# US 2021/0344726 A1 · Threat sensor deployment and management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344726 A1 - Document ID: US20210344726A1 - Status: Published application - Kind: A1 - Application number: 16/864,959 - Filed: 2020-05-01 - Published: 2021-11-04 - Earliest claimed: 2020-05-01 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Nima Sharifi Mehr - Web page: https://patentgrep.com/patent/US20210344726A1 ## CPC - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04W 12/63: Location-dependent; Proximity-dependent - G16Y 10/75: Information technology; Communication - G16Y 40/50: Safety; Security of things, users, data or systems - H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play - H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements - H04L 43/026: using flow identification - H04L 63/1458: {Denial of Service} - H04L 2463/146: Tracing the source of attacks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G16Y: INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT] ## Abstract Various embodiments of apparatuses and methods for threat sensor deployment and management in a malware threat intelligence system are described. In some embodiments, the system comprises a plurality of threat sensors, deployed at different network addresses and physically located in different geographic regions in a provider network, which detect interactions from sources. In some embodiments, a threat sensor deployment and management service determines a deployment plan for the plurality of threat sensors, including each threat sensor's associated threat data collectors. The threat data collectors can be of different types such as utilizing different communication protocols or ports, or providing different kinds of responses to inbound communications. The different threat sensors can have different lifetimes. The service deploys the threat sensors based on the plan, collects data from the deployed threat sensors, adjusts the deployment plan based on the collected data and the threat sensor lifetimes, and then performs the adjustments. ## Claims ### Claim 1 A system, comprising: a plurality of computing devices, physically located in a plurality of different geographic regions, that have respective processors and memory to execute a plurality of threat sensors; one or more computers with one or more processors and associated memory configured to implement a threat sensor deployment and management service of a provider network, wherein the threat sensor deployment and management service is configured to: determine a deployment plan for the plurality of threat sensors, wherein individual threat sensors specify one or more threat data collectors of a plurality of different types of threat data collectors, wherein at least some of the different types of threat data collectors utilize different communication protocols or communication ports, or provide different responses to inbound communications, and wherein the deployment plan specifies threat sensors with different lifetimes; deploy and configure according to the deployment plan the plurality of threat sensors at different network addresses in the plurality of different geographic regions of the provider network; collect threat data from the deployed threat sensors; based on the collected threat data and the different lifetimes of the threat sensors, determine an adjusted deployment plan comprising one or more adjustments to the deployment plan; and perform the adjustments to the threat sensors in one or more of the geographic regions according to the adjusted deployment plan. ### Claim 2 (depends on 1) The system as recited in claim 1, wherein the provider network provides a plurality of services including a virtual compute instance service, and wherein the threat sensor deployment and management service uses the virtual compute instance service to deploy at least some of the plurality of threat sensors. ### Claim 3 (depends on 2) The system as recited in claim 2, wherein at least a particular one of the plurality of threat sensors not implemented by the virtual compute instance service is deployed outside of the provider network, and wherein to collect threat data from the deployed threat sensors, the threat sensor deployment and management service is further configured to: collect data from at least the particular one of the plurality of threat sensors deployed outside of the provider network. ### Claim 4 (depends on 2) The system as recited in claim 2, wherein the threat sensor deployment and management service is further configured to: provide an interface for a client of the provider network to specify details for a desired threat sensor deployment; and wherein to determine the deployment plan for the plurality of threat sensors, the threat sensor deployment and management service is further configured to: determine the deployment plan based at least in part on the specified details from the client. ### Claim 5 A method, comprising: performing by a threat sensor deployment and management component: determining a deployment plan for a plurality of threat sensors, wherein individual threat sensors specify one or more threat data collectors of a plurality of different types of threat data collectors, wherein at least some of the different types of threat data collectors utilize different communication protocols or communication ports, or provide different responses to inbound communications, and wherein the deployment plan specifies threat sensors with different lifetimes; deploying and configuring according to the deployment plan the plurality of threat sensors at a plurality of different network addresses in a plurality of different geographic regions; collecting threat data from the deployed threat sensors; based on the collected threat data and the different lifetimes of the threat sensors, determining an adjusted deployment plan comprising one or more adjustments to the deployment plan; and performing the adjustments to the threat sensors in or more of the geographic regions according to the adjusted deployment plan. ### Claim 6 (depends on 5) The method as recited in claim 5, further comprising: performing adjustment iterations by the threat sensor deployment and management component at different times, wherein a particular adjustment iteration comprises repeating: the collecting the threat data from the deployed threat sensors; the determining the adjusted deployment plan; and the performing the adjustments to the threat sensors. ### Claim 7 (depends on 5) The method as recited in claim 5, wherein the performing the adjustments to the threat sensors according to the adjusted deployment plan further comprises one or more of: terminating a threat sensor, deploying at least one new threat sensor at new network address different from the plurality of different network addresses at which the plurality of threat sensors were deployed, or modifying the lifetime of a deployed threat sensor. ### Claim 8 (depends on 5) The method as recited in claim 5, further comprising: recording, by threat data collectors of corresponding ones of the deployed threat sensors, information about inbound communications received at the corresponding ones of the deployed threat sensors; and generating, by the corresponding ones of the deployed threat sensors, threat sensor logs from the recorded actions of the corresponding threat data collectors. ### Claim 9 (depends on 5) The method as recited in claim 5, further comprising: responding, by a particular one of the threat data collectors of a deployed threat sensor, to inbound communications with different identifying information to simulate responses from different types of systems. ### Claim 10 (depends on 5) The method as recited in claim 5, further comprising: performing by the threat sensor deployment and management component: determining that one or more threat sensors of a particular geographic region are receiving a greater number of inbound communications compared to a threshold; and deploying, based at least in part on the determining, additional threat sensors at network addresses in the particular geographic region. ### Claim 11 (depends on 5) The method as recited in claim 5, further comprising: performing by the threat sensor deployment and management component: determining that a particular threat sensor of the deployed plurality of threat sensors is receiving a larger number of inbound communications than a threshold; and extending, based at least in part on the determining, the lifetime of the particular threat sensor. ### Claim 12 (depends on 5) The method as recited in claim 5, wherein at least two of the different threat data collectors in a deployed threat sensor communicate on the same port using different communication protocols, the method further comprising: performing by the deployed threat sensor: determining an inbound communication protocol for an inbound communication; and selecting the threat data collector of the at least two threat data collectors that communicates using the determined inbound communication protocol to handle the inbound communication. ### Claim 13 (depends on 5) The method as recited in claim 5, wherein at least two of the different threat data collectors in a deployed threat sensor communicate on the same port using different communication protocols, the method further comprising: performing by the deployed threat sensor: receiving an inbound communication; and selecting one of the at least two of the different threat data collectors to respond to the inbound communication, wherein the selection is a weight-based randomized selection, with weights given to the individual different threat data collectors. ### Claim 14 (depends on 5) The method as recited in claim 5, further comprising: performing by a particular one of the threat data collectors of a deployed threat sensor: analyzing an inbound communication, wherein the inbound communication comprises a request to initiate a communication to a network address; determining the network address present in the inbound communication; and downloading data from the network address present in the inbound communication in order to determine information useful for threat intelligence. ### Claim 15 (depends on 5) The method as recited in claim 5, wherein the different network addresses at which the plurality of threat sensors are deployed are not publicized. ### Claim 16 One or more non-transitory computer-readable storage media storing program instructions, that when executed on or across one or more processors of a threat sensor deployment and management component, cause the one or more processors to: determine a deployment plan for a plurality of threat sensors, wherein individual threat sensors specify one or more threat data collectors of a plurality of different types of threat data collectors, wherein at least some of the different types of threat data collectors utilize different communication protocols or communication ports, or provide different responses to inbound communications, and wherein the deployment plan specifies threat sensors with different lifetimes; deploy and configure according to the deployment plan the plurality of threat sensors at a plurality of different network addresses in a plurality of different geographic regions; collect threat data from the deployed threat sensors; based on the collected threat data and the different lifetimes of the threat sensors, determine an adjusted deployment plan comprising one or more adjustments to the deployment plan; and perform the adjustments to the threat sensors in or more of the geographic regions according to the adjusted deployment plan. ### Claim 17 (depends on 16) The one or more non-transitory computer-readable storage media of claim 16, wherein the program instructions further cause the one or more processors of the threat sensor deployment and management component to: perform adjustment iterations at different times, wherein a particular adjustment iteration comprises repeating: the collecting the threat data from the deployed threat sensors; the determining the adjusted deployment plan; and the performing the adjustments to the threat sensors. ### Claim 18 (depends on 16) The one or more non-transitory computer-readable storage media of claim 16, wherein to perform the adjustments to the threat sensors according to the adjusted deployment plan, the program instructions further cause the one or more processors of the threat sensor deployment and management component to perform one or more of: terminate a threat sensor; deploy at least one new threat sensor at new network address different from the plurality of different network addresses at which the plurality of threat sensors were deployed; or modify the lifetime of a deployed threat sensor. ### Claim 19 (depends on 16) The one or more non-transitory computer-readable storage media of claim 16, wherein the program instructions further cause the one or more processors of the threat sensor deployment and management component to: determine that a threshold number of inbound communications have been received by a particular deployed threat sensor from a single source; and prevent the plurality of different threat data collectors of the particular deployed threat sensor from responding to further inbound communications from the single source. ### Claim 20 (depends on 16) The one or more non-transitory computer-readable storage media of claim 16, wherein the program instructions further cause the one or more processors of the threat sensor deployment and management component to: determine that a particular threat sensor of the deployed plurality of threat sensors has been compromised by malware; and terminate, based at least in part on the determining, the particular threat sensor.