# US 2019/0319970 A1 · Network communications protocol for machine-to-machine self orchestration > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0319970 A1 - Document ID: US20190319970A1 - Status: Published application - Kind: A1 - Application number: 16/382,626 - Filed: 2019-04-12 - Published: 2019-10-17 - Earliest claimed: 2018-04-12 - Inventors: Gregory David Pickett - Web page: https://patentgrep.com/patent/US20190319970A1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 16/22: Indexing; Data structures therefor; Storage structures - G06F 16/2379: {Updates performed during online database operations; commit processing} - H04L 51/04: Real-time or near real-time messaging, e.g. instant messaging [IM] - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 51/08: Annexed information, e.g. attachments - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method of securing a network including a plurality of computing systems connected via a network. The computing systems each include at least a processor, a memory, a user interface, and a communications interface. The memory includes a computing device-executable instructions (software program) so that, when executed by the processor, the processor: detects an attack event and sends a message comprising the attack event to the other of the plurality of computing systems via the network. Each of the other of the plurality of computing systems receive the message and perform a different response of a plurality of responses to the attack event. ## Claims ### Claim 1 A system for securing a network comprising: a computing system of a plurality of computing systems connected via a network, the computing system comprising a processor, a memory, a user interface, and a communications interface, wherein the memory comprises computing device-executable instructions so that, when executed by the processor, the processor: detects an attack event; and sends a message comprising the attack event to the other of the plurality of computing systems via the network, wherein each of the other of the plurality of computing systems receive the message and performs a different response of a plurality of responses to the attack event. ### Claim 2 (depends on 1) The system of claim 1, further comprising a database storing data comprising a plurality of attack events, wherein the database is accessible by the plurality of computing systems over the network. ### Claim 3 (depends on 2) The system of claim 2, wherein the processor checks the database for a match of the attack event; and stores the attack event to the database if the match is not found. ### Claim 4 (depends on 1) The system of claim 1, wherein the processor signs the message prior to sharing the message with the other of the plurality of computing systems. ### Claim 5 (depends on 2) The system of claim 2, wherein the processor receives a second message from one of the other of the plurality of computing systems via the network, wherein the second message comprises a second attack event; signs the message and compares its' signature to the signature included the message; performs a different response of the plurality of responses to the attack event. ### Claim 6 (depends on 1) The system of claim 1, wherein the message is shared from the plurality of computers with a plurality of remote computers over the Internet. ### Claim 7 (depends on 2) The system of claim 2, wherein the processor purges attack events from the database that are stored on the database for a time frame longer than a threshold period of time. ### Claim 8 A method for securing a network comprising: detecting, via software running on a computing system, an attack event; attaching, via software running on the computing system, the attack event to a message; and sending, via software running on the computing system, the message to a plurality of computing systems connected via a network, wherein each of the other of the plurality of computing systems receive the message and performs a different response of a plurality of responses to the attack event. ### Claim 9 (depends on 8) The method of claim 8, further comprising accessing, via the software running on the computing system, a database storing data comprising a plurality of attack events. ### Claim 10 (depends on 9) The method of claim 9, further comprising checking, via the software running on the computing system, the database for a match of the attack event; and storing, via the software running on the computing system, the attack event to the database if the match is not found. ### Claim 11 (depends on 8) The method of claim 8, further comprising signing, via the software running on the computing system, the message prior to sharing the message with the other of the plurality of computing systems. ### Claim 12 (depends on 11) The method of claim 11, further comprising receiving, via the software running on the computing system, a second message from one of the other of the plurality of computing systems via the network, wherein the second message comprises a second attack event; signing, via the software running on the computing system, the message and comparing a signature to the signature included with the message; and performing, via the software running on the computing system, a different response of the plurality of responses to the attack event. ### Claim 13 (depends on 8) The method of claim 8, further comprising sending, via the software running on the computer, the message to a plurality of remote computers over the Internet. ### Claim 14 (depends on 9) The method of claim 9, further comprising purging, via the software running on the computer, attack events from the database that are stored on the database for a time frame longer than a threshold period of time.