Back to results
US 12,095,803 B2Granted
Peer device protection
AssigneeOpen Text Corporation
InventorPaul Barnes
Life of this patent
Estimating the term…
Abstract
Peer device protection enables a first device comprising a digital security agent to remedy security issues on (or associated with) a set of devices visible to the first device. In aspects, a first device comprising a digital security agent may identify a set of devices visible to the first device. The first device may monitor the set of devices to collect data, such as types of communications and data points of interest. The digital security agent may apply threat detection to the collected data to identify anomalous network behavior. When anomalous network behavior is detected, the first device may cause an indicator of compromise (IOC) to be generated. Based on the IOC, the first device may facilitate remediation of the anomalous network behavior and/or apply security to one or more devices in the set of devices.
Claims21
A computer-readable storage medium encoding computer executable instructions for:
- detecting a first peer device on a network;
- detecting a second peer device on the network;
- monitoring, by a security device, the first peer device to generate first monitored data and second monitored data;
- monitoring, by the security device, the second peer device to generate third monitored data and fourth monitored data, wherein the security device is a peer of the first peer device and the second peer device, wherein the security device comprises a security solution;
- generating, by the security device and using the first monitored data, a first behavior profile specific only to the first peer device;
- generating, by the security device and using the third monitored data, a second behavior profile specific only to the second peer device;
- applying, by the security device, threat detection to the second monitored data to identify anomalous behavior of the first peer device, the threat detection including comparing the second monitored data to the first behavior profile;
- applying, by the security device, threat detection to the fourth monitored data to identify anomalous behavior of the second peer device, the threat detection including comparing the fourth monitored data to the second behavior profile;
- generating a first indicator of compromise corresponding to the identified anomalous behavior of the first peer device;
- generating a second indicator of compromise corresponding to the identified anomalous behavior of the second peer device;
- based on the first indicator of compromise, using the security device to remediate the identified anomalous behavior of the first peer device;
- and
- based on the second indicator of compromise, using the security device to remediate the identified anomalous behavior of the second peer device.
10 more elements
A method for peer device protection, the method comprising:
- detecting a first peer device on a network;
- detecting a second peer device on the network;
- monitoring, by a security device, the first peer device to generate first monitored data and second monitored data;
- monitoring, by the security device, the second peer device to generate third monitored data and fourth monitored data, wherein the security device is a peer of the first peer device and the second peer device, wherein the security device comprises a security solution;
- generating, by the security device and using the first monitored data, a first behavior profile specific only to the first peer device;
- generating, by the security device and using the third monitored data, a second behavior profile specific only to the second peer device;
- applying, by the security device, threat detection to the second monitored data to identify anomalous behavior of the first peer device, the threat detection including comparing the second monitored data to the first behavior profile;
- applying, by the security device, threat detection to the fourth monitored data to identify anomalous behavior of the second peer device, the threat detection including comparing the fourth monitored data to the second behavior profile;
- generating a first indicator of compromise corresponding to the identified anomalous behavior of the first peer device;
- generating a second indicator of compromise corresponding to the identified anomalous behavior of the second peer device;
- based on the first indicator of compromise, using the security device to remediate the identified anomalous behavior of the first peer device;
- and
- based on the second indicator of compromise, using the security device to remediate the identified anomalous behavior of the second peer device.
10 more elements
A system comprising:
- a processor;
- a memory coupled to the processor, the memory comprising computer executable instructions that, when executed by the processor, performs a method for peer device protection, the method comprising:
- detecting a first peer device on a network;
- detecting a second peer device on the network;
- monitoring, by a security device, the first peer device to generate first monitored data and second monitored data;
- monitoring, by the security device, the second peer device to generate third monitored data and fourth monitored data, wherein the security device is a peer of the first peer device and the second peer device, wherein the security device comprises a security solution;
- generating, by the security device and using the first monitored data, a first behavior profile specific only to the first peer device;
- generating, by the security device and using the third monitored data, a second behavior profile specific only to the second peer device;
- applying, by the security device, threat detection to the second monitored data to identify anomalous behavior of the first peer device, the threat detection including comparing the second monitored data to the first behavior profile;
- applying, by the security device, threat detection to the fourth monitored data to identify anomalous behavior of the second peer device, the threat detection including comparing the fourth monitored data to the second behavior profile;
- generating a first indicator of compromise corresponding to the identified anomalous behavior of the first peer device;
- generating a second indicator of compromise corresponding to the identified anomalous behavior of the second peer device;
- based on the first indicator of compromise, using the security device to remediate the identified anomalous behavior of the first peer device;
- and
- based on the second indicator of compromise, using the security device to remediate the identified anomalous behavior of the second peer device.
12 more elements
Dependencies are inferred from the claim text.