Cyber threat defense system, components, and a method for using artificial intelligence models trained on a normal pattern of life for systems with unusual data sources

A cyber threat defense system, comprising:

• a central cyber defense appliance configured to protect one or more independent systems from cyber threats by detecting the cyber threats, which is facilitated by one or more extensions of the cyber threat defense system implemented in a form of one or more lightweight probes, where a first lightweight probe is configured to integrate within a first independent system to extend monitoring and gathering of data capability of the central cyber defense appliance, where the first lightweight probe is further configured to provide at least remote monitoring and gathering on 1) data, 2) meta data, and 3) a combination of both, from one or more protocols and data types utilized in any of i) a data link layer, ii) a physical layer, or iii) both;
• and then, one or more of a following layers when that layer is utilized in the first independent system, where the following layers include any of iv) an application layer, v) a transport layer, vi) a network layer, and vii) any combination of these three layers,
• where the one or more independent systems are selected from a group consisting of i) Internet of Things (IOT) devices, ii) a vehicle's autonomous network, iii) a ship's control network, iv) an airplane's control network, v) any system excluding 1) an email network, 2) an information technology network, 3) a cloud-based platform, or 4) a Software-as-a-Service based environment, and vi) any combination these,
• an analyzer module configured to cooperate with one or more Artificial Intelligence (AI) models configured to model a normal pattern of life in each of the independent systems to determine when any of i) an abnormal behavior, ii) a suspicious activity, and iii) any combination of both is detected in that independent system, which uses a protocol in at least one of 1) the data link layer and 2) the physical layer, and
• where any portions of the first lightweight probe implemented in software are configured to be stored in a first non-transitory storage medium in an executable format to be executed by a first set of one or more processors, and where any portions of the central cyber defense appliance implemented in software are configured to be stored in a second set of non-transitory storage mediums in an executable format to be executed by a second set of one or more processors.

A method for a cyber threat defense system, comprising:

• providing a central cyber defense appliance to protect one or more independent systems from cyber threats by detecting the cyber threats, which is facilitated by one or more extensions of the cyber threat defense system implemented in a form of one or more lightweight probes, where a first lightweight probe is configured to integrate within a first independent system to extend monitoring and gathering of data capability of the central cyber defense appliance, where the first lightweight probe is further configured to provide at least remote monitoring and gathering on 1) data, 2) meta data, and 3) a combination of both, from one or more protocols and data types utilized in any of i) a data link layer, ii) a physical layer, or iii) both;
• and then, one or more of a following layers when that layer is utilized in the first independent system, where the following layers include any of iv) an application layer, v) a transport layer, vi) a network layer, and vii) any combination of these three layers,
• where the one or more independent systems are selected from a group consisting of i) Internet of Things (IOT) devices, ii) a vehicle's autonomous network, iii) a ship's control network, iv) an airplane's control network, v) any system excluding 1) an email network, 2) an information technology network, 3) a cloud-based platform, or 4) a Software-as-a-Service based environment, and vi) any combination these, and
• providing an analyzer module to cooperate with one or more Artificial Intelligence (AI) models configured to model a normal pattern of life in each of the independent systems to determine when any of i) an abnormal behavior, ii) a suspicious activity, and iii) any combination of both is detected in that independent system, which uses a protocol in at least one of 1) the data link layer and 2) the physical layer.