Management and distribution of virtual cyber sensors
AssigneeGeneral Electric Company
InventorsMatthew Richard Schwartz, Daniel Thanos
Life of this patent
Estimating the term…
Abstract
A system includes reception of data at a computing network, generation of alerts at the computing network based on received data and on cyber sensor data, the cyber sensor data defining data attribute, reception of alerts from the computing network at a defense engine, detection of events based on the received alerts at the defense engine, generation threat data based on the detected events, generation of first cyber sensor data based on the threat data, and initiation of deployment of the first cyber sensor data within the computing network.
Claims18
A system, comprising:
- a computing network to generate alerts based on received data and on cyber sensor data, the cyber sensor data defining data attributes;
- a defense engine to receive alerts from one or more honeyports, the computing network, and to detect events based on the received alerts;
- a system repository to receive information associated with detected events from the computing system;
- an analysis engine to generate threat data based on the received information;
- and
- an orchestrator to generate first cyber sensor data based on the threat data, and to initiate deployment of the first cyber sensor data within the computing network wherein generation of the first cyber sensor data comprises (i) receiving a selection of a base cyber sensor component from a sensor repository and (ii) receiving a selection of key attributes associated with the first cyber sensor data.
A method executable by one or more computing devices in response to execution of processor-executable program code, the method comprising:
- receiving data at a computing network from one or more honeyports;
- generating alerts at the computing network based on received data and on cyber sensor data, the cyber sensor data defining data attributes;
- receiving alerts from the computing network at a defense engine;
- detecting events based on the received alerts at the defense engine;
- generating threat data based on the detected events;
- generating first cyber sensor data based on the threat data wherein generation of the first cyber sensor data comprises (i) receiving a selection of a base cyber sensor component from a sensor repository and (ii) receiving a selection of key attributes associated with the first cyber sensor data;
- and
- initiating deployment of the first cyber sensor data within the computing network.
A non-transitory computer-readable medium storing program code, the program code executable by a system to cause the system to:
- receive data at a computing network from one or more honeyports;
- generate alerts at the computing network based on received data and on cyber sensor data, the cyber sensor data defining data attributes;
- receive alerts from the computing network at a defense engine;
- detect events based on the received alerts at the defense engine;
- generate threat data based on the detected events;
- generate first cyber sensor data based on the threat data;
- and
- initiate deployment of the first cyber sensor data within the computing network wherein generation of the first cyber sensor data comprises (i) receiving a selection of a base cyber sensor component from a sensor repository and (ii) receiving a selection of key attributes associated with the first cyber sensor data.
Dependencies are inferred from the claim text.