# US 12,225,032 B2 · Method of analysing anomalous network traffic > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,032 B2 - Document ID: US12225032B2 - Status: Granted - Kind: B2 - Application number: 17/915,466 - Filed: 2021-03-05 - Published: 2023-04-27 - Granted: 2025-02-11 - Earliest claimed: 2020-03-31 - Assignees: British Telecommunications public limited company - Applicants: British Telecommunications Public Limited Company - Inventors: Claudia Cristina; Simon Beddus; Fadi El-Moussa - Web page: https://patentgrep.com/patent/US12225032B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 2463/146: Tracing the source of attacks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer-implemented method of analysing anomalous network traffic in a telecommunications network, said telecommunications network comprising a plurality of network entities (120, 110) and a security analyser (130-3), wherein the method comprises the steps of: receiving at the security analyser a network communication from a first network entity; identifying the first network entity; by means of the security analyser: analysing the network communication and/or a performance of the first network entity thereby to identify the network communication as an anomalous communication (310); in response to identifying the network communication as an anomalous communication, communicating an instruction to the identified first network entity to respond with origin information regarding the anomalous communication, wherein the origin information identifies a preceding network entity from which the anomalous communication was directly received by the first network entity (320, 330); and commencing with the preceding network entity, iteratively communicating an instruction to a preceding network entity to respond with origin information for identifying another preceding network entity from which the anomalous communication was directly received until a source network entity from which the anomalous communication originated is identified (380, 390; and applying a security policy to the identified source network entity (370). ## Claims ### Claim 1 A computer-implemented method of analysing anomalous network traffic in a telecommunications network, said telecommunications network comprising a plurality of network entities and a security analyser, wherein the method comprises the steps of: receiving at the security analyser a network communication from a first network entity; identifying the first network entity; by means of the security analyser: analysing the network communication and/or a performance of the first network entity thereby to identify the network communication as an anomalous communication; in response to identifying the network communication as an anomalous communication, communicating an instruction to the identified first network entity to respond with origin information regarding the anomalous communication, wherein the origin information identifies a preceding network entity from which the anomalous communication was directly received by the first network entity; and commencing with the preceding network entity, iteratively communicating an instruction to a preceding network entity to respond with origin information for identifying another preceding network entity from which the anomalous communication was directly received until a source network entity from which the anomalous communication originated is identified; and applying a security policy to the identified source network entity; and generating the security policy in dependence on a signature of the anomalous communication that is generated in dependence on each origin information; wherein communicating each instruction is performed in response to determining that only an incomplete signature of the anomalous communication can be generated. ### Claim 2 (depends on 1) A method according to claim 1, wherein the anomalous communication is caused by a malicious attack on the network or a fault within the network. ### Claim 3 (depends on 1) A method according to any claim 1, wherein analysing the network communication comprises analysing a/an: characteristic of the network communication; traffic flow; originating network address; data packet size; a count of data packets; noisy traffic pattern; invalid data packet attribute; a communication protocol; and/or payload data of a data packet. ### Claim 4 (depends on 1) A method according to claim 1, wherein analysing the performance of the first network entity comprises analysing usage of processing and/or memory resources. ### Claim 5 (depends on 1) A method according to claim 1, wherein the origin information comprises in relation to the anomalous communication a: network address; communication protocol type; characteristic payload data; and/or data type. ### Claim 6 (depends on 1) A method according to claim 1, wherein at least one of the plurality of network entities is in the form of an Internet of Things device. ### Claim 7 (depends on 6) A method according to claim 6, wherein the anomalous communication is communicated directly between a series of network entities that are each in the form of an Internet of Things device. ### Claim 8 (depends on 1) A method according to claim 1, wherein the instruction causes a pushback mechanism so as to respond with the origin information. ### Claim 9 (depends on 1) A method according to claim 1, wherein the origin information is retrieved from local memory of the network entity from which said origin information is requested. ### Claim 10 (depends on 1) A method according to claim 1, further comprising the step of applying the security policy to the first network entity. ### Claim 11 (depends on 1) A method according to claim 1, further comprising the step of applying the security policy to every preceding network entity. ### Claim 12 (depends on 1) A method according to claim 1, wherein the security policy is configured to: control a network entity; control traffic to and/or from a network entity; control an application provided by a network entity; and/or reconfigure a network function of a network entity. ### Claim 13 (depends on 1) A computer-readable storage medium comprising instructions that, when executed by a processor associated with the telecommunication network, causes the telecommunication network to perform the method according to claim 1. ### Claim 14 A telecommunications network comprising: a plurality of network entities, including a first network entity; a security analyser, wherein security analyser is configured to receive a network communication from the first network entity; identify the first network entity; analyse the network communication and/or a performance of the first network entity thereby to identify the network communication as an anomalous communication; in response to identifying the network communication as an anomalous communication, communicate an instruction to the identified first network entity to respond with origin information regarding the anomalous communication, wherein the origin information identifies a preceding network entity from which the anomalous communication was directly received by the first network entity; and commencing with the preceding network entity, iteratively communicate an instruction to a preceding network entity to respond with origin information for identifying another preceding network entity from which the anomalous communication was directly received until a source network entity from which the anomalous communication originated is identified; and a remediator for applying a security policy to the identified source network entity; wherein: the security analyser is further configured to generate the security policy in dependence on a signature of the anomalous communication that is generated in dependence on the origin information; and the communication of the instruction is performed in response to a determination that only an incomplete signature of the anomalous communication can be generated. ### Claim 15 (depends on 14) A telecommunications network according to claim 14, wherein the security analyser and/or the remediator form part of a distributed computing system. ### Claim 16 A security analyser comprising storage memory storing computer-readable code and at least one processor which upon execution of the code enables the security analyser to at least be configured to: receive a network communication from a first network entity; identify the first network entity; analyse the network communication and/or a performance of the first network entity thereby to identify the network communication as an anomalous communication; in response to identifying the network communication as an anomalous communication, communicate an instruction to the identified first network entity to respond with origin information regarding the anomalous communication, wherein the origin information identifies a preceding network entity from which the anomalous communication was directly received by the first network entity; and commencing with the preceding network entity, iteratively communicate an instruction to a preceding network entity to respond with origin information for identifying another preceding network entity from which the anomalous communication was directly received until a source network entity from which the anomalous communication originated is identified; and apply a security policy to the identified source network entity; wherein: the security analyser is further configured to generate the security policy in dependence on a signature of the anomalous communication that is generated in dependence on the origin information; and the communication of the instruction is performed in response to a determination that only an incomplete signature of the anomalous communication can be generated.