US 11,838,195 B2
Deployable network sensor for multiple platforms
John Brosnan, Galway (IE); Jeff Myers, Somerville, MA (US); Andriy Lyubka, Galway (IE); Darragh Delaney, Claremorris (IE); Erran Carey, Newtownabbey (GB); Martin Hutchings, Lisburn (GB); Ralph McTeggart, Belfast (GB); Ryan Williams, Belfast (GB); Daniel Skelton, Belfast (GB); Luke Coughlan, Galway (IE); Gianpaolo Tedesco, Seoul (KR); Luis Ramos dos Santos Lopes, Galway (IE); Lars-Kristian Svenoy, Belfast (GB); Dan-Adrian Moinescu, Braila (RO); Niall Cochrane, Belfast (GB); Morgan Doyle, Kinvara (IE); and Sarah Addis, Belfast (GB)
Assigned to Rapid7, Inc., Boston, MA (US)
Filed by Rapid7, Inc., Boston, MA (US)
Filed on Jun. 29, 2022, as Appl. No. 17/852,763.
Application 17/852,763 is a continuation of application No. 17/462,100, filed on Aug. 31, 2021, granted, now 11,411,851.
Prior Publication US 2023/0065596 A1, Mar. 2, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 67/12 (2022.01); H04L 41/046 (2022.01); H04L 43/0894 (2022.01); H04L 9/40 (2022.01); G06F 9/445 (2018.01); G06F 9/455 (2018.01); H04L 43/028 (2022.01); H04L 69/16 (2022.01); H04L 47/35 (2022.01); H04L 47/36 (2022.01); H04L 47/2441 (2022.01); H04L 41/0806 (2022.01)
CPC H04L 43/0894 (2013.01) [G06F 9/445 (2013.01); G06F 9/455 (2013.01); H04L 43/028 (2013.01); H04L 63/14 (2013.01); H04L 69/16 (2013.01); H04L 41/046 (2013.01); H04L 41/0806 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A method, comprising:
performing, by one or more processors that implement a network sensor host in a network:
receiving a network sensor package from a network sensor deployment (NSD) server;
executing the network sensor package, wherein the execution comprises:
launching a container on network sensor host,
launching a network sensor inside the container, wherein the network sensor comprises:
(a) a deep packet inspection (DPI) application,
(b) an intrusion detection system (IDS) application, and
(c) an intrusion prevention system (IPS) application,
requesting configuration information for the network sensor from the NSD server, and
configuring the network sensor based on the configuration information, wherein the network sensor is configured to send status or health beacons to the NSD server, indicating one or more of: a link status of the network sensor, traffic rate(s) of the network sensor, drop rate(s) of the network sensor, memory usage of the network sensor, and a Switched Port Analyzer (SPAN) status of the network sensor;
collecting data about the network using the network sensor; and
sending the collected data to a remote cybersecurity platform monitoring the network.