Abstract: A computer implemented security method for a set of internet-of-things (IoT) devices, the set of devices comprising network-connected sensors and actuators, wherein a data repository stores data about the devices, actions performable by each of the devices and one or more network attacks to which at least a subset of the devices are susceptible, the method comprising: defining, for each network attack, one or more responsive actions for the attack, each responsive action identifying one or more performable actions for performance by one or more devices to mitigate the attack; detecting a device in a compromised state, the compromised state being determined based on a threshold number of occurrences of an attack perpetrated against the device; selecting responsive actions for the perpetrated attack; and triggering the responsive actions to mitigate the perpetrated attack.

Abstract: A method of identifying anomalous data obtained by at least one sensor of a plurality of sensors located within an environment. The method includes identifying, based on sensor data obtained from the plurality of sensors, at least one instance of a sequence of events that occurred within the environment. A probability of the sequence of events occurring within the environment under non-anomalous conditions is obtained. A frequency characteristic dependent on a frequency at which the sequence of events occurred within the environment is determined. A likelihood of the sequence of events occurring within the environment at the frequency is determined, based on a combination of the probability and the frequency characteristic. It is identified, based on the likelihood, that at least a portion of the sensor data is anomalous.

Abstract: A method of identifying anomalous network activity. The method includes identifying, based on network data representative of network activity within a network, at least one instance of a sequence of events that occurred within the network. A probability of the sequence of events occurring during non-anomalous network activity is obtained based on transition probabilities between events in the sequence of events. A frequency characteristic dependent on a frequency at which the sequence of events occurred within the network is determined. A likelihood of the sequence of events occurring within the network at the frequency is determined based on a combination of the probability and the frequency characteristic. It is identified, based on the likelihood, that at least a portion of the network data is anomalous.