Patent ID: 11902303
Assignee: JUNIPER NETWORKS, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 14:
15. A method comprising:
monitoring, by a device, network data transmitted over the network between a plurality of internal devices on the network and between at least one of the plurality of internal devices and at least one external device outside the network;
detecting, by the device, a first order indicator of compromise on the network based on the network data transmitted over the network;
detecting, by the device, a second order indicator of compromise on the network based on the network data transmitted over the network;
detecting, by the device, one or more indicators of a compromised entity detected by a honey-host;
correlating, by the device, the one or more indicators of the compromised entity detected by the honey-host, the first order indicator of compromise on the network, and the second order indicator of compromise on the network,
wherein the compromised entity is one of the plurality of internal devices;

generating, by the device, a risk score for the network data based on correlating the one or more indicators of the compromised entity detected by the honey-host, the first order indicator of compromise on the network, and the second order indicator of compromise on the network; and
generating, by the device, a preventative action on data associated with the network based on the risk score.