignees: Webroot Inc. - Applicants: Webroot Inc. - Inventors: David Dufour; Hal Lonas - Web page: https://patentgrep.com/patent/US10484400B2 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06N 5/04: Inference or reasoning models - G06N 20/00: Machine learning - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Examples of the present disclosure describe systems and methods for generating dynamic sensors. In aspects, a device may be detected on a network. If the device is not recognized by the network, a generic container may be created. If the device is recognized by the network, a device-specific container may be created, and device-specific threat protection and/or a device-specific machine model may be loaded into the container. In either case, a threat intelligence model and/or an ecosystem-specific machine model may also be loaded into the container. The container may then be deployed to one or more networks. In aspects, the container may be used to analyze network traffic to sense potential threats for ecosystems comprising varying devices and topologies. ## Claims ### Claim 1 A system comprising: at least one processor; and memory coupled to the at least one processor, the memory comprising computer executable instructions that, when executed by the at least one processor, performs a method for generated dynamic sensors, the method comprising: detecting a device on a network; determining whether the detected device is identifiable based on an evaluation of device data for the device, wherein the evaluation comprises at least one of: requesting a manifest file from the device or issuing self-identifying commands to the device, and wherein the evaluation provides information that identifies the device, the device type and at least one of the operating system, installed applications, resource usage, or privileges; when the device is not identifiable: generating a generic container; loading a threat intelligence module into the generic container, wherein the threat intelligence module provides general computing environment security for at least one of known threats and suspected threats; loading an ecosystem-specific module into the generic container, wherein the ecosystem-specific module provides security for at least one of: an identified ecosystem, an identified threat, and an identified form of communication; and deploying the generic container as a dynamic sensor; and when the device is identifiable: generating a device-specific container, wherein the device-specific container is based on the device information; loading device-specific threat protection into the device-specific container; loading a device-specific machine model into the device-specific container; loading the threat intelligence module into the device-specific container; loading the ecosystem-specific module into the device-specific container; and deploying the device-specific container as a dynamic sensor. ### Claim 2 (depends on 1) The system of claim 1, wherein detecting the device comprises at least one of: identifying an attempt, by the device, to connect to the network; and determining the device is currently connected to the network. ### Claim 3 (depends on 2) The system of claim 2, wherein detecting the device further comprises: monitoring the network activity associated with the device; and evaluating the network activity to determine the device data for the device. ### Claim 4 (depends on 3) The system of claim 3, wherein determining whether the detected device is identifiable comprises evaluating the device data for the device, wherein the evaluating comprises at least one of: providing the device data to a device lookup service; and comparing connection details in the device data to previously-received connection details. ### Claim 5 (depends on 1) The system of claim 1, wherein at least one of the generic container and the device-specific container comprises one or more default modules, wherein the one or more default modules are maintained by a module maintenance service. ### Claim 6 (depends on 5) The system of claim 5, wherein the module maintenance service manages a default module list, wherein the default module list is modified based on at least one of manual observation, threat trend analyses, and security service updates. ### Claim 7 (depends on 1) The system of claim 1, wherein the device-specific threat protection comprises a set of modules corresponding to one or more threats, wherein the set of modules is presented to a user via a user interface, and the set of modules is prioritized according to at least one of; date of detection and number of devices impacted. ### Claim 8 (depends on 1) The system of claim 1, wherein the device-specific machine model is trained using input associated with at least one of the device and the device type. ### Claim 9 (depends on 1) The system of claim 1, wherein the threat intelligence module provides general computing environment security for at least one of: known threats and suspected threats. ### Claim 10 (depends on 9) The system of claim 9, wherein providing the general computing environment security comprises: analyzing downloading data associated with the device; calculating a score corresponding to the security of the data based on the analysis; and providing corrective actions based upon the score. ### Claim 11 (depends on 1) The system of claim 1, wherein the ecosystem-specific module is trained using input associated with previously-connected network devices, and wherein the ecosystem-specific module is trained to provide security for at least one of: a particular ecosystem, a particular identified threat, and a particular form of communication. ### Claim 12 (depends on 1) The system of claim 1, wherein deploying the device-specific container comprises integrating the device-specific container with a sensor component to generate the dynamic sensor. ### Claim 13 (depends on 12) The system of claim 12, wherein deploying the device-specific container further comprises installing the dynamic sensor on one or more devices in the network. ### Claim 14 (depends on 1) The system of claim 1, wherein the dynamic sensor is configured to evaluate message traffic transmitted over the network for known or suspected threats from transient devices. ### Claim 15 A method for generated dynamic sensors, the method comprising: detecting a device on a network; determining whether the detected device is identifiable based on an evaluation of device data for the device, wherein the evaluation comprises at least one of: requesting a manifest file from the device or issuing self-identifying commands to the device, and wherein the evaluation provides information that identifies the device, the device type and at least one of the operating system, installed applications, resource usage, or privileges; when the device is not identifiable: generating a generic container; loading a threat intelligence module into the generic container, wherein the threat intelligence module provides general computing environment security for at least one of known threats and suspected threats; loading an ecosystem-specific module into the generic container, wherein the ecosystem-specific module provides security for at least one of: an identified ecosystem, an identified threat, and an identified form of communication; and deploying the generic container as a dynamic sensor; and when the device is identifiable: generating a device-specific container, wherein the device-specific container is based on the device information; loading device-specific threat protection into the device-specific container; loading a device-specific machine model into the device-specific container; loading the threat intelligence module into the device-specific container; loading the ecosystem-specific module into the device-specific container; and deploying the device-specific container as a dynamic sensor. ### Claim 16 (depends on 15) The method of claim 15, wherein detecting the device comprises: accessing a network control component that is operable to enable the device to communicate over the network; and monitoring messages transmitted by the network control component. ### Claim 17 (depends on 15) The method of claim 15, wherein determining whether the detected device is identifiable comprises evaluating the device data for the device, wherein the evaluating comprises at least one of: providing the device data to a device lookup service; and comparing connection details in the device data to previously-received connection details. ### Claim 18 (depends on 15) The method of claim 15, wherein the device-specific threat protection comprises one or more modules corresponding to one or more threats to the device, wherein the one or more modules is selected based on a threat assessment profile. ### Claim 19 (depends on 15) The method of claim 15, wherein deploying the device-specific container comprises: integrating the device-specific container with a sensor component to generate the dynamic sensor; and installing the dynamic sensor on one or more devices in the network. ### Claim 20 A hardware computer-readable storage device encoding computer executable instructions which, when executed by at least one processor, performs a method for venue detection, the method comprising: detecting a device on a network; determining whether the detected device is identifiable based on an evaluation of device data for the device, wherein the evaluation comprises at least one of: requesting a manifest file from the device or issuing self-identifying commands to the device, and wherein the evaluation provides information that identifies the device, the device type and at least one of the operating system, installed applications, resource usage, or privileges; when the device is not identifiable: generating a generic container; loading a threat intelligence module into the generic container, wherein the threat intelligence module provides general computing environment security for at least one of known threats and suspected threats; loading an ecosystem-specific module into the generic container, wherein the ecosystem-specific module provides security for at least one of: an identified ecosystem, an identified threat, and an identified form of communication; and deploying the generic container as a dynamic sensor; and when the device is identifiable: generating a device-specific container, wherein the device-specific container is based on the device information; loading device-specific threat protection into the device-specific container; loading a device-specific machine model into the device-specific container; loading the threat intelligence module into the device-specific container; loading the ecosystem-specific module into the device-specific container; and deploying the device-specific container as a dynamic sensor.