# US 9,436,652 B2 · Honeyport active network security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,436,652 B2 - Document ID: US9436652B2 - Status: Granted - Kind: B2 - Application number: 13/907,867 - Filed: 2013-06-01 - Published: 2014-12-04 - Granted: 2016-09-06 - Earliest claimed: 2013-06-01 - Assignees: General Electric Company - Applicants: General Electric Company - Inventors: Matthew Richard Schwartz - Web page: https://patentgrep.com/patent/US9436652B2 ## CPC - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - G06F 15/173: using an interconnection network, e.g. matrix, shuffle, pyramid, star, snowflake - G06F 21/567: {using dedicated hardware} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A device comprises a processor. The processor is configured to generate a first signal using a first communication protocol. The first signal corresponds to data received by the processor. The processor is configured to generate a second signal using a second communication protocol. The second signal comprises fabricated data generated by the processor. Additionally, the processor is configured to transmit the first signal. The processor is also configured to transmit the second signal. ## Claims ### Claim 1 A device, comprising: a processor configured to: generate a first signal using a first communication protocol, wherein the first signal corresponds to data transmitted to the processor using the first communication protocol, wherein the first communication protocol is a common protocol utilized to communicate between the processor and at least one node coupled to the processor in a network; generate a second signal using a second communication protocol, wherein the second signal comprises decoy data generated by the processor as part of a network security protocol, wherein the second signal is generated independently from the data transmitted to the processor; and transmit the first signal as an actual signal for reception by the node and transmit the second signal as a decoy signal in parallel with one another. ### Claim 2 (depends on 1) The device of claim 1, wherein the processor is configured to simultaneously transmit the first and second signals. ### Claim 3 (depends on 1) The device of claim 1, wherein the processor is configured to sequentially transmit the first and second signals. ### Claim 4 (depends on 1) The device of claim 1, wherein the processor is configured to detect a transmission using the second communication protocol. ### Claim 5 (depends on 4) The device of claim 4, wherein the processor is configured to capture data present in the transmission. ### Claim 6 (depends on 5) The device of claim 5, wherein the processor is configured to analyze the captured data to determine if a portion of the captured data matches a portion of a set of authorized data. ### Claim 7 (depends on 6) The device of claim 6, wherein the processor is configured to generate and transmit a third signal as the decoy data using the second communication protocol when the portion of the captured data does not match the portion of the set of authorized data, wherein the third signal comprises, a banner, a random data reply, or a random length reply, wherein the third signal mimics correct operation of a human machine interface. ### Claim 8 (depends on 6) The device of claim 6, wherein the processor is configured to generate and transmit an indication of an unauthorized network access when the portion of the captured data does not match the portion of the set of authorized data. ### Claim 9 (depends on 5) The device of claim 5, wherein the processor is configured to transmit the captured data to storage for logging of the captured data. ### Claim 10 (depends on 5) The device of claim 5, wherein the processor is configured to capture at least 32 bytes of data as the captured data. ### Claim 11 A non-transitory computer-readable medium having computer executable code stored thereon, the code comprising instructions to: receive data; generate a first signal using a first communication protocol, wherein the first signal corresponds to the data transmitted to a processor using the first communication protocol, wherein the first communication protocol is a common protocol utilized to communicate between the processor and at least one node coupled to the processor in a network; generate a second signal using a second communication protocol, wherein the second signal comprises decoy data as part of a network security protocol, wherein the second signal is generated independently from the data transmitted to the processor; and transmit the first signal as an actual signal for reception by the node and transmit the second signal as a decoy signal in parallel with one another. ### Claim 12 (depends on 11) The non-transitory computer-readable medium of claim 11, wherein the code comprises instructions to detect a transmission using the second communication protocol. ### Claim 13 (depends on 12) The non-transitory computer-readable medium of claim 12, wherein the code comprises instructions to capture data present in the transmission. ### Claim 14 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein the code comprises instructions to analyze the captured data to determine if a portion of the captured data matches a portion of a set of authorized data. ### Claim 15 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the code comprises instructions to generate and transmit a third signal as the decoy data using the second communication protocol when the portion of the captured data does not match the portion of the set of authorized data, wherein the third signal comprises, a banner, a random data reply, or a random length reply, wherein the third signal mimics correct operation of a human machine interface. ### Claim 16 (depends on 14) The non-transitory computer-readable medium of claim 14, wherein the code comprises instructions to generate and transmit an indication of an unauthorized network access when the portion of the captured data does not match the portion of the set of authorized data. ### Claim 17 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein the code comprises instructions to transmit the captured data to storage for logging of the captured data. ### Claim 18 A device, comprising: a memory configured to store instructions; and a processor configured to execute the stored instructions to: receive data corresponding to operational characteristics of machinery; generate a first signal using a first communication protocol related to the machinery, wherein the first signal corresponds to the data-transmitted to the processor using the first communication protocol, wherein the first communication protocol is a common protocol utilized to communicate between the processor and at least one node coupled to the processor in a network; generate a second signal using a second communication protocol related to the machinery, wherein the second signal comprises decoy data generated by the processor as part of a network security protocol, wherein the second signal is generated independently from the data transmitted to the processor; and transmit the first signal as an actual signal for reception by the node and transmit the second signal as a decoy signal in parallel with one another. ### Claim 19 (depends on 18) The device of claim 18, wherein the processor is configured to detect a transmission using the second communication protocol from a remote user. ### Claim 20 (depends on 19) The device of claim 19, wherein the processor is configured to forward interaction with the remote user to a server.