Patent
Atlas literature
Patent
US 12,634,305 B2Patent drawings and their descriptions. Click a drawing to enlarge it.
FIG. 1 is a schematic illustration of a System Deployment Architecture.
FIG. 2 is a block diagram of a WGAN Training Frame- work.
FIG. 3 is a block diagram of GAN Generator and Dis- 35 criminator Architectures.
FIG. 4 is a block diagram of a TCN Block.
FIG. 5 is a block diagram of a Self-Attention Block.
FIG. 6 is a block diagram of a Transformer Block.
FIG. 7 is a flowchart of a method for detecting cyber- 40 attacks at edge servers.
FIG. 8 is a flowchart of a method for classifying cyber- attacks at a cloud server.
FIG. 9 is a schematic illustration of an edge server.
FIG. 10 is a schematic illustration of a virtualization 45 environment in which the different methods, servers and system described herein can be deployed.
Claims define the patent's legal scope. Independent claims stand alone; dependent claims (nested) narrow them. Click a claim to expand its dependents.
A method for detecting cyber-attacks at edge servers, comprising: receiving network traffic; extracting and normalizing network flow features from the network traffic to produce a data pattern for evalu-ation; computing an anomaly detection score for the data pattern for evaluation; comparing the anomaly detection score with a threshold and determining if the network traffic corresponds to normal traffic or to an anomaly; upon determining that the network traffic corresponds to an anomaly, mitigating malicious network traffic by triggering a mitigation strategy and sending an anomaly message to an anomaly classifier; retraining the anomaly detector, using federated learning, when triggered by a cloud server running the anomaly classifier upon obtention of new datasets of network traffic; receiving a new training dataset with normal traffic data from the cloud server; retraining a generative adversarial network (GAN) gen-erator neural network and a GAN discriminator neural network of the anomaly detector; periodically sending weights of the neural networks of the generator and discriminator to the cloud server; receiving average generator weights and average dis-criminator weights from the cloud server; updating the weights of the neural networks of the gen-erator and discriminator using the average generator weights and average discriminator weights received from the cloud server, and resuming training; and replacing the current GAN generator neural network and the GAN discriminator neural network with the retrained GAN generator neural network and GAN discriminator neural network.
The method of claim 1, wherein the generator learns a probabilistic distribution of a training set, enabling produc-tion, by the generator, of data similar to the training set and wherein the discriminator learns how to distinguish between real data and data produced by the generator.
The method of claim 1, wherein the GAN comprises at least one of each of a temporal convolutional network (TCN) block, a self-attention block, and a transformer block.
The method of claim 1, wherein the extracting and normalizing network flow features from the network traffic, B₂ comprises extracting and normalizing flow duration, total number of packets, number of flow packets per second, and number of flow bytes per second.
The method of claim 1, wherein the mitigation strategy is selected among any one or more of temporarily dropping packets, resetting connections, deviating traffic, and notify-ing network hosts.
The method of claim 1, wherein the anomaly message comprises a geographical location, a timestamp, normalized network flow features, and a computed anomaly detection score value.
The method of claim 1, wherein the threshold is defined during the training of the GAN and is updated when the GAN is updated.
An edge server running an anomaly detector for detect-ing cyber-attacks comprising processing circuits and a memory, the memory containing instructions executable by the processing circuits whereby the edge server running the anomaly detector is operative to: receive network traffic; extract and normalize network flow features from the network traffic to produce a data pattern for evaluation; compute an anomaly detection score for the data pattern for evaluation; compare the anomaly detection score with a threshold and determine if the network traffic corresponds to normal traffic or to an anomaly; determine that the network traffic corresponds to an anomaly and mitigate malicious network traffic by triggering mitigation strategies and send an anomaly message to an anomaly classifier; retrain the anomaly detector, using federated learning, when triggered by a cloud server running the anomaly classifier upon obtention of new datasets of network traffic; receive a new training dataset with normal traffic data from the cloud server; start retraining a GAN generator neural network and a GAN discriminator neural network of the anomaly detector; periodically send weights of the neural networks of the generator and discriminator to the cloud server; receive average generator weights and average discrimi-nator weights from the cloud server; update the weights of the neural networks of the generator and discriminator using the average generator weights and average discriminator weights received from the cloud server, and resume training; and replace the current GAN generator neural network and the GAN discriminator neural network with the retrained GAN generator neural network and GAN discriminator neural network.
The edge server of claim 9, wherein the edge server is further operative to: receive a validation dataset from the cloud server; and detect anomalies in the received validation dataset and send back a report with an anomaly detection score computed for each of a plurality of data sample of the validation dataset. ∗ ∗ ∗ ∗ ∗
Layer stacks claimed or described, ordered top of device to substrate.
GAN-based anomaly detector at edge server (method)
No layer stack recorded.
edge server running GAN-based anomaly detector
No layer stack recorded.
Patents and literature cited by this patent (applicant and examiner references).
Cited patents · 8
Patent
Atlas literature
Patent
US 12,634,305 B2Patent drawings and their descriptions. Click a drawing to enlarge it.
FIG. 1 is a schematic illustration of a System Deployment Architecture.
FIG. 2 is a block diagram of a WGAN Training Frame- work.
FIG. 3 is a block diagram of GAN Generator and Dis- 35 criminator Architectures.
FIG. 4 is a block diagram of a TCN Block.
FIG. 5 is a block diagram of a Self-Attention Block.
FIG. 6 is a block diagram of a Transformer Block.
FIG. 7 is a flowchart of a method for detecting cyber- 40 attacks at edge servers.
FIG. 8 is a flowchart of a method for classifying cyber- attacks at a cloud server.
FIG. 9 is a schematic illustration of an edge server.
FIG. 10 is a schematic illustration of a virtualization 45 environment in which the different methods, servers and system described herein can be deployed.
Claims define the patent's legal scope. Independent claims stand alone; dependent claims (nested) narrow them. Click a claim to expand its dependents.
A method for detecting cyber-attacks at edge servers, comprising: receiving network traffic; extracting and normalizing network flow features from the network traffic to produce a data pattern for evalu-ation; computing an anomaly detection score for the data pattern for evaluation; comparing the anomaly detection score with a threshold and determining if the network traffic corresponds to normal traffic or to an anomaly; upon determining that the network traffic corresponds to an anomaly, mitigating malicious network traffic by triggering a mitigation strategy and sending an anomaly message to an anomaly classifier; retraining the anomaly detector, using federated learning, when triggered by a cloud server running the anomaly classifier upon obtention of new datasets of network traffic; receiving a new training dataset with normal traffic data from the cloud server; retraining a generative adversarial network (GAN) gen-erator neural network and a GAN discriminator neural network of the anomaly detector; periodically sending weights of the neural networks of the generator and discriminator to the cloud server; receiving average generator weights and average dis-criminator weights from the cloud server; updating the weights of the neural networks of the gen-erator and discriminator using the average generator weights and average discriminator weights received from the cloud server, and resuming training; and replacing the current GAN generator neural network and the GAN discriminator neural network with the retrained GAN generator neural network and GAN discriminator neural network.
The method of claim 1, wherein the generator learns a probabilistic distribution of a training set, enabling produc-tion, by the generator, of data similar to the training set and wherein the discriminator learns how to distinguish between real data and data produced by the generator.
The method of claim 1, wherein the GAN comprises at least one of each of a temporal convolutional network (TCN) block, a self-attention block, and a transformer block.
The method of claim 1, wherein the extracting and normalizing network flow features from the network traffic, B₂ comprises extracting and normalizing flow duration, total number of packets, number of flow packets per second, and number of flow bytes per second.
The method of claim 1, wherein the mitigation strategy is selected among any one or more of temporarily dropping packets, resetting connections, deviating traffic, and notify-ing network hosts.
The method of claim 1, wherein the anomaly message comprises a geographical location, a timestamp, normalized network flow features, and a computed anomaly detection score value.
The method of claim 1, wherein the threshold is defined during the training of the GAN and is updated when the GAN is updated.
An edge server running an anomaly detector for detect-ing cyber-attacks comprising processing circuits and a memory, the memory containing instructions executable by the processing circuits whereby the edge server running the anomaly detector is operative to: receive network traffic; extract and normalize network flow features from the network traffic to produce a data pattern for evaluation; compute an anomaly detection score for the data pattern for evaluation; compare the anomaly detection score with a threshold and determine if the network traffic corresponds to normal traffic or to an anomaly; determine that the network traffic corresponds to an anomaly and mitigate malicious network traffic by triggering mitigation strategies and send an anomaly message to an anomaly classifier; retrain the anomaly detector, using federated learning, when triggered by a cloud server running the anomaly classifier upon obtention of new datasets of network traffic; receive a new training dataset with normal traffic data from the cloud server; start retraining a GAN generator neural network and a GAN discriminator neural network of the anomaly detector; periodically send weights of the neural networks of the generator and discriminator to the cloud server; receive average generator weights and average discrimi-nator weights from the cloud server; update the weights of the neural networks of the generator and discriminator using the average generator weights and average discriminator weights received from the cloud server, and resume training; and replace the current GAN generator neural network and the GAN discriminator neural network with the retrained GAN generator neural network and GAN discriminator neural network.
The edge server of claim 9, wherein the edge server is further operative to: receive a validation dataset from the cloud server; and detect anomalies in the received validation dataset and send back a report with an anomaly detection score computed for each of a plurality of data sample of the validation dataset. ∗ ∗ ∗ ∗ ∗
Layer stacks claimed or described, ordered top of device to substrate.
GAN-based anomaly detector at edge server (method)
No layer stack recorded.
edge server running GAN-based anomaly detector
No layer stack recorded.
Patents and literature cited by this patent (applicant and examiner references).
Cited patents · 8
Patent
Atlas literature
Patent
US 12,634,305 B2Patent drawings and their descriptions. Click a drawing to enlarge it.
FIG. 1 is a schematic illustration of a System Deployment Architecture.
FIG. 2 is a block diagram of a WGAN Training Frame- work.
FIG. 3 is a block diagram of GAN Generator and Dis- 35 criminator Architectures.
FIG. 4 is a block diagram of a TCN Block.
FIG. 5 is a block diagram of a Self-Attention Block.
FIG. 6 is a block diagram of a Transformer Block.
FIG. 7 is a flowchart of a method for detecting cyber- 40 attacks at edge servers.
FIG. 8 is a flowchart of a method for classifying cyber- attacks at a cloud server.
FIG. 9 is a schematic illustration of an edge server.
FIG. 10 is a schematic illustration of a virtualization 45 environment in which the different methods, servers and system described herein can be deployed.
Claims define the patent's legal scope. Independent claims stand alone; dependent claims (nested) narrow them. Click a claim to expand its dependents.
A method for detecting cyber-attacks at edge servers, comprising: receiving network traffic; extracting and normalizing network flow features from the network traffic to produce a data pattern for evalu-ation; computing an anomaly detection score for the data pattern for evaluation; comparing the anomaly detection score with a threshold and determining if the network traffic corresponds to normal traffic or to an anomaly; upon determining that the network traffic corresponds to an anomaly, mitigating malicious network traffic by triggering a mitigation strategy and sending an anomaly message to an anomaly classifier; retraining the anomaly detector, using federated learning, when triggered by a cloud server running the anomaly classifier upon obtention of new datasets of network traffic; receiving a new training dataset with normal traffic data from the cloud server; retraining a generative adversarial network (GAN) gen-erator neural network and a GAN discriminator neural network of the anomaly detector; periodically sending weights of the neural networks of the generator and discriminator to the cloud server; receiving average generator weights and average dis-criminator weights from the cloud server; updating the weights of the neural networks of the gen-erator and discriminator using the average generator weights and average discriminator weights received from the cloud server, and resuming training; and replacing the current GAN generator neural network and the GAN discriminator neural network with the retrained GAN generator neural network and GAN discriminator neural network.
The method of claim 1, wherein the generator learns a probabilistic distribution of a training set, enabling produc-tion, by the generator, of data similar to the training set and wherein the discriminator learns how to distinguish between real data and data produced by the generator.
The method of claim 1, wherein the GAN comprises at least one of each of a temporal convolutional network (TCN) block, a self-attention block, and a transformer block.
The method of claim 1, wherein the extracting and normalizing network flow features from the network traffic, B₂ comprises extracting and normalizing flow duration, total number of packets, number of flow packets per second, and number of flow bytes per second.
The method of claim 1, wherein the mitigation strategy is selected among any one or more of temporarily dropping packets, resetting connections, deviating traffic, and notify-ing network hosts.
The method of claim 1, wherein the anomaly message comprises a geographical location, a timestamp, normalized network flow features, and a computed anomaly detection score value.
The method of claim 1, wherein the threshold is defined during the training of the GAN and is updated when the GAN is updated.
An edge server running an anomaly detector for detect-ing cyber-attacks comprising processing circuits and a memory, the memory containing instructions executable by the processing circuits whereby the edge server running the anomaly detector is operative to: receive network traffic; extract and normalize network flow features from the network traffic to produce a data pattern for evaluation; compute an anomaly detection score for the data pattern for evaluation; compare the anomaly detection score with a threshold and determine if the network traffic corresponds to normal traffic or to an anomaly; determine that the network traffic corresponds to an anomaly and mitigate malicious network traffic by triggering mitigation strategies and send an anomaly message to an anomaly classifier; retrain the anomaly detector, using federated learning, when triggered by a cloud server running the anomaly classifier upon obtention of new datasets of network traffic; receive a new training dataset with normal traffic data from the cloud server; start retraining a GAN generator neural network and a GAN discriminator neural network of the anomaly detector; periodically send weights of the neural networks of the generator and discriminator to the cloud server; receive average generator weights and average discrimi-nator weights from the cloud server; update the weights of the neural networks of the generator and discriminator using the average generator weights and average discriminator weights received from the cloud server, and resume training; and replace the current GAN generator neural network and the GAN discriminator neural network with the retrained GAN generator neural network and GAN discriminator neural network.
The edge server of claim 9, wherein the edge server is further operative to: receive a validation dataset from the cloud server; and detect anomalies in the received validation dataset and send back a report with an anomaly detection score computed for each of a plurality of data sample of the validation dataset. ∗ ∗ ∗ ∗ ∗
Layer stacks claimed or described, ordered top of device to substrate.
GAN-based anomaly detector at edge server (method)
No layer stack recorded.
edge server running GAN-based anomaly detector
No layer stack recorded.
Patents and literature cited by this patent (applicant and examiner references).
Cited patents · 8
Patent
Atlas literature
Patent
US 12,634,305 B2Patent drawings and their descriptions. Click a drawing to enlarge it.
FIG. 1 is a schematic illustration of a System Deployment Architecture.
FIG. 2 is a block diagram of a WGAN Training Frame- work.
FIG. 3 is a block diagram of GAN Generator and Dis- 35 criminator Architectures.
FIG. 4 is a block diagram of a TCN Block.
FIG. 5 is a block diagram of a Self-Attention Block.
FIG. 6 is a block diagram of a Transformer Block.
FIG. 7 is a flowchart of a method for detecting cyber- 40 attacks at edge servers.
FIG. 8 is a flowchart of a method for classifying cyber- attacks at a cloud server.
FIG. 9 is a schematic illustration of an edge server.
FIG. 10 is a schematic illustration of a virtualization 45 environment in which the different methods, servers and system described herein can be deployed.
Claims define the patent's legal scope. Independent claims stand alone; dependent claims (nested) narrow them. Click a claim to expand its dependents.
A method for detecting cyber-attacks at edge servers, comprising: receiving network traffic; extracting and normalizing network flow features from the network traffic to produce a data pattern for evalu-ation; computing an anomaly detection score for the data pattern for evaluation; comparing the anomaly detection score with a threshold and determining if the network traffic corresponds to normal traffic or to an anomaly; upon determining that the network traffic corresponds to an anomaly, mitigating malicious network traffic by triggering a mitigation strategy and sending an anomaly message to an anomaly classifier; retraining the anomaly detector, using federated learning, when triggered by a cloud server running the anomaly classifier upon obtention of new datasets of network traffic; receiving a new training dataset with normal traffic data from the cloud server; retraining a generative adversarial network (GAN) gen-erator neural network and a GAN discriminator neural network of the anomaly detector; periodically sending weights of the neural networks of the generator and discriminator to the cloud server; receiving average generator weights and average dis-criminator weights from the cloud server; updating the weights of the neural networks of the gen-erator and discriminator using the average generator weights and average discriminator weights received from the cloud server, and resuming training; and replacing the current GAN generator neural network and the GAN discriminator neural network with the retrained GAN generator neural network and GAN discriminator neural network.
The method of claim 1, wherein the generator learns a probabilistic distribution of a training set, enabling produc-tion, by the generator, of data similar to the training set and wherein the discriminator learns how to distinguish between real data and data produced by the generator.
The method of claim 1, wherein the GAN comprises at least one of each of a temporal convolutional network (TCN) block, a self-attention block, and a transformer block.
The method of claim 1, wherein the extracting and normalizing network flow features from the network traffic, B₂ comprises extracting and normalizing flow duration, total number of packets, number of flow packets per second, and number of flow bytes per second.
The method of claim 1, wherein the mitigation strategy is selected among any one or more of temporarily dropping packets, resetting connections, deviating traffic, and notify-ing network hosts.
The method of claim 1, wherein the anomaly message comprises a geographical location, a timestamp, normalized network flow features, and a computed anomaly detection score value.
The method of claim 1, wherein the threshold is defined during the training of the GAN and is updated when the GAN is updated.
An edge server running an anomaly detector for detect-ing cyber-attacks comprising processing circuits and a memory, the memory containing instructions executable by the processing circuits whereby the edge server running the anomaly detector is operative to: receive network traffic; extract and normalize network flow features from the network traffic to produce a data pattern for evaluation; compute an anomaly detection score for the data pattern for evaluation; compare the anomaly detection score with a threshold and determine if the network traffic corresponds to normal traffic or to an anomaly; determine that the network traffic corresponds to an anomaly and mitigate malicious network traffic by triggering mitigation strategies and send an anomaly message to an anomaly classifier; retrain the anomaly detector, using federated learning, when triggered by a cloud server running the anomaly classifier upon obtention of new datasets of network traffic; receive a new training dataset with normal traffic data from the cloud server; start retraining a GAN generator neural network and a GAN discriminator neural network of the anomaly detector; periodically send weights of the neural networks of the generator and discriminator to the cloud server; receive average generator weights and average discrimi-nator weights from the cloud server; update the weights of the neural networks of the generator and discriminator using the average generator weights and average discriminator weights received from the cloud server, and resume training; and replace the current GAN generator neural network and the GAN discriminator neural network with the retrained GAN generator neural network and GAN discriminator neural network.
The edge server of claim 9, wherein the edge server is further operative to: receive a validation dataset from the cloud server; and detect anomalies in the received validation dataset and send back a report with an anomaly detection score computed for each of a plurality of data sample of the validation dataset. ∗ ∗ ∗ ∗ ∗
Layer stacks claimed or described, ordered top of device to substrate.
GAN-based anomaly detector at edge server (method)
No layer stack recorded.
edge server running GAN-based anomaly detector
No layer stack recorded.
Patents and literature cited by this patent (applicant and examiner references).
Cited patents · 8
Cited non-patent literature · 6
Cited non-patent literature · 6
Cited non-patent literature · 6
Cited non-patent literature · 6
