Sensor-based Detection and Remediation System

• US 20140052849A1
• Filed: 08/09/2013
• Published: 02/20/2014
• Est. Priority Date: 08/14/2012
• Status: Active Grant

• Current Assignee: DigiCert Incorporated
• Original Assignee: DigiCert Incorporated
• Inventors: Sabin, Jason Allen
• Granted Patent: US 9,769,046 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/147 for predicting network behaviour
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route

Abstract

The invention comprises a method and system of deploying and managing sensor agents to provide services to networks and devices within a network. The invention dynamically deploys, initiates, and controls sensor agents that scan networks. Data obtained during the scan are returned to an analysis system for evaluation. Results are displayed to a user through a graphical interface or stored in a database. Results may also be used by the analysis system to remediate anomalies and provide graphical network information. Typically, a plurality of sensor agents are used to gather data in the aggregate and provide a more complete analysis on the operation and security of a network.

Claims

1. A method for providing services to a network comprising:

a. Initiating a sensor agent controller,

b. Obtaining information about the network,

c. Initiating a sensor agent using instructions provided by the sensor agent controller, and

d. Having the sensor agent perform a service for the network.

2. A method according to claim 1 further comprising obtaining operating parameters for the sensor agent from a policy engine.

3. A method according to claim 1 where the information about the network is providing by a network informant.

4. A method according to claim 1 further comprising having the sensor agent return information to an analysis system.

5. A method according to claim 4 where the analysis system includes a remediation decision point that takes an action in response to the information provided by the sensor agent.

6. A method according to claim 5 where the response to the information comprises initiating a second sensor agent.

7. A method according to claim 1 where the sensor agent is initiated through an agent provisioner.

8. A method according to claim 1 where initiating the sensor agent comprises dynamically deploying the sensor agent within a network.

9. A method according to claim 1 further comprising generating a flag that is sent to a notification component.

10. A method for discovering system anomalies within a network comprising:

a. Initiating a sensor agent controller,

b. Having the sensor agent controller initiate at least one sensor agent,

c. Having the at least one sensor agent scan the network for anomalies, and

d. Providing detected anomalies to an analysis system.

11. A method according to claim 10 where the sensor agent comprises a discovery controller that determines the process to follow when an anomaly is detected.

12. A method according to claim 10 where the sensor agent comprises a discovery controller that detects hidden devices within a network.

13. A method according to claim 11 where the sensor agent comprises an identification handler that sends an alert about hidden devices detected within a network.

14. A method according to claim 10 where the analysis system uses detected anomalies to create a map of the network.

15. A method according to claim 10 where the analysis system modifies a configuration file based on the detected anomaly.

16. A method according to claim 10 where the at least one sensor agent comprises a network validator that evaluates the contents of digital certificates discovered on the network.

17. A method according to claim 16 where the anomaly comprises a digital certificate that does not match contents provided by a policy engine.

18. A method according to claim 10 where the sensor agent is initiated through a VM controller and operates on a virtual network.

19. A method of monitoring a network comprising:

a. Initiating a sensor agent controller,

b. Retrieving operating parameter information from a policy engine,

c. Retrieving network information from a network informant,

d. Sending instructions to an agent provisioner based on the operating parameters retrieved from the policy engine,

e. Initiating at least one sensor agent that has access to a network identified in the network information retrieved from the network informant,

f. Having the at least one sensor agent scan devices within the network, and

g. Having the at least one sensor agent return information obtained from the scan to an analysis system.

20. A method according to claim 19 where the at least one sensor agent is a plurality of sensor agents that comprise a security scanner and certificate validator.

21. A method according to claim 19 where at least one sensor agent is deployed within a virtual network using a VM controller.

22. A method according to claim 19 further comprising having the analysis system take an action in response to the information returned by at least one sensor agent.

23. A method according to claim 19 further comprising having at least one sensor agent generate a flag if at least one sensor agent fails to operate in accordance with its operating parameters.

24. A method according to claim 23 were the flag is sent as a notification about the failure.

25. A system of deploying sensor agents comprising:

a. A server running a sensor agent controller,

b. At least one sensor agent that can be deployed by the sensor agent controller, and

c. A network where the sensor agent can be deployed.

26. A system according to claim 25 where the sensor agent controller comprises an agent provisioner that deploys the at least one sensor agent.

27. A system according to claim 25 where the at least one sensor agent is a plurality of sensor agents that are initiated by the sensor agent controller.

28. A system according to claim 25 further comprising a server with an analysis system that receives data from the at least one sensor agent.

29. A system according to claim 28 where the analysis system provides a visual indicators about the data received from at least one sensor agent.

30. A system according to claim 29 where the visual indicators comprise security information about the network.