US 2024/0406192 A1 · COLLECTIVE INTELLIGENCE IMMUNITY CYBER DETECTION AND PROTECTION

Abstract

Detection of abnormal node behavior and attacks by a node(s) can be enhancedly performed and managed. A security management component (SMC) of a collective node of a node group can analyze respective groups of residual vectors associated with respective features and associated with and received from respective nodes of the node group. Based on the analysis and defined security management criteria relating to abnormal node behavior and attacks, SMC can determine whether there is abnormal node behavior and/or an attack by one or more nodes. In response to detected abnormal node behavior and/or attack by a node(s), SMC can perform a desired mitigation action. Respective SMCs of the respective nodes of the node group also can perform respective determinations regarding whether an abnormal node behavior and/or attack by a respective node exists based on their respective analysis of their respective groups of residual vectors.

Claims20

Dependent claims

A method, comprising:

analyzing, by a system comprising a processor, first residual vector data received from a first device and second residual vector data received from a second device, wherein the first residual vector data is representative of a first group of residuals between a first actual state of behavior of the first device associated with a time period and a first predicted state of behavior of the first device associated with the time period, and wherein the second residual vector data is representative of a second group of residuals between a second actual state of behavior of the second device associated with the time period and a second predicted state of behavior of the second device associated with the time period;
and
based on a result of the analyzing and a defined abnormal device group behavior criterion that indicates what constitutes abnormal device group behavior associated with the group of devices, determining, by the system, whether an abnormal behavior associated with a group of devices exists, wherein the group of devices comprises the first device and the second device.

A system, comprising:

a memory that stores computer executable components;
and
a processor that executes computer executable components stored in the memory, wherein the computer executable components comprise:
a data collector component that receives a first group of residual vectors from a first node and a second group of residual vectors from a second node, wherein the first group of residual vectors is representative of a first group of residuals between a first state of behavior of the first node associated with a time period and a first predicted state of behavior of the first node associated with the time period, and wherein the second group of residual vectors is representative of a second group of residuals between a second state of behavior of the second node associated with the time period and a second predicted state of behavior of the second node associated with the time period;
and
a security management component that determines whether an abnormal behavior associated with a group of nodes exists based on a result of the analysis of the first group of residual vectors and the second group of residual vectors, and based on a defined abnormal node group behavior criterion that indicates what constitutes abnormal node group behavior associated with the group of nodes, wherein the group of nodes comprises the first node and the second node.

3 more elements

A non-transitory machine-readable medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising:

evaluating a first group of vectors received from a first user equipment and a second group of residual vectors received from a second user equipment, wherein the first group of vectors relates to a first group of residuals between a first state of behavior of the first user equipment associated with a time period and a first expected state of behavior of the first user equipment associated with the time period, and wherein the second group of residual vectors relates to a second group of residuals between a second state of behavior of the second user equipment associated with the time period and a second expected state of behavior of the second user equipment associated with the time period;
and
determining whether a malicious behavior associated with a group of user equipment has occurred based on a result of the evaluating and a defined malicious user equipment group behavior criterion that indicates what constitutes abnormal user equipment group behavior associated with the group of user equipment, wherein the group of user equipment comprises the first user equipment and the second user equipment.

Dependencies are inferred from the claim text.

Collective intelligence immunity cyber detection and protection

Life of this patent

Collective intelligence immunity cyber detection and protection

Life of this patent

Abstract

Claims20