Dynamic sensors
Examples of the present disclosure describe systems and methods for generating dynamic sensors. In aspects, a device may be detected on a network. If the device is not recognized by the network, a generic container may be created. If the device is recognized by the network, a device-specific container may be created, and device-specific threat protection and/or a device-specific machine model may be loaded into the container. In either case, a threat intelligence model and/or an ecosystem-specific machine model may also be loaded into the container. The container may then be deployed to one or more networks. In aspects, the container may be used to analyze network traffic to sense potential threats for ecosystems comprising varying devices and topologies.
1. A system comprising:
at least one processor; and
memory coupled to the at least one processor, the memory comprising computer executable instructions that, when executed by the at least one processor, performs a method for generated dynamic sensors, the method comprising:
detecting a device on a network;
determining whether the detected device is identifiable based on an evaluation of device data for the device, wherein the evaluation comprises at least one of: requesting a manifest file from the device or issuing self-identifying commands to the device, and wherein the evaluation provides information that identifies the device, the device type and at least one of the operating system, installed applications, resource usage, or privileges;
when the device is not identifiable:
generating a generic container;
loading a threat intelligence module into the generic container, wherein the threat intelligence module provides general computing environment security for at least one of known threats and suspected threats;
loading an ecosystem-specific module into the generic container, wherein the ecosystem-specific module provides security for at least one of: an identified ecosystem, an identified threat, and an identified form of communication; and
deploying the generic container as a dynamic sensor; and
when the device is identifiable:
generating a device-specific container, wherein the device-specific container is based on the device information;
loading device-specific threat protection into the device-specific container;
loading a device-specific machine model into the device-specific container;
loading the threat intelligence module into the device-specific container;
loading the ecosystem-specific module into the device-specific container; and
deploying the device-specific container as a dynamic sensor.
2. The system of claim 1 , wherein detecting the device comprises at least one of:
identifying an attempt, by the device, to connect to the network; and
determining the device is currently connected to the network.
3. The system of claim 2 , wherein detecting the device further comprises:
monitoring the network activity associated with the device; and
evaluating the network activity to determine the device data for the device.
4. The system of claim 3 , wherein determining whether the detected device is identifiable comprises evaluating the device data for the device, wherein the evaluating comprises at least one of:
providing the device data to a device lookup service; and
comparing connection details in the device data to previously-received connection details.
5. The system of claim 1 , wherein at least one of the generic container and the device-specific container comprises one or more default modules, wherein the one or more default modules are maintained by a module maintenance service.
6. The system of claim 5 , wherein the module maintenance service manages a default module list, wherein the default module list is modified based on at least one of manual observation, threat trend analyses, and security service updates.
7. The system of claim 1 , wherein the device-specific threat protection comprises a set of modules corresponding to one or more threats, wherein the set of modules is presented to a user via a user interface, and the set of modules is prioritized according to at least one of; date of detection and number of devices impacted.
8. The system of claim 1 , wherein the device-specific machine model is trained using input associated with at least one of the device and the device type.
9. The system of claim 1 , wherein the threat intelligence module provides general computing environment security for at least one of: known threats and suspected threats.
10. The system of claim 9 , wherein providing the general computing environment security comprises:
analyzing downloading data associated with the device;
calculating a score corresponding to the security of the data based on the analysis; and
providing corrective actions based upon the score.
11. The system of claim 1 , wherein the ecosystem-specific module is trained using input associated with previously-connected network devices, and wherein the ecosystem-specific module is trained to provide security for at least one of: a particular ecosystem, a particular identified threat, and a particular form of communication.
12. The system of claim 1 , wherein deploying the device-specific container comprises integrating the device-specific container with a sensor component to generate the dynamic sensor.
13. The system of claim 12 , wherein deploying the device-specific container further comprises installing the dynamic sensor on one or more devices in the network.
14. The system of claim 1 , wherein the dynamic sensor is configured to evaluate message traffic transmitted over the network for known or suspected threats from transient devices.
15. A method for generated dynamic sensors, the method comprising:
detecting a device on a network;
determining whether the detected device is identifiable based on an evaluation of device data for the device, wherein the evaluation comprises at least one of: requesting a manifest file from the device or issuing self-identifying commands to the device, and wherein the evaluation provides information that identifies the device, the device type and at least one of the operating system, installed applications, resource usage, or privileges;
when the device is not identifiable:
generating a generic container;
loading a threat intelligence module into the generic container, wherein the threat intelligence module provides general computing environment security for at least one of known threats and suspected threats;
loading an ecosystem-specific module into the generic container, wherein the ecosystem-specific module provides security for at least one of: an identified ecosystem, an identified threat, and an identified form of communication; and
deploying the generic container as a dynamic sensor; and
when the device is identifiable:
generating a device-specific container, wherein the device-specific container is based on the device information;
loading device-specific threat protection into the device-specific container;
loading a device-specific machine model into the device-specific container;
loading the threat intelligence module into the device-specific container;
loading the ecosystem-specific module into the device-specific container; and
deploying the device-specific container as a dynamic sensor.
16. The method of claim 15 , wherein detecting the device comprises:
accessing a network control component that is operable to enable the device to communicate over the network; and
monitoring messages transmitted by the network control component.
17. The method of claim 15 , wherein determining whether the detected device is identifiable comprises evaluating the device data for the device, wherein the evaluating comprises at least one of:
providing the device data to a device lookup service; and
comparing connection details in the device data to previously-received connection details.
18. The method of claim 15 , wherein the device-specific threat protection comprises one or more modules corresponding to one or more threats to the device, wherein the one or more modules is selected based on a threat assessment profile.
19. The method of claim 15 , wherein deploying the device-specific container comprises:
integrating the device-specific container with a sensor component to generate the dynamic sensor; and
installing the dynamic sensor on one or more devices in the network.
20. A hardware computer-readable storage device encoding computer executable instructions which, when executed by at least one processor, performs a method for venue detection, the method comprising:
detecting a device on a network;
determining whether the detected device is identifiable based on an evaluation of device data for the device, wherein the evaluation comprises at least one of: requesting a manifest file from the device or issuing self-identifying commands to the device, and wherein the evaluation provides information that identifies the device, the device type and at least one of the operating system, installed applications, resource usage, or privileges;
when the device is not identifiable:
generating a generic container;
loading a threat intelligence module into the generic container, wherein the threat intelligence module provides general computing environment security for at least one of known threats and suspected threats;
loading an ecosystem-specific module into the generic container, wherein the ecosystem-specific module provides security for at least one of: an identified ecosystem, an identified threat, and an identified form of communication; and
deploying the generic container as a dynamic sensor; and
when the device is identifiable:
generating a device-specific container, wherein the device-specific container is based on the device information;
loading device-specific threat protection into the device-specific container;
loading a device-specific machine model into the device-specific container;
loading the threat intelligence module into the device-specific container;
loading the ecosystem-specific module into the device-specific container; and
deploying the device-specific container as a dynamic sensor.