US 2021/0344690 A1Published application

Distributed threat sensor analysis and correlation

AssigneeAmazon Technologies, Inc.

InventorNima Sharifi Mehr

Life of this patent

Estimating the term…

Loading patent…

Abstract

Various embodiments of apparatuses and methods for distributed threat sensor analysis and correlation of a malware threat intelligence system are described. In some embodiments, the system comprises a plurality of threat sensors, deployed at different network addresses and physically located in different geographic regions in a provider network, which detect interactions from sources. In some embodiments, a distributed threat sensor analysis and correlation service obtains significance scores for different sources of the interactions with the plurality of threat sensors. The service determines which of the sources are malicious actors based on the significance scores. The service receives identifiers of known actors such as compute instances in the provider network, client devices in a client network, or deployed IoT devices in a remote network, and correlates the malicious actors with the known actors to identify which known actors might be infected by malware.

Claims20

Dependent claims

A system, comprising:

a plurality of computing devices that comprise respective processors and memory to execute a plurality of threat sensors, wherein individual threat sensors of the plurality of threat sensors detect interactions with sources of the interactions, and wherein the plurality of threat sensors are deployed at a respective plurality of different network addresses and are physically located in different geographic regions in a provider network;
one or more processors and associated memories configured to implement a distributed threat sensor analysis and correlation service of the provider network, wherein the distributed threat sensor analysis and correlation service is configured to:
obtain a plurality of individual identifiers of the respective sources of the interactions with the plurality of threat sensors, and respective significance scores associated with respective individual identifiers of the plurality of individual identifiers;
determine, based at least in part on the significance scores, identifiers of malicious actors comprising a subset of the plurality of individual identifiers;
receive identifiers of a plurality of known actors, wherein the plurality of known actors comprises one or more of:
servers in the provider network, compute instances in the provider network, client devices in a client network, or deployed IoT devices in a remote network;
correlate the identifiers of malicious actors with the identifiers of known actors to identify one or more of the known actors as being infected by malware;
and
provide identifiers of the one or more of the known actors infected by malware to one or more destinations.

6 more elements

A method, comprising:

performing by a distributed threat sensor analysis and correlation component:
obtaining a plurality of individual identifiers of respective sources of interactions with a plurality of threat sensors, and respective significance scores associated with respective individual identifiers of the plurality of individual identifiers;
determining, based at least in part on the significance scores, identifiers of malicious actors comprising a subset of the plurality of individual identifiers;
receiving identifiers of a plurality of known actors, wherein the plurality of known actors comprises one or more of:
servers in a provider network, compute instances in a provider network, client devices in a client network, or deployed IoT devices in a remote network;
correlating the identifiers of malicious actors with the identifiers of known actors to identify one or more of the known actors as being infected by malware;
and
providing identifiers of the one or more of the known actors infected by malware to one or more destinations.

5 more elements

One or more non-transitory computer-readable storage media storing program instructions, that when executed on or across one or more processors of a distributed threat sensor analysis and correlation component, cause the one or more processors to:

obtain a plurality of identifiers of respective sources of interactions with a plurality of threat sensors, and respective significance scores associated with respective identifiers of the plurality of identifiers;
determine, based at least in part on the significance scores, identifiers of malicious actors comprising a subset of the plurality of identifiers;
receive identifiers of a plurality of known actors, wherein the plurality of known actors comprises one or more of:
servers in a provider network, compute instances in a provider network, client devices in a client network, or deployed IoT devices in a remote network;
correlate the identifiers of malicious actors with the identifiers of known actors to identify one or more of the known actors as being infected by malware;
and
provide identifiers of the one or more of the known actors infected by malware to one or more destinations.

4 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/865,005Filed 1 May 2020
Published: 4 Nov 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification13 codes

H04L 63/1408
For detecting or protecting against malicious traffic: by monitoring network traffic
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
G06F 16/25
Of structured data, e.g. relational data: integrating or interfacing systems involving database management systems
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting

Family

US 12,058,148 B2Related patent
US 2021/0344690 A1This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key