# US 2021/0344690 A1 · Distributed threat sensor analysis and correlation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344690 A1 - Document ID: US20210344690A1 - Status: Published application - Kind: A1 - Application number: 16/865,005 - Filed: 2020-05-01 - Published: 2021-11-04 - Earliest claimed: 2020-05-01 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Nima Sharifi Mehr - Web page: https://patentgrep.com/patent/US20210344690A1 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 16/25: Integrating or interfacing systems involving database management systems - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06N 3/006: based on simulated virtual individual or collective life forms, e.g. social simulations or particle swarm optimisation [PSO] - G06N 20/00: Machine learning - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Various embodiments of apparatuses and methods for distributed threat sensor analysis and correlation of a malware threat intelligence system are described. In some embodiments, the system comprises a plurality of threat sensors, deployed at different network addresses and physically located in different geographic regions in a provider network, which detect interactions from sources. In some embodiments, a distributed threat sensor analysis and correlation service obtains significance scores for different sources of the interactions with the plurality of threat sensors. The service determines which of the sources are malicious actors based on the significance scores. The service receives identifiers of known actors such as compute instances in the provider network, client devices in a client network, or deployed IoT devices in a remote network, and correlates the malicious actors with the known actors to identify which known actors might be infected by malware. ## Claims ### Claim 1 A system, comprising: a plurality of computing devices that comprise respective processors and memory to execute a plurality of threat sensors, wherein individual threat sensors of the plurality of threat sensors detect interactions with sources of the interactions, and wherein the plurality of threat sensors are deployed at a respective plurality of different network addresses and are physically located in different geographic regions in a provider network; one or more processors and associated memories configured to implement a distributed threat sensor analysis and correlation service of the provider network, wherein the distributed threat sensor analysis and correlation service is configured to: obtain a plurality of individual identifiers of the respective sources of the interactions with the plurality of threat sensors, and respective significance scores associated with respective individual identifiers of the plurality of individual identifiers; determine, based at least in part on the significance scores, identifiers of malicious actors comprising a subset of the plurality of individual identifiers; receive identifiers of a plurality of known actors, wherein the plurality of known actors comprises one or more of: servers in the provider network, compute instances in the provider network, client devices in a client network, or deployed IoT devices in a remote network; correlate the identifiers of malicious actors with the identifiers of known actors to identify one or more of the known actors as being infected by malware; and provide identifiers of the one or more of the known actors infected by malware to one or more destinations. ### Claim 2 (depends on 1) The system as recited in claim 1, wherein the provider network provides a plurality of services including a database service, and wherein at least the identifiers of the malicious actors or the identifiers of the one or more of the known actors infected by malware are stored in a database of the database service of the provider network. ### Claim 3 (depends on 1) The system as recited in claim 1, wherein at least a particular one of the plurality of threat sensors is deployed outside of the provider network, and wherein to obtain the plurality of individual identifiers of the respective sources of the interactions with the plurality of threat sensors, the distributed threat sensor analysis and correlation service is further configured to: obtain the plurality of individual identifiers of the respective sources of the interactions with at least the particular one of the plurality of threat sensors deployed outside of the provider network. ### Claim 4 (depends on 1) The system as recited in claim 1, wherein to obtain the respective significance scores associated with the respective individual identifiers, the distributed threat sensor analysis and correlation service is further configured, for an individual source of the interactions of the respective sources of the interactions with the plurality of threat sensors, to: determine, based at least in part on aggregated information regarding the interactions with the plurality of threat sensors over a period of time for the individual source, and aggregated information regarding interactions from previous periods of time for the individual source, recency information regarding how recently the interactions for the individual source occurred; determine a number of the plurality of threat sensors that the individual source communicated with during at least one of the periods of time; and compute a significance score of the respective significance scores for the individual source of the interactions, based at least in part on the determined recency information and the determined number of threat sensors that the individual source communicated with. ### Claim 5 A method, comprising: performing by a distributed threat sensor analysis and correlation component: obtaining a plurality of individual identifiers of respective sources of interactions with a plurality of threat sensors, and respective significance scores associated with respective individual identifiers of the plurality of individual identifiers; determining, based at least in part on the significance scores, identifiers of malicious actors comprising a subset of the plurality of individual identifiers; receiving identifiers of a plurality of known actors, wherein the plurality of known actors comprises one or more of: servers in a provider network, compute instances in a provider network, client devices in a client network, or deployed IoT devices in a remote network; correlating the identifiers of malicious actors with the identifiers of known actors to identify one or more of the known actors as being infected by malware; and providing identifiers of the one or more of the known actors infected by malware to one or more destinations. ### Claim 6 (depends on 5) The method as recited in claim 5, wherein the determining the identifiers of malicious actors further comprises: determining malicious significance scores comprising the significance scores that are above a received or determined threshold; and determining the respective individual identifiers associated with the malicious significance scores as the identifiers of malicious actors. ### Claim 7 (depends on 5) The method as recited in claim 5, further comprising: performing by the distributed threat sensor analysis and correlation component: in response to the identifying the one or more of the known actors as being infected by malware, causing a first responsive action to be initiated, wherein the first responsive action comprises one or more of: (a) triggering a client-provided function to be executed; (b) sending a message to the remote network or the client network indicating the one or more known actors; or (c) terminating the security credentials for the particular one or more known actors in the provider network. ### Claim 8 (depends on 5) The method as recited in claim 5, further comprising: performing by the distributed threat sensor analysis and correlation component: receiving feedback regarding whether the identifying one or more of the known actors as being infected by malware is correct; and updating the significance scores associated with the respective individual identifiers based at least in part on the received feedback. ### Claim 9 (depends on 5) The method as recited in claim 5, wherein obtaining the respective significance scores associated with the respective individual identifiers further comprises: performing by the distributed threat sensor analysis and correlation component for an individual source of the interactions of the respective sources of the interactions with the plurality of threat sensors: determining, based at least in part on aggregated information regarding the interactions with the plurality of threat sensors over a period of time for the individual source, and aggregated information regarding interactions from previous periods of time for the individual source, recency information regarding how recently the interactions for the individual source occurred; determining a number of the plurality of threat sensors that the individual source communicated with during at least one of the periods of time; and computing a significance score of the respective significance scores for the individual source of the interactions, based at least in part on the determined recency information and the determined number of threat sensors that the individual source communicated with. ### Claim 10 (depends on 9) The method as recited in claim 9, wherein computing the significance score for the individual source of the interactions further comprises: computing the significance score based at least in part on one or more of: a determined classification of payloads received from the individual source of the interactions, a determined number of different ports the individual source of the interactions interacted with, a determined number of threat sensors the individual source of the interactions interacted with, a determined number of outbound initiated connections associated with the individual source of the interactions, or a determined static or dynamic nature of a network address associated with the individual source of the interactions. ### Claim 11 (depends on 5) The method as recited in claim 5, wherein obtaining the respective significance scores associated with the respective individual identifiers further comprises: calculating the respective significance scores based at least in part on user input regarding calculations for the calculating. ### Claim 12 (depends on 5) The method as recited in claim 5, further comprising: performing by the distributed threat sensor analysis and correlation component: receiving one or more of: ports targeted by the interactions with the plurality of threat sensors, payload classifications of the interactions with the plurality of threat sensors, protocols used by the interactions with the plurality of threat sensors, one or more threat sensors that detected the interactions with the plurality of threat sensors, or information regarding whether the interactions with the plurality of threat sensors were inbound initiated connections, outbound initiated connections, or both inbound and outbound initiated connections; and wherein the determining the identifiers of the malicious actors is further based at least in part on one or more of: the ports targeted by the interactions, the payload classifications of the interactions, the protocols used by the interactions, the one or more threat sensors that detected the interactions, or the information regarding whether the interactions were inbound initiated connections, outbound initiated connections, or both inbound and outbound initiated connections. ### Claim 13 (depends on 5) The method as recited in claim 5, further comprising: performing by the distributed threat sensor analysis and correlation component: generating metrics regarding the identified one or more of the known actors infected by malware for display in a user interface or dashboard. ### Claim 14 (depends on 5) The method as recited in claim 5, further comprising: performing by the distributed threat sensor analysis and correlation component: storing the identifiers of malicious actors and the identifiers of the one or more of the known actors infected by malware in a database, wherein the database provides a query interface to analyze the information regarding the malicious actors and known actors infected by malware. ### Claim 15 One or more non-transitory computer-readable storage media storing program instructions, that when executed on or across one or more processors of a distributed threat sensor analysis and correlation component, cause the one or more processors to: obtain a plurality of identifiers of respective sources of interactions with a plurality of threat sensors, and respective significance scores associated with respective identifiers of the plurality of identifiers; determine, based at least in part on the significance scores, identifiers of malicious actors comprising a subset of the plurality of identifiers; receive identifiers of a plurality of known actors, wherein the plurality of known actors comprises one or more of: servers in a provider network, compute instances in a provider network, client devices in a client network, or deployed IoT devices in a remote network; correlate the identifiers of malicious actors with the identifiers of known actors to identify one or more of the known actors as being infected by malware; and provide identifiers of the one or more of the known actors infected by malware to one or more destinations. ### Claim 16 (depends on 15) The one or more non-transitory computer-readable storage media of claim 15, wherein to determine the identifiers of malicious actors, the program instructions further cause the one or more processors of the distributed threat sensor analysis and correlation component to: determine malicious significance scores comprising the significance scores that are above a received or determined threshold; and determine the respective identifiers associated with the malicious significance scores as the identifiers of malicious actors. ### Claim 17 (depends on 15) The one or more non-transitory computer-readable storage media of claim 15 wherein, in response to the identifying the one or more of the known actors as being infected by malware, the program instructions further cause the one or more processors of the distributed threat sensor analysis and correlation component to: trigger a client-provided function to be executed; send a message to the remote network or the client network indicating the one or more known actors; or terminate the security credentials for the particular one or more known actors in the provider network. ### Claim 18 (depends on 15) The one or more non-transitory computer-readable storage media of claim 15, wherein the program instructions further cause the one or more processors of the distributed threat sensor analysis and correlation component to: receive feedback regarding whether the identifying one or more of the known actors as being infected by malware is correct; and update the respective significance scores associated with the respective identifiers based at least in part on the received feedback. ### Claim 19 (depends on 15) The one or more non-transitory computer-readable storage media of claim 15, wherein to obtain the respective significance scores associated with the respective identifiers, the program instructions further cause the one or more processors of the distributed threat sensor analysis and correlation component, for an individual source of the interactions of the respective sources of the interactions with the plurality of threat sensors, to: determine, based at least in part on aggregated information regarding the interactions with the plurality of threat sensors over a period of time for the individual source, and aggregated information regarding interactions from previous periods of time for the individual source, recency information regarding how recently the interactions for the individual source occurred; determine a number of the plurality of threat sensors that the individual source communicated with during at least one of the periods of time; and compute a significance score of the respective significance scores for the individual source of the interactions, based at least in part on the determined recency information and the determined number of threat sensors that the individual source communicated with. ### Claim 20 (depends on 19) The one or more non-transitory computer-readable storage media of claim 19, wherein to compute the significance score for the individual source of the interactions, the program instructions further cause the one or more processors of the distributed threat sensor analysis and correlation component to: compute the significance score based at least in part on one or more of: a determined classification of payloads received from the individual source of the interactions, a determined number of different ports the individual source of the interactions interacted with, a determined number of threat sensors the individual source of the interactions interacted with, a determined number of outbound initiated connections associated with the individual source of the interactions, or a determined static or dynamic nature of a network address associated with the individual source of the interactions.