# US 12,003,364 B2 · Compromised network node detection system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,364 B2 - Document ID: US12003364B2 - Status: Granted - Kind: B2 - Application number: 18/144,074 - Filed: 2023-05-05 - Published: 2023-08-31 - Granted: 2024-06-04 - Earliest claimed: 2018-06-27 - Assignees: T-Mobile USA, Inc. - Applicants: T-Mobile USA, Inc. - Inventors: Ahmad Arash Obaidi - Web page: https://patentgrep.com/patent/US12003364B2 ## CPC - H04L 41/0661: {by reconfiguring faulty entities} - H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06N 20/00: Machine learning - H04L 43/0817: by checking functioning - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L 43/16: Threshold monitoring - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - G06F 2009/45575: {Starting, stopping, suspending or resuming virtual machine instances} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45591: {Monitoring or debugging support} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04W 12/121: Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract An improved core network that includes a network resilience system that can detect network function virtualization (NFV)-implemented nodes that have been compromised and/or that are no longer operational, remove such nodes from the virtual network environment, and restart the removed nodes in a last-known good state is described herein. For example, the network resilience system can use health status messages provided by nodes, intrusion data provided by intrusion detection agents running on nodes, and/or operational data provided by the nodes as applied to machine learning models to identify nodes that may be compromised and/or non-operational. Once identified, the network resilience system can delete these nodes and restart or restore the nodes using the last-known good state. ## Claims ### Claim 1 A computer-implemented method comprising: applying operational data corresponding to a node implemented by a virtual machine instance running on a physical computing device in a core network as an input to a machine learning model, wherein application of the operational data as the input to the machine learning model causes the machine learning model to output an indication that the node is exhibiting anomalous behavior; determining that the node is compromised based on the indication output by the machine learning model; removing the virtual machine instance that implements the node; initiating a restored version of the virtual machine instance that implements the node in response to the virtual machine instance being removed; and preventing a first type of user allowed to access the node implemented by the virtual machine instance from accessing the node implemented by the restored version of the virtual machine instance. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein determining that the node is compromised further comprises determining that there is at least one of unauthorized access to the node implemented by the virtual machine instance, unauthorized data changes in the node implemented by the virtual machine instance, a presence of malware in the node implemented by the virtual machine instance, a presence of a virus in the node implemented by the virtual machine instance, or a presence of other malicious code in the node implemented by the virtual machine instance. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the anomalous behavior comprises at least one of unauthorized access to the node implemented by the virtual machine instance, unauthorized data changes in the node implemented by the virtual machine instance, a backup of the node implemented by the virtual machine instance occurring during a first time, or access to the node implemented by the virtual machine instance occurring during unscheduled maintenance. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, further comprising training the machine learning model using historical operational data obtained from a plurality of nodes. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the operational data comprises at least one of a backup schedule, a maintenance schedule, data indicating what types of data are modified, data indicating when the types of data are modified, data indicating which users access the node implemented by the virtual machine instance, or data indicating when the users access the node implemented by the virtual machine instance. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the restored version of the virtual machine instance comprises a most recent backup copy of the virtual machine instance. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the node implemented by the virtual machine instance comprises one of a session border controller (SBC), a breakout gateway control function (BGCF), a media gateway controller function (MGCF), a home subscriber server (HSS), an interrogating call session control function (1-CSCF), or a serving call session control function (S-CSCF). ### Claim 8 Non-transitory, computer-readable storage media comprising computer-executable instructions, wherein the computer-executable instructions, when executed by a computer system, cause the computer system to: apply operational data corresponding to a node implemented by a virtual machine instance running on a physical computing device in a core network as an input to a machine learning model, wherein application of the operational data as the input to the machine learning model causes the machine learning model to output an indication that the node is exhibiting anomalous behavior; determine that the node is compromised based on the indication output by the machine learning model; remove the virtual machine instance that implements the node; initiate a restored version of the virtual machine instance that implements the node in response to the virtual machine instance being removed; and prevent a first type of user allowed to access the node implemented by the virtual machine instance from accessing the node implemented by the restored version of the virtual machine instance. ### Claim 9 (depends on 8) The non-transitory, computer-readable storage media of claim 8, wherein the computer-executable instructions further cause the computer system to determine that there is at least one of unauthorized access to the node implemented by the virtual machine instance, unauthorized data changes in the node implemented by the virtual machine instance, a presence of malware in the node implemented by the virtual machine instance, a presence of a virus in the node implemented by the virtual machine instance, or a presence of other malicious code in the node implemented by the virtual machine instance. ### Claim 10 (depends on 8) The non-transitory, computer-readable storage media of claim 8, wherein the anomalous behavior comprises at least one of unauthorized access to the node implemented by the virtual machine instance, unauthorized data changes in the node implemented by the virtual machine instance, a backup of the node implemented by the virtual machine instance occurring during a first time, or access to the node implemented by the virtual machine instance occurring during unscheduled maintenance. ### Claim 11 (depends on 8) The non-transitory, computer-readable storage media of claim 8, wherein the computer-executable instructions further cause the computer system to train the machine learning model using historical operational data obtained from a plurality of nodes. ### Claim 12 (depends on 8) The non-transitory, computer-readable storage media of claim 8, wherein the operational data comprises at least one of a backup schedule, a maintenance schedule, data indicating what types of data are modified, data indicating when the types of data are modified, data indicating which users access the node implemented by the virtual machine instance, or data indicating when the users access the node implemented by the virtual machine instance. ### Claim 13 (depends on 8) The non-transitory, computer-readable storage media of claim 8, wherein the restored version of the virtual machine instance comprises a most recent backup copy of the virtual machine instance. ### Claim 14 (depends on 8) The non-transitory, computer-readable storage media of claim 8, wherein the node implemented by the virtual machine instance comprises one of a session border controller (SBC), a breakout gateway control function (BGCF), a media gateway controller function (MGCF), a home subscriber server (HSS), an interrogating call session control function (1-CSCF), or a serving call session control function (S-CSCF). ### Claim 15 A core network comprising: a physical computing device that hosts a virtual machine instance that implements a node of the core network; and a network system comprising a processor in communication with the physical computing device and configured with specific computer-executable instructions to: apply operational data corresponding to a node implemented by a virtual machine instance running on a physical computing device in a core network as an input to a machine learning model, wherein application of the operational data as the input to the machine learning model causes the machine learning model to output an indication that the node is exhibiting anomalous behavior; determine that the node is compromised based on the indication output by the machine learning model; remove the virtual machine instance that implements the node; initiate a restored version of the virtual machine instance that implements the node in response to the virtual machine instance being removed; and prevent a first type of user allowed to access the node implemented by the virtual machine instance from accessing the node implemented by the restored version of the virtual machine instance. ### Claim 16 (depends on 15) The core network of claim 15, wherein the network system is further configured with specific computer-executable instructions to determine that there is at least one of unauthorized access to the node implemented by the virtual machine instance, unauthorized data changes in the node implemented by the virtual machine instance, a presence of malware in the node implemented by the virtual machine instance, a presence of a virus in the node implemented by the virtual machine instance, or a presence of other malicious code in the node implemented by the virtual machine instance. ### Claim 17 (depends on 15) The core network of claim 15, wherein the anomalous behavior comprises at least one of unauthorized access to the node implemented by the virtual machine instance, unauthorized data changes in the node implemented by the virtual machine instance, a backup of the node implemented by the virtual machine instance occurring during a first time, or access to the node implemented by the virtual machine instance occurring during unscheduled maintenance. ### Claim 18 (depends on 15) The core network of claim 15, wherein the network system is further configured with specific computer-executable instructions to train the machine learning model using historical operational data obtained from a plurality of nodes. ### Claim 19 (depends on 15) The core network of claim 15, wherein the operational data comprises at least one of a backup schedule, a maintenance schedule, data indicating what types of data are modified, data indicating when the types of data are modified, data indicating which users access the node implemented by the virtual machine instance, or data indicating when the users access the node implemented by the virtual machine instance. ### Claim 20 (depends on 15) The core network of claim 15, wherein the node implemented by the virtual machine instance comprises one of a session border controller (SBC), a breakout gateway control function (BGCF), a media gateway controller function (MGCF), a home subscriber server (HSS), an interrogating call session control function (1-CSCF), or a serving call session control function (S-CSCF).