Monitoring network activity
AssigneeBlackBerry Limited
InventorsPaul Wilson LeMarquand, Kristian Neil Spriggs, David Brian Seel
Life of this patent
Estimating the term…
Abstract
A method for monitoring network activity includes initiating a training phase by a machine learning (ML) server. Data associated with normal network traffic through the ML server during the training phase is collected. A classification model is generated based on the collected data. The ML server switches the training phase to an active phase. An outbound request is received during the active phase. Whether the outbound request is an anomalous request is determined based on the classification model.
Claims19
A method, comprising:
- initiating, by a machine learning (ML) server, a training phase;
- collecting, by the ML server and during the training phase, data associated with normal network traffic through the ML server;
- generating, by the ML server, a classification model based on the collected data;
- switching, by the ML server, from the training phase to an active phase;
- receiving, by the ML server and during the active phase, an outbound request;
- determining, by the ML server, whether the outbound request is an anomalous request based on the classification model;
- detecting, by the ML server, a completion of a software update in a communication network system that is monitored by the ML server during the active phase;
- and
- in response to detecting the completion of the software update in the communication network system, switching, by the ML server, from the active phase to the training phase.
A non-transitory computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:
- initiating, by a machine learning (ML) server, a training phase;
- collecting, by the ML server and during the training phase, data associated with normal network traffic through the ML server;
- generating, by the ML server, a classification model based on the collected data;
- switching, by the ML server, from the training phase to an active phase;
- receiving, by the ML server and during the active phase, an outbound request;
- determining, by the ML server, whether the outbound request is an anomalous request based on the classification model;
- detecting, by the ML server, a completion of a software update in a communication network system that is monitored by the ML server during the active phase;
- and
- in response to detecting the completion of the software update in the communication network system, switching, by the ML server, from the active phase to the training phase.
A computer-implemented system, comprising:
- one or more computers;
- and
- one or more computer memory devices interoperably coupled with the one or more computers and having machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:
- initiating, by a machine learning (ML) server, a training phase;
- collecting, by the ML server and during the training phase, data associated with normal network traffic through the ML server;
- generating, by the ML server, a classification model based on the collected data;
- switching, by the ML server, from the training phase to an active phase;
- receiving, by the ML server and during the active phase, an outbound request;
- determining, by the ML server, whether the outbound request is an anomalous request based on the classification model;
- detecting, by the ML server, a completion of a software update in a communication network system that is monitored by the ML server during the active phase;
- and
- in response to detecting the completion of the software update in the communication network system, switching, by the ML server, from the active phase to the training phase.
Dependencies are inferred from the claim text.