Patent application EP19151683A (EP), filed 2019-01-14
Publication number: EP3512179A1
Title: CYBER SECURITY FRAMEWORK FOR INTERNET-CONNECTED EMBEDDED DEVICES
Abstract: Methods, systems and computer program products for intrusion detection are provided. Aspects include receiving (400), by a processor, internet of things (IoT) device data from each of a plurality of IoT devices, wherein the IoT device data comprises operational data and non-operational data associated with each of the plurality of IoT devices. A security model is built (404) for the plurality of IoT devices based at least in part on the IoT device data, wherein the security model comprises one or more IoT device data ranges. The plurality of IoT devices are monitored (406) to identify a potential intrusion in any of the plurality of IoT devices based at least in part on the IoT device data exceeding any of the one or more IoT device data ranges.
IPC codes: G06F  21/    55            A I
G06N  20/    00            A I
H04L  29/    06            A I
H04L  29/    08            A I
H04W  12/    12            A I
H04W   4/    70            A I
Claims: number: 1
text: A method for intrusion detection, the method comprising:
number: 2
text: The method of Claim 1, further comprising:
number: 3
text: The method of Claim 2, wherein employing the security measure for the intrusion event comprises:
number: 4
text: The method of Claim 2 or 3, wherein the determining that the potential intrusion is an intrusion event further comprises:
number: 5
text: The method of any preceding Claim, wherein the device data further comprises status data associated with the plurality of IoT devices; and wherein the monitoring the plurality of IoT devices to identify the potential intrusion comprises:
number: 6
text: A system for intrusion detection, the system comprising:
number: 7
text: The system of Claim 6, further comprising:
number: 8
text: The system of Claim 7, wherein employing the security measure for the intrusion event comprises:
number: 9
text: The system of Claim 7 or 8, wherein the determining that the potential intrusion is an intrusion event further comprises:
number: 10
text: The system of Claim 7, 8 or 9, wherein the device data further comprises status data associated with the plurality of IoT devices; and wherein the monitoring the plurality of IoT devices to identify the potential intrusion comprises:
number: 11
text: A computer program product comprising:
number: 12
text: The computer program product of Claim 11, further comprising:
number: 13
text: The computer program product of Claim 11 or 12, wherein employing the security measure for the intrusion event comprises:
number: 14
text: The computer program product of Claim 11, 12 or 13, wherein the device data further comprises status data associated with the plurality of IoT devices; and wherein the monitoring the plurality of IoT devices to identify the potential intrusion comprises:
Office action: search_report, dated 2019-07-17
Rejection reasons: novelty_epc_54
Prior art cited: ref_id: US2016261465A1
ref_type: patent
severity: background
ref_id: WO2017175160A1
ref_type: patent
severity: background
ref_id: US2013269032A1
ref_type: patent
severity: background
ref_id: US2013269032
ref_type: patent
severity: background
ref_id: US2016261465
ref_type: patent
severity: novelty_destroying
ref_id: WO2017175160
ref_type: patent
severity: novelty_destroying
Final disposition: pending (2019-07-17)