US 11,902,311 B2Granted

Communications methods and apparatus for dynamic detection and/or mitigation of threats and/or anomalies

AssigneeRibbon Communications Operating Company, Inc.

InventorsSridhar Kuppanna, Dilnawaj Ahmed, Shaun Jaikarran Bharrat, Timothy R. Thornton, Justin Hart, Kevin Riley

Life of this patent

Estimating the term…

Loading patent…

Abstract

The present invention relates to methods and apparatus for dynamically detecting and/or mitigating threats in communications systems. Exemplary methods and apparatus of the present invention allow for a combination of automated and operator controlled responses to threats. While an operator is provided an opportunity to provide input on how to respond to a threat, after one or more threats of a given type are identified, the system will automatically take corrective action without waiting for operator input and/or in the absence of operator input following notification of a threat.

Claims21

Dependent claims

A method of operating a communication system comprising:

processing, at a first node executing an application for threat detection and mitigation, a first set of traffic data including information about system traffic corresponding to a first time period, one or more pieces of data in said first set of traffic data being provided by sensors or sensor enforcer nodes monitoring traffic;
detecting, based on the first set of traffic data, a first set of traffic instances which are found to be a first threat of a first type;
notifying an operator of the first threat of the first type;
monitoring to detect a response from the operator indicating an action to be taken in the system in response to the first threat of the first type;
and
in response to detecting an operator indicated action to be taken in response to the first threat of the first type, implementing said action;
in response to failing to detect an operator indicated action to be taken in response to the first threat of the first type within a predetermined time, continuing system operation without taking an action in response to the first threat of the first type;
storing information about the first threat of the first type and any action taken in response to the first threat of the first type;
processing, at the first node, a second set of traffic data including information about system traffic corresponding to a second time period, said second time period following said first time period;
detecting, based on the second set of traffic data, a second set of traffic instances which are found to be a second threat of the first type;
notifying the operator of the second threat of the first type, said notifying the operator of the second threat of the first type including sending a notification including alarm information to a plurality of computing devices of the operator;
monitoring to detect a response from the operator indicating an action to be taken in response to the second threat of the first type;
and
in response to failing to detect an operator indicated action to be taken in response to the second threat of the first type in a predetermined time,
checking to determine if the second threat of the first type corresponds to an increased rate of threats of the first type or an increased level of threat and
if the detected threat corresponds to an increased rate of threats or an increased level of threat taking an automated action in response to the second threat of the first type in the absence of operator input.

13 more elements

A method of operating a communication system comprising:

processing, at a first node executing an application for threat detection and mitigation, a first set of traffic data including information about system traffic corresponding to a first time period, one or more pieces of data in said first set of traffic data being provided by sensors or sensor enforcer nodes monitoring traffic;
detecting, based on the first set of traffic data, a first set of traffic instances which are found to be a first threat of a first type;
notifying an operator of the first threat of the first type;
monitoring to detect a response from the operator indicating an action to be taken in the system in response to the first threat of the first type;
and
in response to detecting an operator indicated action to be taken in response to the first threat of the first type, implementing said action;
in response to failing to detect an operator indicated action to be taken in response to the first threat of the first type within a predetermined time, continuing system operation without taking an action in response to the first threat of the first type;
storing information about the first threat of the first type and any action taken in response to the first threat of the first type;
wherein the first set of traffic data includes Real-time Transport Protocol (RTP) application meta-data, raw RTP data Real-time Transport Control Protocol (RTCP) application meta-data, and raw RTCP data;
wherein the first set of traffic instances are detected based on automated analysis of the RTP application meta-data, the raw RTP data, the RTCP application meta-data, and the raw RTCP data;
wherein the first set of traffic instances contains a set of characteristics or patterns that match a set of characteristics or patterns which is indicative of a threat of the first type.

8 more elements

A communications system comprising:

a storage device;
and
a first node, said first node including:
one or more processors configured to control the operation of the first node to perform one or more threat detection and mitigation operations including:
processing a first set of traffic data including information about system traffic corresponding to a first time period, one or more pieces of data in said first set of traffic data being provided by sensors or sensor enforcer nodes monitoring traffic;
detecting, based on the first set of traffic data, a first set of traffic instances which are found to be a first threat of a first type;
notifying an operator of the first threat of the first type;
monitoring to detect a response from the operator indicating an
action to be taken in the system in response to the first threat of the first type;
in response to detecting an operator indicated action to be taken in response to the first threat of the first type, implementing said action;
in response to failing to detect an operator indicated action to be taken in response to the first threat of the first type within a first predetermined time, continuing system operation without taking an action in response to the first threat of the first type;
storing information about the first threat of the first type and any action taken in response to the first threat of the first type in the storage device;
processing, at the first node, a second set of traffic data including information about system traffic corresponding to a second time period, said second time period following said first time period;
detecting, based on the second set of traffic data, a second set of traffic instances which are found to be a second threat of the first type;
notifying the operator of the second threat of the first type, said notifying the operator of the second threat of the first type including sending a notification including alarm information to a plurality of computing devices of the operator;
monitoring to detect a response from the operator indicating an action to be taken in response to the second threat of the first type;
and
in response to failing to detect an operator indicated action to be taken in response to the second threat of the first type in a predetermined time,
checking to determine if the second threat of the first type corresponds to an increased rate of threats of the first type or an increased level of threat;
and
if the detected threat corresponds to an increased rate of threats or an increased level of threat taking an automated action in response to the second threat of the first type in the absence of operator input.

18 more elements

A non-transitory computer readable medium including a first set of computer executable instructions which when executed by a processor of a node cause the node to:

process a first set of traffic data including information about system traffic corresponding to a first time period, one or more pieces of data in said first set of traffic data being provided by sensors or sensor enforcer nodes monitoring traffic;
detect, based on the first set of traffic data, a first set of traffic instances which are found to be a first threat of a first type;
notify an operator of the first threat of the first type;
monitor to detect a response from the operator indicating an action to be taken in a system in response to the first;
threat of the first type;
in response to detecting an operator indicated action to be taken in response to the first, threat of the first type, implementing said action;
in response to failing to detect an operator indicated action to be taken in response to the first threat of the first type within a first predetermined time, continuing system operation without taking an action in response to the first;
threat of the first type;
store in a storage device information about the first threat of the first type and any action taken in response to the first threat of the first type;
process at the node a second set of traffic data including information about system traffic corresponding to a second time period, said second time period following said first time period;
detect, based on the second set of traffic data, a second set of traffic instances which are found to be a second threat of the first type;
notify the operator of the second threat of the first type, said notifying the operator of the second threat of the first type including sending a notification including alarm information to a plurality of computing devices of the operator;
monitor to detect a response from the operator indicating an action to be taken in response to the second threat of the first type;
and
in response to failing to detect an operator indicated action to be taken in response to the second threat of the first type in a predetermined time,
check to determine if the second threat of the first type corresponds to an increased rate of threats of the first type or an increased level of threat;
and
if the detected threat corresponds to an increased rate of threats or an increased level of threat take an automated action in response to the second threat of the first type in the absence of operator input.

15 more elements

A communications system comprising:

a storage device;
and
a first node, said first node including:
one or more processors configured to control the operation of the first node to perform one or more threat detection and mitigation operations including:
processing at the first node a first set of traffic data including information about system traffic corresponding to a first time period, one or more pieces of data in said first set of traffic data set being provided by sensors or sensor enforcer nodes monitoring traffic;
detecting, based on the first set of traffic data, a first set of traffic instances which are found to be a first threat of a first type;
notifying an operator of the first threat of the first type;
monitoring to detect a response from the operator indicating an action to be taken in the system in response to the first threat of the first type;
and
in response to detecting an operator indicated action to be taken in response to the first threat of the first type, implementing said action;
in response to failing to detect an operator indicated action to be taken in response to the first threat of the first type within a predetermined time, continuing system operation without taking an action in response to the first threat of the first type;
storing information about the first threat of the first type and any action taken in response to the first threat of the first type in the storage device;
wherein the first set of traffic data includes Real-time Transport Protocol (RTP) application meta-data, raw RTP data, Real-time Transport Control Protocol (RTCP) application meta-data, and raw RTCP data;
wherein the first set of traffic instances are detected based on automated analysis of the RTP application meta-data, the raw RTP data, the RTCP application meta-data and the raw RTCP data;
wherein the first set of traffic instances contains a set of characteristics or patterns that match a set of characteristics or patterns which is indicative of a threat of the first type.

12 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/091,898Filed 30 Dec 2022 · continuation
Priority: 13 Jul 2018
Published: US 2023/0133681 A14 May 2023
Granted: 13 Feb 2024
Term ends: Not estimatedThe source records don’t support an estimate.

Classification12 codes

H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
H04L 63/205
For managing network security; network security policies in general: involving negotiation or determination of the one or more network security…
H04L 47/24
Flow control; Congestion control: traffic characterised by specific attributes, e.g. priority or QoS
H04L 63/0227
For separating internal from external traffic, e.g. firewalls: filtering policies

Family

Application62/697,901Us provisional application · filed 13 Jul 2018
Application62/703,848Us provisional application · filed 26 Jul 2018
Application16/057,114Parent of this continuation-in-part · filed 7 Aug 2018
Application16/283,600Parent of this continuation · filed 22 Feb 2019
US 10,659,485 B2Parent of this continuation-in-part · filed 19 May 2020
Application17/149,608Parent of this continuation · filed 14 Jan 2021
US 10,931,696 B2Parent of this continuation · filed 23 Feb 2021
US 2023/0133681 A1Pre-grant publication · published 4 May 2023
US 11,570,191 B2Parent of this continuation
Application16/283,600Parent of this continuation-in-part
US 2019/0173898 A1Published application
US 2020/0021609 A1Published application
US 2021/0144166 A1Published application
US 11,902,311 B2This patent

From the US filing history. Foreign family members aren’t listed.