# US 12,003,542 B2 · Rapid initial deployment database security model

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,542 B2
- Document ID: US12003542B2
- Status: Granted
- Kind: B2
- Application number: 17/148,684
- Filed: 2021-01-14
- Published: 2022-07-14
- Granted: 2024-06-04
- Earliest claimed: 2021-01-14
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Sheng Yan Sun; Shuo Li; Xiaobo Wang; Jun Wang; Hua Wang; Shidong Shan; Xing Xing Jing
- Web page: https://patentgrep.com/patent/US12003542B2

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 18/22: Matching criteria, e.g. proximity measures
- G06F 18/24143: {Distances to neighbourhood prototypes, e.g. restricted Coulomb energy networks [RCEN]}
- G06N 3/09: Supervised learning
- G06N 3/098: Distributed learning, e.g. federated learning
- G06N 20/00: Machine learning
- H04L 63/102: {Entity profiles}
- G06N 3/045: Combinations of networks
- G06N 3/08: Learning methods
- H04L 63/104: {Grouping of entities}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

A method, system, and computer program product for recommending an initial database security model. The method may include identifying a plurality of nodes connected to a security network. The method may also include analyzing security characteristics of each node of the plurality of nodes. The method may also include identifying, from the security characteristics, key factors for each node. The method may also include calculating similarities between each node of the plurality of nodes. The method may also include building a self-organized centerless network across the plurality of nodes by grouping nodes with high similarities based on the similarities between each node, where the self-organized centerless network is a centerless network without a central management server, and includes groups of nodes from the plurality of nodes. The method may also include generating federated security models for the groups of nodes.

## Claims

### Claim 1

A computer-implemented method comprising:
identifying a plurality of nodes connected to a security network;
analyzing security characteristics of each node of the plurality of nodes, wherein the security characteristics comprise at least one of data regarding security policies and data regarding security server layers;
identifying, from the security characteristics, key factors for each node;
calculating similarities between each node of the plurality of nodes using the key factors;
building a self-organized centerless network across the plurality of nodes by grouping nodes based on the similarities between each node, resulting in groups of nodes; and
generating federated security models for the groups of nodes.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
determining that a new node is added to the security network;
calculating similarities between the new node and each of the plurality of nodes;
selecting nodes from the plurality of nodes with a close relationship to the new node, resulting in selected nodes;
generating a second federated security model for the new node based on the selected nodes; and
deploying the second federated security model on the new node.

### Claim 3 (depends on 2)

The method of claim 2, wherein generating the second federated security model for the new node comprises:
identifying a federated security model from the federated security models that corresponds to a highest amount of nodes from the selected nodes, resulting in a best match security model; and
selecting the best match security model as the second federated security model.

### Claim 4 (depends on 2)

The method of claim 2, wherein generating the second federated security model for the new node comprises:
analyzing the federated security models that correspond to the selected nodes; and
synthesizing the federated security models that correspond to the selected nodes, resulting in a synthesized security model for the group of nodes, wherein the synthesized security model is the federated security model.

### Claim 5 (depends on 4)

The method of claim 4, wherein synthesizing the federated security models that correspond to the selected nodes comprises:
identifying one or more parameters used in the federated security models;
determining a set of parameters for the second federated security model based on the one or more parameters; and
generating the second federated security model from the set of parameters for the second federated security model.

### Claim 6 (depends on 5)

The method of claim 5, wherein determining the set of parameters for the second federated security model comprises:
performing parameter averaging techniques on the federated security models that correspond to the selected nodes, resulting in the set of parameters for the second federated security model.

### Claim 7 (depends on 1)

The method of claim 1, wherein building the self-organized centerless network across the plurality of nodes comprises:
generating a node relationship map for the plurality of nodes; and
grouping the nodes with high similarities based on the node relationship map, resulting in the groups of nodes.

### Claim 8 (depends on 7)

The method of claim 7, wherein grouping nodes the nodes with high similarities comprises:
generating a closest neighbors list for each node from the plurality of nodes using the node relationship map;
determining a relationship threshold based on the node relationship map and the closest neighbors list;
comparing each node relationship to the relationship threshold; and
forming groups of nodes comprising nodes with relationships above the relationship threshold.

### Claim 9 (depends on 1)

The method of claim 1, wherein generating the federated security models for the groups of nodes comprises:
generating a federated security model for each group of nodes from the groups of nodes, wherein generating the federated security model comprises:
identifying a machine learning model for the security network, wherein the machine learning model was built and trained using historical data;
generating a node security model for each node of the group of nodes, wherein the node security model comprises an architectural model;
performing parameter averaging techniques on each node security model, resulting in a set of parameters for the group of nodes; and
generating the federated security model from the set of parameters.

### Claim 10 (depends on 9)

The method of claim 9, wherein generating the node security model comprises:
selecting a node from the group of nodes;
inputting the key factors for the node into the machine learning model; and
outputting the architectural model for the node including at least a deployment layer structure for the node.

### Claim 11 (depends on 1)

The method of claim 1, wherein each group of nodes from the groups of nodes comprises nodes with strong relationships between each node in the group of nodes.

### Claim 12

A system having one or more computer processors, the system configured to:
identify a plurality of nodes connected to a security network;
analyze security characteristics of each node of the plurality of nodes;
identify, from the security characteristics, key factors for each node;
calculate similarities between each node of the plurality of nodes using the key factors;
build a self-organized centerless network across the plurality of nodes by grouping nodes based on the similarities between each node, resulting in groups of nodes; and
generate federated security models for the groups of nodes.

### Claim 13 (depends on 12)

The system of claim 12, the system further configured to:
determine that a new node is added to the security network;
calculate similarities between the new node and each of the plurality of nodes;
select nodes from the plurality of nodes with a close relationship to the new node, resulting in selected nodes;
generate a second federated security model for the new node based on the selected nodes; and
deploy the second federated security model on the new node.

### Claim 14 (depends on 12)

The system of claim 12, wherein building the self-organized centerless network across the plurality of nodes comprises:
generating a node relationship map for the plurality of nodes; and
grouping the nodes with high similarities based on the node relationship map, resulting in the groups of nodes.

### Claim 15 (depends on 14)

The system of claim 14, wherein grouping nodes the nodes with high similarities comprises:
generating a closest neighbors list for each node from the plurality of nodes using the node relationship map;
determining a relationship threshold based on the node relationship map and the closest neighbors list;
comparing each node relationship to the relationship threshold; and
forming groups of nodes comprising nodes with relationships above the relationship threshold.

### Claim 16 (depends on 12)

The system of claim 12, wherein generating the federated security models for the groups of nodes comprises:
generating a federated security model for each group of nodes from the groups of nodes, wherein generating the federated security model comprises:
identifying a machine learning model for the security network, wherein the machine learning model was built and trained using historical data;
generating a node security model for each node of the group of nodes, wherein the node security model comprises an architectural model;
performing parameter averaging techniques on each node security model, resulting in a set of parameters for the group of nodes; and
generating the federated security model from the set of parameters.

### Claim 17

A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a server to cause the server to perform a method, the method comprising:
identifying a plurality of nodes connected to a security network;
analyzing security characteristics of each node of the plurality of nodes;
identifying, from the security characteristics, key factors for each node;
calculating similarities between each node of the plurality of nodes using the key factors;
building a self-organized centerless network across the plurality of nodes by grouping nodes based on the similarities between each node, resulting in groups of nodes; and
generating federated security models for the groups of nodes.

### Claim 18 (depends on 17)

The computer program product of claim 17, further comprising:
determining that a new node is added to the security network;
calculating similarities between the new node and each of the plurality of nodes;
selecting nodes from the plurality of nodes with a close relationship to the new node, resulting in selected nodes;
generating a second federated security model for the new node based on the selected nodes; and
deploying the second federated security model on the new node.

### Claim 19 (depends on 17)

The computer program product of claim 17, wherein building the self-organized centerless network across the plurality of nodes comprises:
generating a node relationship map for the plurality of nodes; and
grouping the nodes with high similarities based on the node relationship map, resulting in the groups of nodes.

### Claim 20 (depends on 17)

The computer program product of claim 17, wherein generating the federated security models for the groups of nodes comprises:
generating a federated security model for each group of nodes from the groups of nodes, wherein generating the federated security model comprises:
identifying a machine learning model for the security network, wherein the machine learning model was built and trained using historical data;
generating a node security model for each node of the group of nodes, wherein the node security model comprises an architectural model;
performing parameter averaging techniques on each node security model, resulting in a set of parameters for the group of nodes; and
generating the federated security model from the set of parameters.