US 12,757,023 B2Granted

Cellular IoT security using dynamic policy-driven mechanisms for threat detection and isolation

AssigneeNetskope, Inc.

InventorsMilind Gunjan, Kallol Banerjee, Jonathan Bosanac

Life of this patent

Estimating the term…

Loading patent…

Abstract

A cellular security system that uses multiple policies to protect a cellular network against various threats in a cloud-based environment. The cellular security system includes a tenant with multiple cellular devices, multiple tunnels that receive and route traffic, monitor traffic, capture real-time traffic attributes, and detect anomalies. The cellular security system further includes an anomaly detection model, an alert generator, and an anomaly reporter. The anomaly detection model retrieves baseline profiles from a threat database, loads policies related to a threat, and compares real-time traffic features with baseline profiles. The anomaly detection model further applies an anomaly detection algorithm to a traffic instance, assigns an anomaly score, and raises a flag for anomaly detection where the anomaly score is greater than a threshold. The alert generator sends an alert to the tenant in the cloud-based environment, and the anomaly reporter notifies a management plane for further remediation of the anomaly.

Claims20

Dependent claims

A cellular security system driven by a plurality of policies to protect a cellular network of a plurality of cellular networks against a plurality of threats in a cloud-based environment, the cellular security system comprises one or more hardware processors with code for:

a tenant of a plurality of tenants using the plurality of cellular networks, the tenant includes a plurality of cellular devices;
a plurality of tunnels between a cellular device of the plurality of cellular devices and the cellular network, the plurality of tunnels is operable to:
receive traffic from the cellular device at the cellular network;
route the traffic to a gateway using a plurality of network identifiers;
monitor the traffic from the cellular device at the gateway;
and
capture real-time traffic attributes and extract a plurality of relevant features;
an anomaly detection model to detect the plurality of threats in the cloud-based environment, wherein the anomaly detection model is operable to:
retrieve a plurality of baseline profiles from a threat database,
load the plurality of policies related to a threat of the plurality of threats,
compare real-time traffic features with the plurality of baseline profiles,
apply an anomaly detection algorithm to a traffic instance,
assign an anomaly score to the traffic instance,
determine whether the anomaly score is greater than a threshold to detect an anomaly, and
raise a flag for detection of the anomaly;
an alert generator to send an alert to the tenant in the cloud-based environment;
and
an anomaly reporter to notify a management plane for a remediation of the anomaly, wherein the anomaly is remediated at the management plane and the management plane is operable to:
analyze the anomaly,
correlate the anomaly with the threat database and get confirmation of the threat,
initiate a quarantined traffic by a quarantined traffic module upon confirmation of the threat, wherein the quarantined traffic module enables a security action based on a threat level of the threat, and initiates an isolation of the cellular device affected from the threat based on the threat level of either suspension at the cellular network or limiting connectivity,
send a request to update a network identifier for the quarantined traffic,
assess severity of the threat,
update the threat database with new anomaly patterns and results in real-time based on new traffic patterns, feedback, and evolving threat, and
periodically update the anomaly detection algorithm used by the anomaly detection model based on the updated threat database.

22 more elements

A method for providing cellular security using a plurality of policies to protect a cellular network against a plurality of threats in a cloud-based environment, the method for providing cellular security using one or more hardware processors, comprising:

receiving traffic from a cellular device at the cellular network;
routing the traffic to a gateway using a plurality of network identifiers;
monitoring the traffic from the cellular device at the gateway;
capturing real-time traffic attributes and extracting a plurality of relevant features;
detecting the plurality of threats using an anomaly detection model, wherein the anomaly detection model is operable to:
retrieve a plurality of baseline profiles from a threat database,
load the plurality of policies related to a threat of the plurality of threats,
compare real-time traffic features with the plurality of baseline profiles,
apply an anomaly detection algorithm to a traffic instance,
assign an anomaly score to the traffic instance, and
determine whether the anomaly score is greater than a threshold to detect an anomaly,
raising a flag for detection of the anomaly;
generating an alert to notify a tenant in the cloud-based environment upon detecting the anomaly, wherein the anomaly is remediated at a management plane and the management plane is operable to:
analyze the anomaly,
correlate the anomaly with the threat database and get confirmation of the threat,
initiate a quarantined traffic by a quarantined traffic module upon confirmation of the threat, wherein the quarantined traffic module enables a security action based on a threat level of the threat, and initiates an isolation of the cellular device affected from the threat based on the threat level of either suspension at the cellular network or limiting connectivity,
send a request to update a network identifier for the quarantined traffic,
assess severity of the threat,
update the threat database with new anomaly patterns and results in real-time based on new traffic patterns, feedback, and evolving threat, and
periodically update the anomaly detection algorithm used by the anomaly detection model based on the updated threat database.

17 more elements

A non-transitory computer-readable media having computer-executable instructions embodied thereon that, when executed by one or more processors, facilitate a method for providing cellular security using a plurality of policies to protect a cellular network against a plurality of threats in a cloud-based environment, the method for providing cellular security comprising:

receiving traffic from a cellular device at the cellular network;
routing the traffic to a gateway using a plurality of network identifiers;
monitoring the traffic from the cellular device at the gateway;
capturing real-time traffic attributes and extracting a plurality of relevant features;
detecting the plurality of threats using an anomaly detection model, wherein the anomaly detection model is operable to:
retrieve a plurality of baseline profiles from a threat database,
load the plurality of policies related to a threat of the plurality of threats,
compare real-time traffic features with the plurality of baseline profiles,
apply an anomaly detection algorithm to a traffic instance,
assign an anomaly score to the traffic instance, and
determine whether the anomaly score is greater than a threshold to detect an anomaly,
raising a flag for detection of the anomaly;
generating an alert to notify a tenant in the cloud-based environment upon detecting the anomaly, wherein the anomaly is remediated at a management plane and the management plane is operable to:
analyze the anomaly,
correlate the anomaly with the threat database and get confirmation of the threat,
initiate a quarantined traffic by a quarantined traffic module upon confirmation of the threat, wherein the quarantined traffic module enables a security action based on a threat level of the threat, and initiates an isolation of the cellular device affected from the threat based on the threat level of either suspension at the cellular network or limiting connectivity,
send a request to update a network identifier for the quarantined traffic,
assess severity of the threat,
update the threat database with new anomaly patterns and results in real-time based on new traffic patterns, feedback, and evolving threat, and
periodically update the anomaly detection algorithm used by the anomaly detection model based on the updated threat database.

17 more elements

Dependencies are inferred from the claim text.

Facts

Application: 19/044,404Filed 3 Feb 2025 · continuation
Priority: 24 Jul 2024
Published: US 2026/0032444 A129 Jan 2026
Granted: 6 Oct 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification3 codes

H04W 12/122
Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]: counter-measures against attacks; Protection against…
H04W 12/088
Access security: using filters or firewalls
H04W
Wireless communication networks