Distributed security system for vulnerability-risk-threat (VRT) detection

A security system comprising:

• a processor;
• and
• a memory coupled to the processor and configured to store instructions that, when executed by the processor, cause the security system to:
• dynamically instantiate an agent component of the security system for a 5G network in response to detecting an indication of a cyberattack to the 5G network;
• wherein the agent component is one of multiple agent components that are distributed across different 5G networks and communicatively coupled to a central component of the security system,
• wherein the agent component is configured to monitor and control incoming network traffic at a perimeter of the 5G network in accordance with a security model that defines a vulnerability parameter, a risk parameter, and a threat parameter, and
• wherein the vulnerability parameter relates to a susceptibility of the 5G network to the cyberattack, the risk parameter relates to a scope of the cyberattack, and the threat parameter relates to a source of the cyberattack;
• process, by the agent component, the incoming network traffic with the security model to output a vulnerability-risk-threat (VRT) score that characterizes the incoming network traffic in relation to the vulnerability parameter, the risk parameter, and the threat parameter;
• embed, by the agent component based on the VRT score, a tag in the incoming network traffic to indicate that the incoming network traffic includes potential malicious VRT traffic and to track the incoming network traffic through the 5G network;
• determine, by the agent component, tagged traffic information that includes whether the incoming network traffic includes malicious VRT traffic based on comparing a tracked activity of the incoming network traffic with an expected activity;
• communicate, by the agent component to a central component, at least an indication of the VRT score, the incoming network traffic, or the tagged traffic information,
• wherein the central component collects VRT information from the multiple agent components distributed at respective 5G networks and generates updates for the multiple agent components based on the collected VRT information, the VRT information including respective tagged traffic information;
• receive, by the agent component from the central component, an update that includes at least an indication of the collected VRT information from the multiple agent components distributed at the respective 5G networks, wherein the update is used to train the security model;
• and
• dynamically terminate the instantiation of the agent component once the cyberattack is thwarted as a result of an action taken by the agent component or upon expiration of a time period.

At least one non-transitory computer-readable storage medium storing instructions for execution by at least one processor, wherein execution of the instructions cause a security system to:

• detect an indication of a cyberattack to a 5G network;
• in response to the detected indication of the cyberattack, dynamically instantiating an agent component for the 5G network,
• wherein the agent component is one of multiple agent components that are distributed across different 5G networks and communicatively coupled to a central component of the security system,
• wherein the agent component is configured to monitor and control incoming network traffic at a perimeter of the 5G network in accordance with a security model that defines a vulnerability parameter, a risk parameter, and a threat parameter, and
• wherein the vulnerability parameter relates to a susceptibility of the 5G network to a cyberattack, the risk parameter relates to a scope of the cyberattack, and the threat parameter relates to a source of a cyberattack;
• processing, by the agent component, the incoming network traffic with the security model to output a vulnerability-risk-threat (VRT) score that characterizes the incoming network traffic in relation to the vulnerability parameter, the risk parameter, and the threat parameter;
• embedding, by the agent component based on the VRT score, a tag in the incoming network traffic to indicate that the incoming network traffic includes potential malicious VRT traffic and to track the incoming network traffic through the 5G network;
• determining, by the agent component, tagged traffic information that includes whether the incoming network traffic includes malicious VRT traffic based on comparing a tracked activity of the incoming network traffic with an expected activity;
• communicating, by the agent component to the central component, at least an indication of the VRT score or the tagged traffic information,
• wherein the central component collects VRT information from the multiple agent components distributed at respective 5G networks and generates updates for the multiple agent components based on the collected VRT information, the VRT information including respective tagged traffic information;
• and
• receiving, by the agent component from the central component, an update that includes at least an indication of the collected VRT information from the multiple agent components distributed at the respective 5G networks, wherein the update is used to train the security model
• dynamically terminating the instantiation of the agent component once the cyberattack is thwarted as a result of an action taken by the agent component or upon expiration of a time period.