Detection of malicious network activity

A communications device for monitoring network traffic in a communication network to detect malicious activity, the device comprising:

• a communications module for receiving network traffic between a core of the network and devices in a local distribution of the network;
• a memory for storing computer readable instructions;
• and
• a processor for executing the instructions, wherein upon executing the instructions, the processing is configured to:
• detect malicious activity in the local distribution based on a combination of:
• a local machine-learning model for identifying malicious activity in the local distribution, the local machine-learning model modelling network traffic from the local distribution;
• and
• a global machine-learning model, the global machine-learning model modelling network traffic from a plurality of local distributions of the network based training data from a plurality of local sentinel modules executed on a respective plurality of computing nodes, the computing nodes respectively receiving network traffic from the plurality of location distributions.

A method of monitoring network traffic in a communication network with a sentinel module to detect malicious activity, the method comprising:

• using a global sentinel module to receive network traffic between an Internet-of-Things (IoT) servicing system to a core of the network to communicate with IoT devices on a plurality of local distributions of the network;
• from the received network traffic, training a global machine-learning model modelling network traffic from a plurality of local distributions of the network;
• and
• instructing transmission of the global sentinel model to at least one of the local distributions for detecting malicious activity in the distribution based on a combination of the global machine-learning model and a local machine-learning model modelling network traffic from the local distribution.

A device for monitoring network traffic in a communication network to detect malicious activity, the device comprising:

• a memory for storing computer readable instructions;
• and
• a processor for executing the instructions, wherein upon executing the instructions, the processor is configured to:
• use a global sentinel module to receive network traffic between an Internet-of-Things (IoT) servicing system to a core of the network to communicate with IoT devices on a plurality of local distributions of the network;
• from the received network traffic, train a global machine-learning model modelling network traffic from a plurality of local distributions of the network;
• and
• instruct transmission of the global sentinel model to at least one of the local distributions for detecting malicious activity in the distribution based on a combination of the global machine-learning model and a local machine-learning model modelling network traffic from the local distribution.