DATA SECURITY INSPECTION MECHANISM FOR SERIAL NETWORKS
First Claim
Patent Images
1. A method comprising:
- determining, by a device in a serial network, that a suspicious event has occurred in the network, wherein the suspicious event is identified based on timing information for one or more frames in the serial network;
assessing, by the device, whether the suspicious event is malicious by evaluating a sequence of events in the network that precede the suspicious event; and
causing, by the device, a mitigation action to be performed in the network when the suspicious event is deemed malicious.
1 Assignment
0 Petitions
Accused Products
Abstract
In one embodiment, a device in a serial network determines that a suspicious event has occurred in the network. The suspicious event is identified based on timing information for one or more frames in the serial network. The device assesses whether the suspicious event is malicious by evaluating a sequence of events in the network that precede the suspicious event. The device causes a mitigation action to be performed in the network when the suspicious event is deemed malicious.
9 Citations
20 Claims
-
1. A method comprising:
-
determining, by a device in a serial network, that a suspicious event has occurred in the network, wherein the suspicious event is identified based on timing information for one or more frames in the serial network; assessing, by the device, whether the suspicious event is malicious by evaluating a sequence of events in the network that precede the suspicious event; and causing, by the device, a mitigation action to be performed in the network when the suspicious event is deemed malicious. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8)
-
-
9. An apparatus, comprising:
-
one or more network interfaces to communicate with a serial network; a processor coupled to the one or more network interfaces and configured to execute a process; and a memory configured to store the process executable by the processor, the process when executed configured to; determine that a suspicious event has occurred in the serial network, wherein the suspicious event is identified based on timing information for one or more frames in the serial network; assess whether the suspicious event is malicious by evaluating a sequence of events in the network that precede the suspicious event; and cause a mitigation action to be performed in the network when the suspicious event is deemed malicious. - View Dependent Claims (10, 11, 12, 13, 14, 15, 16)
-
-
17. A tangible, non-transitory, computer-readable medium storing program instructions that, when executed by a device in a serial network, cause the device to perform a process comprising:
-
determining, by the device, that a suspicious event has occurred in the network, wherein the suspicious event is identified based on timing information for one or more frames in the serial network; assessing, by the device, whether the suspicious event is malicious by evaluating a sequence of events in the network that precede the suspicious event; and causing, by the device, a mitigation action to be performed in the network when the suspicious event is deemed malicious. - View Dependent Claims (18, 19, 20)
-
Specification