System, method, and computer program for mitigating an attack on a network by effecting false alarms

A method for mitigating an attack on a network, comprising:

• monitoring, using a communication management system, a communication network that is periodically reconfigured, according to a plurality of predefined network rules, to adapt to changes in a demand for one or more services provided by the communication network, the reconfigurations involving changes to at least one of physical components or virtual components of the communication network;
• recording, using the communication management system, one or more changes to a configuration of the communication network;
• determining, using the communication management system, at least one rule of the plurality of predefined network rules that contributed to causing the one or more changes to the configuration of the communication network;
• determining, using the communication management system, at least one event that occurred in the communication network and that was considered by the at least one rule for, at least in part, causing the one or more changes to the configuration of the communication network;
• processing, using the communication management system, the at least one event, resulting in an effect to the communication network;
• determining, using the communication management system, at least one pattern of reconfigurations occurring in the configuration of the communication network, the at least one pattern including a sequence of clusters associated with the reconfigurations, where each cluster in the sequence of clusters includes the at least one event;
• determining, using the communication management system, that the at least one pattern is repeated;
• and
• in response to determining that the at least one pattern is repeated, mitigating, using the communication management system, an attack to the communication network by at least one of:
• amending the at least one rule to decrease the effect;
• or
• creating at least one additional rule to decrease the effect, the at least one additional rule being associated with the at least one event.

A device for mitigating an attack on a network, comprising:

• a non-transitory memory of a communication management system storing instructions;
• and
• one or more processors in communication with the non-transitory memory, wherein the one or more processors execute the instructions to:
• monitor a communication network that is periodically reconfigured, according to a plurality of predefined network rules, to adapt to changes in a demand for one or more services provided by the communication network, the reconfigurations involving changes to at least one of physical components or virtual components of the communication network;
• record one or more changes to a configuration of the communication network;
• determine at least one rule of the plurality of predefined network rules that contributed to causing the one or more changes to the configuration of the communication network;
• determine at least one event that occurred in the communication network and that was considered by the at least one rule for, at least in part, causing the one or more changes to the configuration of the communication network;
• process the at least one event, resulting in an effect to the communication network;
• determine at least one pattern of reconfigurations occurring in the configuration of the communication network, the at least one pattern including a sequence of clusters associated with the reconfigurations, where each cluster in the sequence of clusters includes the at least one event;
• determine that the at least one pattern is repeated;
• and
• in response to the determination that the at least one pattern is repeated, mitigate an attack to the communication network by at least one of:
• amending the at least one rule to decrease the effect;
• or creating at least one additional rule to decrease the effect, the at least one additional rule being associated with the at least one event.