Distributed feedback loops from threat intelligence feeds to distributed machine learning systems

A method comprising:

• detecting, by a distributed learning agent among a plurality of distributed learning agents located at an edge of a network, an anomaly using a locally executed machine learning-based anomaly detector configured to identify statistical deviations in characteristics of network traffic at the distributed learning agent;
• sending, by the distributed learning agent, a notification identifying the anomaly to a supervisory device that is centrally located in the network;
• receiving, at the distributed learning agent, threat intelligence feedback from the supervisory device regarding the anomaly, wherein the supervisory device matches the reported network anomaly to threat intelligence feed data received from one or more threat intelligence services, and wherein the threat intelligence feed data is collected by the supervisory device at a central location in the network, while the anomaly is detected at the edge of the network by the distributing learning agent;
• and
• adjusting, by the distributed learning agent, an operation of the locally executed machine learning-based anomaly detector based on the received threat intelligence feedback.

An apparatus, the apparatus being a supervisory device that is centrally located in a network, the apparatus comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed operable to:
• receive a notification from a distributed learning agent among a plurality of distributed learning agents located at an edge of the network, the notification identifying an anomaly which has been detected by the distributed learning agent, wherein the distributed learning agent detects the anomaly at the edge of the network using a locally executed machine learning-based anomaly detector configured to identify statistical deviations in characteristics of network traffic at the distributed learning agent;
• receive threat intelligence feed data from one or more threat intelligence services;
• match the anomaly detected by the distributed learning agent to the threat intelligence feed data;
• determine whether to provide threat intelligence feedback to the distributed learning agent based on the matched threat intelligence feed data and one or more policy rules;
• and
• provide threat intelligence feedback to the distributed learning agent regarding the matched threat intelligence feed data, in response to determining that the device should provide threat intelligence feedback to the distributed learning agent,
• wherein the providing of the threat intelligence feedback from the supervisory device that is centrally located in the network to the distributed learning agent that is located at the edge of the network causes the distributed learning agent to adjust an operation of the machine learning-based anomaly detector locally executing on the distributed learning agent.