US 2021/0344726 A1Published application

Threat sensor deployment and management

AssigneeAmazon Technologies, Inc.

InventorNima Sharifi Mehr

Life of this patent

Estimating the term…

Loading patent…

Abstract

Various embodiments of apparatuses and methods for threat sensor deployment and management in a malware threat intelligence system are described. In some embodiments, the system comprises a plurality of threat sensors, deployed at different network addresses and physically located in different geographic regions in a provider network, which detect interactions from sources. In some embodiments, a threat sensor deployment and management service determines a deployment plan for the plurality of threat sensors, including each threat sensor's associated threat data collectors. The threat data collectors can be of different types such as utilizing different communication protocols or ports, or providing different kinds of responses to inbound communications. The different threat sensors can have different lifetimes. The service deploys the threat sensors based on the plan, collects data from the deployed threat sensors, adjusts the deployment plan based on the collected data and the threat sensor lifetimes, and then performs the adjustments.

Claims20

Dependent claims

A system, comprising:

a plurality of computing devices, physically located in a plurality of different geographic regions, that have respective processors and memory to execute a plurality of threat sensors;
one or more computers with one or more processors and associated memory configured to implement a threat sensor deployment and management service of a provider network, wherein the threat sensor deployment and management service is configured to:
determine a deployment plan for the plurality of threat sensors, wherein individual threat sensors specify one or more threat data collectors of a plurality of different types of threat data collectors, wherein at least some of the different types of threat data collectors utilize different communication protocols or communication ports, or provide different responses to inbound communications, and wherein the deployment plan specifies threat sensors with different lifetimes;
deploy and configure according to the deployment plan the plurality of threat sensors at different network addresses in the plurality of different geographic regions of the provider network;
collect threat data from the deployed threat sensors;
based on the collected threat data and the different lifetimes of the threat sensors, determine an adjusted deployment plan comprising one or more adjustments to the deployment plan;
and
perform the adjustments to the threat sensors in one or more of the geographic regions according to the adjusted deployment plan.

5 more elements

A method, comprising:

performing by a threat sensor deployment and management component:
determining a deployment plan for a plurality of threat sensors, wherein individual threat sensors specify one or more threat data collectors of a plurality of different types of threat data collectors, wherein at least some of the different types of threat data collectors utilize different communication protocols or communication ports, or provide different responses to inbound communications, and wherein the deployment plan specifies threat sensors with different lifetimes;
deploying and configuring according to the deployment plan the plurality of threat sensors at a plurality of different network addresses in a plurality of different geographic regions;
collecting threat data from the deployed threat sensors;
based on the collected threat data and the different lifetimes of the threat sensors, determining an adjusted deployment plan comprising one or more adjustments to the deployment plan;
and
performing the adjustments to the threat sensors in or more of the geographic regions according to the adjusted deployment plan.

4 more elements

One or more non-transitory computer-readable storage media storing program instructions, that when executed on or across one or more processors of a threat sensor deployment and management component, cause the one or more processors to:

determine a deployment plan for a plurality of threat sensors, wherein individual threat sensors specify one or more threat data collectors of a plurality of different types of threat data collectors, wherein at least some of the different types of threat data collectors utilize different communication protocols or communication ports, or provide different responses to inbound communications, and wherein the deployment plan specifies threat sensors with different lifetimes;
deploy and configure according to the deployment plan the plurality of threat sensors at a plurality of different network addresses in a plurality of different geographic regions;
collect threat data from the deployed threat sensors;
based on the collected threat data and the different lifetimes of the threat sensors, determine an adjusted deployment plan comprising one or more adjustments to the deployment plan;
and
perform the adjustments to the threat sensors in or more of the geographic regions according to the adjusted deployment plan.

3 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/864,959Filed 1 May 2020
Published: 4 Nov 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification17 codes

H04L 63/205
For managing network security; network security policies in general: involving negotiation or determination of the one or more network security…
H04L 63/0218
Architectural arrangements, e.g. perimeter networks or demilitarized zones: distributed architectures, e.g. distributed firewalls
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
H04L 63/145
Countermeasures against malicious traffic: the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Family

US 12,041,094 B2Related patent
US 2021/0344726 A1This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key