Method of threat detection in a threat detection network and threat detection network

Abstract

A threat detection network, a node of a threat detection network and a threat detection method in a threat detection network, the threat detection network comprising interconnected nodes (5a-5h) and a backend system (2), wherein the backend system utilizes a backend threat detection mechanism, and at least part of the nodes (5a-5h) comprise security agent modules (6a-6h) which collect data related to the respective node. The nodes (5a-5h) utilize at least one local threat detection model which comprises a machine learning-based model of a backend threat detection mechanism. The method comprises collecting data related to the node (5a-5h) by the security agent module at the node, applying the local threat detection model to the collected data, and making a security related decision at the node (5a-5h), such as an endpoint, based on results of the local threat detection model.

Dependencies are inferred from the claim text.