US 12,506,761 B2 · Method of threat detection in a threat detection network and threat detection network utilizing threat detection model and local consistency model

Abstract

A network node of a threat detection network, a backend system of a threat detection network including interconnected network nodes and a backend system, a threat detection network and a threat detection method for such network detect network threats. The backend system utilizes a backend threat detection model, and at least part of f the network nodes include security agent modules collecting data related to the respective network node. The network nodes utilize a local threat detection model and a local consistency model. The local consistency model provides confidence level information between the local and backend detection models. The method includes collecting data related to the network node by the security agent module at the network node, applying local threat detection model to the collected data, and making a decision at the endpoint based on the results of the local threat detection model and consistency models.

Claims20

Dependent claims

A method of threat detection in a threat detection network, the threat detection network comprising interconnected network nodes and a backend system,

wherein the backend system utilizes a backend threat detection model,
wherein at least part of the network nodes comprise security agent modules which collect data related to the respective network node, and wherein the network nodes utilize a local threat detection model and a local consistency model,
wherein the local consistency model is configured to provide a confidence level information between the local threat detection model and the backend threat detection model,
wherein the method comprises:
collecting data related to the network node by the security agent module at the network node,
applying local threat detection model to the collected data, and
making a security related decision at the endpoint based on the results of the local threat detection model and the local consistency model.

4 more elements

Network node of a threat detection network, the network comprising interconnected network nodes and a backend system, wherein

the network node comprises at least one or more processors and at least one security agent module which is configured to collect data related to the respective network node, and
the network node is further configured to utilize a local threat detection model and a local consistency model,
wherein the local consistency model trained and/or provided by the backend system is configured to provide a confidence level information between the local threat detection model and the backend threat detection model,
wherein the network node is configured to:
collect data related to the network node by the security agent module at the network node,
apply local threat detection model to the collected data, and
make a security related decision at the endpoint based on the results of the local threat detection model and the local consistency model.

4 more elements

Dependencies are inferred from the claim text.

Method of threat detection in a threat detection network and threat detection network utilizing threat detection model and local consistency model

Life of this patent

Method of threat detection in a threat detection network and threat detection network utilizing threat detection model and local consistency model

Life of this patent

Abstract

Claims20