Compromised network node detection system
AssigneeT-Mobile USA, Inc.
InventorAhmad Arash Obaidi
Life of this patent
Estimating the term…
Abstract
An improved core network that includes a network resilience system that can detect network function virtualization (NFV)-implemented nodes that have been compromised and/or that are no longer operational, remove such nodes from the virtual network environment, and restart the removed nodes in a last-known good state is described herein. For example, the network resilience system can use health status messages provided by nodes, intrusion data provided by intrusion detection agents running on nodes, and/or operational data provided by the nodes as applied to machine learning models to identify nodes that may be compromised and/or non-operational. Once identified, the network resilience system can delete these nodes and restart or restore the nodes using the last-known good state.
Claims20
A computer-implemented method comprising:
- obtaining a health status message from a first node in a plurality of nodes, wherein the plurality of nodes are each implemented by a virtual machine instance running in a virtual computing environment in a core network;
- determining that a second node in the plurality of nodes has not provided a second health status message;
- transmitting a message to the second node to provide an acknowledgment that the message is received;
- determining that the second node has not responded to the message within a threshold period of time;
- transmitting a second message to the first node and other nodes in the plurality of nodes requesting an acknowledgment that the second message is received;
- determining that the first node and the other nodes responded to the second message;
- obtaining a backup copy of the virtual machine instance that implements the second node;
- deleting the virtual machine instance that implements the second node from the virtual computing environment;
- and
- starting a restored version of the virtual machine instance that implements the second node.
Non-transitory, computer-readable storage media comprising computer-executable instructions, wherein the computer-executable instructions, when executed by a computer system, cause the computer system to:
- obtain a health status message from a first node in a plurality of nodes, wherein the plurality of nodes are each implemented by a virtual machine instance running on a physical computing device in a core network;
- determine that a second node in the plurality of nodes has not provided a second health status message;
- attempt to contact the second node;
- in response to a failure to contact the second node, transmit a second message to the first node and other nodes in the plurality of nodes requesting an acknowledgment that the second message is received;
- determine that the first node and the other nodes responded to the second message;
- obtain a backup copy of the virtual machine instance that implements the second node;
- delete the virtual machine instance that implements the second node;
- and
- start a restored version of the virtual machine instance that implements the second node.
A core network comprising:
- a physical computing device that hosts a plurality of virtual machine instances, wherein each virtual machine instance in the plurality of virtual machine instances corresponds to a node in a plurality of nodes;
- and
- a network resilience system comprising a processor in communication with the physical computing device and configured with specific computer-executable instructions to:
- obtain a health status message from a first node in a plurality of nodes;
- determine that a second node in the plurality of nodes has not provided a second health status message;
- attempt to contact the second node;
- in response to a failure to contact the second node, transmit a second message to the first node and other nodes in the plurality of nodes to verify that a connection between the first node and the other nodes and the network resilience system is operational;
- determine that the connection between the first node and the other nodes and the network resilience system is operational;
- obtain a backup copy of a first virtual machine instance in the plurality of virtual machine instances that implements the second node;
- delete the first virtual machine instance;
- and
- start a restored version of the first virtual machine instance.
Dependencies are inferred from the claim text.