Increasing edge data confidence via trusted ethical hacking

Patent metadata

Field	Value
Publication number	US-11438359-B2
Application number	US-201916663981-A
Country	US
Kind code	B2
Filing date	Oct 25, 2019
Priority date	Oct 25, 2019
Publication date	Sep 6, 2022
Grant date	Sep 6, 2022

Abstract

One example method includes deploying a group of bots in a computing environment that includes a group of nodes, each of the bots having an associated attack vector with respect to one or more of the nodes, receiving, from each of the bots, a report that identifies a node attacked by that bot, and a result of the attack, and adjusting, based on the bot reports, a confidence score of one or more of the attacked nodes.

First claim

What is claimed is:

1. A method, comprising:
deploying a group of bots in a computing environment that includes a plurality of nodes, each of the bots operable to exercise a respective attack vector with respect to one or more of the nodes, and one of the attack vectors is executable to employ a passive approach that does not involve installation of software on the nodes;
receiving, from each of the bots, a report that identifies a node attacked by that bot, and a result of the attack; and
adjusting, based on the reports received from the bots, a confidence score of one or more of the attacked nodes.

2. The method as recited in claim 1 , wherein the deployed bots are recognized as trustworthy by the nodes.

3. The method as recited in claim 1 , wherein a confidence score of a first node is increased as a result of the first node having successfully resisted an attack by one of the bots, and/or a confidence score of a second node is decreased as a result of the second node having unsuccessfully resisted an attack by one of the bots.

4. The method as recited in claim 1 , wherein each of the attack vectors is specific to a particular layer of the computing environment.

5. The method as recited in claim 1 , wherein the nodes comprise any one or more of a sensor, gateway/server, sensor ingest layer, or edge/cloud.

6. The method as recited in claim 1 , wherein the attack vectors target any one or more of node readings, data provenance metadata, client logins, storage of node readings, packets, and a distributed ledger network.

7. The method as recited in claim 1 , wherein a subset of the bots cooperate with each other to perform a coordinated attack of the computing environment.

8. The method as recited in claim 1 , wherein one or more of the bots operate autonomously.

9. The method as recited in claim 1 , further comprising:
identifying, based on one or more bot reports, a vulnerability in the computing environment;
identifying a remedial action for the vulnerability; and
implementing the remedial action in a node.

10. The method as recited in claim 9 , further comprising updating a confidence score of the node based upon implementation of the remedial action.

11. A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
deploying a group of bots in a computing environment that includes a plurality of nodes, each of the bots operable to exercise a respective attack vector with respect to one or more of the nodes, and one of the attack vectors is executable to employ a passive approach that does not involve installation of software on the nodes;
receiving, from each of the bots, a report that identifies a node attacked by that bot, and a result of the attack; and
adjusting, based on the reports received from the bots, a confidence score of one or more of the attacked nodes.

12. The non-transitory storage medium as recited in claim 11 , wherein the deployed bots are recognized as trustworthy by the nodes.

13. The non-transitory storage medium as recited in claim 11 , wherein a confidence score of a first node and/or data associated with the first node is increased as a result of the first node having successfully resisted an attack by one of the bots, and/or a confidence score of a second node and/or data associated with the second node is decreased as a result of the second node having unsuccessfully resisted an attack by one of the bots.

14. The non-transitory storage medium as recited in claim 11 , wherein each of the attack vectors is specific to a particular layer of the computing environment.

15. The non-transitory storage medium as recited in claim 11 , wherein the nodes comprise any one or more of a sensor, gateway/server, sensor ingest layer, or edge/cloud.

16. The non-transitory storage medium as recited in claim 11 , wherein the attack vectors target any one or more of node readings, data provenance metadata, client logins, storage of node readings, packets, and a distributed ledger network.

17. The non-transitory storage medium as recited in claim 11 , wherein a subset of the bots cooperate with each other to perform a coordinated attack of the computing environment.

18. The non-transitory storage medium as recited in claim 11 , wherein one or more of the bots operate autonomously.

19. The non-transitory storage medium as recited in claim 11 , wherein the operations further comprise:
identifying, based on one or more bot reports, a vulnerability in the computing environment;
identifying a remedial action for the vulnerability; and
implementing the remedial action in a node.

20. The non-transitory storage medium as recited in claim 19 , wherein the operations further comprise updating a confidence score of the node based upon implementation of the remedial action.

Assignees

• Emc Ip Holding Co Llc
• EMC IP Holding Comapny LLC

Inventors

• Todd Stephen James
• Shepherd Jason A

Classifications

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1475

  Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L2463/144

  Detection or countermeasures against botnets · CPC title