Method of threat detection in threat detection network, and threat detection network

Abstract

To provide a method of threat detection in a threat detection network.SOLUTION: A backend system of a threat detection network utilizes a backend threat detection model, and at least some of network nodes comprise security agent modules which collect data related to the respective network nodes, where the network nodes utilize a local threat detection model and a local consistency model. The local consistency model provides confidence level information between the local threat detection model and the backend threat detection model. The method comprises collecting data related to the network node by the security agent module at the network node, applying the local threat detection model to the collected data, and making a security related decision at an endpoint based on results of the local threat detection model and the local consistency model.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a threat detection method in a threat detection network, a network node of the threat detection network, a backend system of the threat detection network, and the threat detection network.

Background Art

[0002] Security and threat detection systems for computers and computer networks are used to detect threats and anomalies in computers and networks. Such examples are endpoint protection platforms (EPP), endpoint detection and response (EDR), and managed detection and response (MDR) products and services. An endpoint protection platform (EPP) is a solution deployed on an endpoint device to prevent file-based malware attacks, detect malicious activities, and provide the investigation and remediation functions necessary to respond to dynamic security incidents and alerts. Also, an EDR system focuses on the detection and monitoring of violations when they occur and helps determine the best way to respond to the detected violations. MDR is a managed cybersecurity service for threat detection, response, and remediation. The emergence of machine learning, big data, and cloud computing has enabled the growth of efficient and robust threat detection solutions in part.

[0003] An EPP, EDR, or other corresponding system deploys a data collector on a selected network endpoint, which can be any element of the IT infrastructure. The data collector observes the activities being performed at the endpoint and sends the collected data to a central backend system, often located within the cloud. When the backend receives the data, the data is processed (e.g., aggregated and enhanced) before being analyzed and scanned by the security system provider for signs of security violations and anomalies.

[0004] To effectively combat modern cyber threats, it's crucial to operate as close to the entity as possible to provide protection. When the entity being protected is an endpoint, this approach involves performing mobile data collection, analysis, threat detection, response, and remediation functions as close to the endpoint as possible.

[0005] Achieving such goals is a complex task requiring considerable effort, and this effort can take many forms. Often, machine learning (ML) is used to achieve these goals. Machine learning itself can be used in many ways in this field, and one of these possible ways focuses on the application of on-device machine learning models for the proactive and rapid detection of malware on end-user devices. [Overview of the project] [Problems that the invention aims to solve]

[0006] This approach has several drawbacks, including the limited capabilities of on-sensor machine learning models. In particular, on-sensor malware detection machine learning models must provide reasonably high-quality decisions while minimizing resource consumption so as not to impair the user experience. For example, dynamic analysis techniques are better at capturing object behavior than static analysis techniques. At the same time, dynamic analysis techniques tend to be more machine-intensive, and this performance overhead ultimately limits their applicability on endpoint devices. As a result, hybrid solutions are also proposed that run simpler, less resource-intensive analysis techniques on endpoints to handle simpler cases, while more complex cases are handled with the help of cloud-powered detection mechanisms, which can achieve high-quality decisions thanks to more powerful attribute extraction and analysis techniques.

[0007] One of the key challenges in designing such hybrid systems is distinguishing between relatively simple tasks and, conversely, more complex tasks that cannot be handled by simple endpoint-side models and analytical capabilities.

[0008] Therefore, it is necessary to achieve a reliable threat detection system that can also keep resource consumption at a reasonable level. [Means for solving the problem]

[0009] The following is a simplified overview to provide a basic understanding of several aspects of various embodiments of the invention. This overview is not a comprehensive overview of the invention. It is not intended to identify the main or important elements of the invention or to delineate its scope. The following overview merely presents some concepts of the invention in a simplified form as a prelude to a more detailed description of exemplary embodiments of the invention.

[0010] According to a first aspect, the present invention relates to a method for threat detection in a threat detection network, for example, a computer implementation method, wherein the threat detection network includes interconnected network nodes and a backend system, the backend system utilizing a backend threat detection model. At least a portion of the network nodes include security agent modules that collect data related to each of the network nodes, and the network nodes utilize a local threat detection model and a local consistency model. The local consistency model is configured to provide trust level information between the local threat detection model and the backend threat detection model. The method collects data related to the network nodes by the security agent modules at the network nodes, applies the local threat detection model to the collected data, and makes security-related decisions at the endpoints based on the results of the local threat detection model and the local consistency model.

[0011] In one embodiment of the present invention, confidence level information between a local threat detection model and a backend threat detection model includes an estimate of agreement between the verdicts provided by the local threat detection model and the backend threat detection model utilized by the backend system.

[0012] In one embodiment of the present invention, when the confidence level information provided by the local consistency model is high and / or exceeds a certain confidence level value, security-related decisions at network nodes are made independently by the network nodes.

[0013] In one embodiment of the present invention, when the reliability level information provided by the local consistency model is low and / or below a certain reliability level value, security-related decisions at the network node are made based on the context of the network node, such as the availability of network connectivity, for example, internet connectivity.

[0014] In one embodiment of the present invention, when a network node and / or a security agent module of a network node are online, the network node queries the backend to utilize the backend threat detection model on detected objects, and security-related decisions are made based on the backend security threat model.

[0015] In one embodiment of the present invention, if the network node's network node and / or security agent module are offline, the network node moves to isolate the detected object, and when the network node's network node and / or security agent module are online to make security-related decisions based on the backend security threat model, it queries the backend to utilize the backend threat detection model for the object.

[0016] In one embodiment of the present invention, when the reliability level information provided by the local consistency model is moderate and / or between specific reliability level values, security-related decisions at a network node are made based on the context of the network node, including network connectivity, and further contextual information about the network node, such as the type of network node and / or the risk level of active users using it.

[0017] In one embodiment of the present invention, the set of attributes extracted from an object on a network node for a local threat detection model includes a subset of the set of attributes extracted from a backend network node.

[0018] In one embodiment of the present invention, the consistency model is prepared based on the results of validation between the local threat detection model and the backend threat detection model.

[0019] In one embodiment of the present invention, the backend threat detection model, the local threat detection model, and / or consistency model are prepared in the backend system.

[0020] One embodiment of the present invention includes preparing a machine learning-based threat detection model by defining backend threat model features, defining local threat model features, defining backend threat detection models and local threat detection models based on training data, and creating a training consistency model based on validation data, local threat detection models and backend threat detection models.

[0021] According to a second aspect, the present invention relates to a network node of a threat detection network, the network comprising interconnected network nodes and a backend system. The network node comprises at least one processor and at least one security agent module configured to collect data associated with each of the network nodes. The network node is further configured to utilize a local threat detection model and a local integrity model, the local integrity model trained and / or provided by the backend system is configured to provide confidence level information between the local threat detection model and the backend threat detection model. The network node is configured to collect data associated with the network node by the security agent module at the network node, apply the local threat detection model to the collected data, and make security-related decisions at the endpoint based on the results of the local threat detection model and the local integrity model.

[0022] According to a third aspect, the present invention relates to a backend system for a threat detection network, the threat detection network comprising interconnected network nodes and the backend system. The backend system comprises at least one processor and at least one server configured to utilize a backend threat detection model. The backend system is further configured to train and / or provide a local threat detection model and a consistency model to the network nodes, the local consistency model trained and / or provided by the backend system is configured to provide confidence level information between the local threat detection model and the backend threat detection model. The backend system may (optionally) be further configured to receive network node-related data collected by security agent modules at the network nodes, apply the backend threat detection model to the received data, and / or provide information related to endpoint security-related decisions based on the results of the backend detection model.

[0023] According to a fourth aspect, the present invention relates to a threat detection network including at least one network node according to the present invention and / or at least one backend system according to the present invention.

[0024] According to a fifth aspect, the present invention relates to a computer program including instructions which, when executed by a computer, cause the computer to execute a method according to the present invention.

[0025] According to a sixth aspect, the present invention relates to a computer-readable medium including a computer program according to the present invention.

Advantages of the Invention

[0026] With the solution of the present invention, it is possible to achieve a reliable threat detection system that can also keep resource consumption at a reasonable level. In the solution of the present invention, when conditions change, for example, when a node or endpoint is offline or online, reliable threat detection results can be provided. The system can, for example, handle low-risk threats offline, isolate high-risk threats, and / or adapt the threat level to changing conditions so that it can wait for a node, device, or endpoint to be online.

Brief Description of the Drawings

[0027] [Figure 1] Schematically shows an exemplary network architecture of an embodiment of the present invention. [Figure 2] Presents exemplary embodiments of the solution of the present invention regarding the preparation phase and the functional phase. [Figure 3] Shows an exemplary method according to an embodiment of the present invention.

Modes for Carrying Out the Invention

[0028] Various exemplary and non-limiting embodiments of the present invention, along with their additional objectives and advantages, will be best understood from the following description of specific exemplary and non-limiting embodiments when read in conjunction with the accompanying drawings.

[0029] The verbs "include" and similar verbs are used herein as open limitations, without excluding or requiring the existence of any uncited features. Unless otherwise specified, the features described in the dependent claims may be freely combined with each other.

[0030] Furthermore, please understand that throughout this specification, the use of "one" or similar words, i.e., the singular form, does not preclude the plural form.

[0031] Embodiments of the present invention are shown in the accompanying drawings as examples, not as limitations.

[0032] A threat detection network according to one embodiment of the present invention may include at least one network node and a backend system including at least one backend server. In this case, information, such as threat detection-related data, can be shared between nodes and / or between a node and the backend system.

[0033] Figure 1 schematically shows an exemplary network architecture of one embodiment of the present invention in which the solution of the present invention can be used. In Figure 1, a portion of the first computer network 1 is schematically shown, in which a computer system, such as an EPP or EDR system, is installed. Any other computer system capable of carrying out embodiments of the present invention can be used instead of or in addition to the EPP or EDR system used in this example. The first computer network is connected to a security services network, in this case a security backend system or server 2, via a cloud 3. The backend system or server 2 forms a node on the security services computer network relative to the first computer network. The security services computer network can be managed by a threat detection system provider and can be isolated from the cloud 3 by a gateway or other interface (not shown) or other network elements suitable for the backend 2. The first computer network 1 may also be isolated from the cloud 3 by a gateway 4 or other interface. Other network structures are also possible.

[0034] The first computer network 1 is formed from a plurality of interconnected network nodes 5a-5h, each representing an element within the computer network 1, such as a computer, smartphone, tablet, laptop, or other network-enabled hardware. In one embodiment of the present invention, a node is any device on the network, but not a gateway. Each network node 5a-5h shown in the computer network also represents an endpoint, such as an EDR endpoint or EPP endpoint, on which security agent modules 6a-6h, which may include a data collector or "sensor," are installed. The security agent modules may also be installed on any other element of the computer network, such as a gateway or other interface. In the example in Figure 1, security agent module 4a is installed on gateway 4. Security agent modules 6a-6h and 4a collect various types of data on nodes 5a-5h or gateway 4, including, for example, program or file hashes, files stored on nodes 5a-5h, network traffic logs, process logs, binaries or files extracted from memory (e.g., DLLs, EXEs, or memory forensic artifacts), and / or logs from monitoring actions performed by programs or scripts running on nodes 5a-5h or gateway 4 (e.g., TCP dumps). The collected data may be stored in a database or similar model for information storage for further use. Any kind of threat detection and integrity models may be further built on backend / server 2 and / or on a second server and stored in the database. Nodes 5a-5h and server 2 typically include hard drives, processors, and RAM.

[0035] Any type of data that can assist in the detection and monitoring of security threats, such as security breaches or system intrusions, can be collected by security agent modules 6a-6h, 4a during their lifecycle, and the type of data monitored and collected can be set according to rules defined by the threat detection system provider when installing the threat detection system and / or when delivering components of the threat detection model and / or behavior model. In one embodiment of the present invention, at least a portion of security agent modules 6a-6h may also have the ability to make decisions about the type of data observed and collected by itself. For example, security agents 6a-6h, 4a can collect data about the behavior of programs running on endpoints, which can be observed when a new program is started. Where appropriate resources are available, the collected data may be stored permanently or temporarily by security agent modules 6a-6h, 4a in appropriate storage locations (not shown) on each of their network nodes or on the first computer network 1.

[0036] Security agent modules 6a-6h and 4a are configured to send and receive information, such as data they collect or transmit, to and from the threat detection system backend 2 via the cloud 3. This allows the threat detection system provider to remotely manage the system without the need to constantly maintain a human presence in the organization managing the first computer network 1.

[0037] In one embodiment of the present invention, security agent modules 6a-6h and 4a can be configured to establish an internal network, such as an internal swarm intelligence network, which includes security agent modules of multiple interconnected network nodes 5a-5h of the local computer network 1. Each security agent module 6a-6h and 4a collects data about each of its respective network nodes 5a-5h, and is further configured to share information based on the collected data within the established internal network. In one embodiment, the swarm intelligence network consists of multiple semi-independent security nodes (security agent modules) that can function similarly on their own. Therefore, the number of instances in the swarm intelligence network can vary considerably. Furthermore, there may be two or more connected swarm intelligence networks cooperating with each other within a single local computer network.

[0038] Security agent modules 6a-6h, 4a, and / or the backend system are further configured to use collected data and information received from the internal network to generate and adapt models relevant to each network node 5a-5h and / or its user. These models may be, for example, threat detection models and / or integrity models.

[0039] Figure 2 shows an exemplary embodiment of the solution of the present invention relating to the preparation phase and the functioning phase according to one embodiment of the solution of the present invention. The preparation phase can be used to generate a set of items that are important for the functioning of the functioning phase, for example, a set of features used to represent a particular object that the classifier must process, and a decision model that leverages the representation of the object based on the aforementioned features to classify the supplied object.

[0040] Preparing a machine learning-based threat detection model may include defining backend threat model features, defining local threat model features, defining backend and local threat detection models based on training data, and creating a training consistency model based on validation data, local threat detection models, and backend threat detection models.

[0041] In one embodiment, the creation of models for endpoint features and cloud and / or backend features can be defined. Based on the training data and defined features, cloud / backend threat detection models and local threat detection models can be trained, for example. The models can be, for example, machine learning models. During the preparation phase, the training data can undergo preprocessing to find and select an appropriate set of features that can effectively represent the given data. Such features are then utilized during the creation of the decision model. After the preparation phase is complete, both the feature definitions and the trained models are used for incoming unknown input objects. Each object in the input flow of previously unseen items is mapped to the appropriate space as indicated by the selected features. Such representations of the input objects are then fed into the trained model, and the model's predictions are collected along with any further outputs for the model.

[0042] The solution of the present invention uses machine learning models available at the endpoint and backend for the detection of malicious objects and / or malicious behavior. In the example in Figure 2, both the sensor-side detection model and the cloud detection model are trained in the backend system, for example in the cloud, for example, in the manner described above. The sensor-side detection model may be a lightweight model with limited capabilities, while the backend detection model is less limited and therefore a more reliable model. The sensor-side detection model depends on the set of sensor-side features that can be extracted, whereas the backend detection model is not so limited and can be considered a superset of endpoint 1. The backend model can operate over many attributes that cannot be extracted or analyzed on the endpoint sensor due to performance overhead.

[0043] At the end of the training process for local and backend threat detection models, the validation results of these models are compared to obtain another real-valued function for the attribute space on which the sensor-side model relies. This function represents the consistency level of both models and can be called the consistency model. Thus, the consistency model can be trained and / or prepared based on validation data, extracted features, and the trained local threat detection model, as well as the trained backend / cloud threat detection model. This mapping of consistency levels can be provided to the endpoint as a machine learning mode to support the sensor-side machine learning threat detection model. The sensor-side model and consistency model can then be sent to the sensor. On the endpoint side, the consistency model can also be referenced whenever a decision is requested from the sensor-side machine learning detection model. The consistency model is prepared to provide information on how reliable the output of the detection model is. Thus, the endpoint applies the local threat detection model to the collected data and makes security-related decisions at the endpoint based on the results of the local threat detection model and the local consistency model.

[0044] The confidence level information between the local threat detection model and the backend threat detection model is used to give an estimate of the agreement between the verdicts provided by the local threat detection model and the backend threat detection model utilized by the backend system.

[0045] The consistency model can be used, for example, in series or in parallel with the endpoint threat detection model. The use of the model may also depend on the context, risk level, and other factors related to the endpoint and / or threat detection. In one exemplary embodiment, when the confidence level provided by the consistency model is high, the sensor may decide to act independently of local (i.e., sensor-side) decisions. Otherwise, the sensor may act according to the context, for example, as follows:

[0046] ● If the endpoint and / or endpoint sensor are online and the reliability level provided by the consistency model level is low, the use of the sensor-side detection model can be omitted, and instead, the object can be submitted to the cloud, and the endpoint can act on the decisions provided by the cloud;

[0047] ● If the endpoint and / or endpoint sensor are offline and the reliability level provided by the consistency model level is low, the object can be temporarily isolated and moved, the user can be notified, and when the sensor comes online, the object can be submitted to the cloud;

[0048] ● If the reliability level provided by the consistency model level is moderate and the cloud decision is deferred, the endpoint may rely on additional contextual information such as the endpoint type (server, non-server, etc.) and / or the risk level of the active users using it.

[0049] Figure 3 shows an exemplary method according to one embodiment of the present invention. In the exemplary method in step S301, data is collected in relation to the network node by a security agent module on the network node. Then, in step S302, a local threat detection model is applied to the collected data, and in step S303, security-related decisions are made at the endpoint based on the results of the local threat detection model and the local integrity model.

[0050] One exemplary scenario is presented in the following paragraph. In this exemplary embodiment, raw data related to actions on network nodes is received. The raw data may be received / collected from multiple network nodes (5a-5h), and different data types may be aligned as input events and collected for submission. Multiple different types of events may exist. In one embodiment of the present invention, a sensor collects events for several seconds and then transmits these collected events in a single transmission to reduce the number of network connections and / or requests. A submission processing component can be responsible for the initial preprocessing of all data submissions received from various types of endpoint sensors.

[0051] Raw data associated with each network node can be collected by the network nodes of the computer network and / or by security server backends from multiple network nodes of the computer network. Observed events associated with network nodes are, in effect, some measurable event caused by a number of underlying processes / actors. Such actors could be, for example, actual users or operating systems.

[0052] Threats in the network and / or network nodes can be identified according to the solution of the present invention by utilizing machine learning threat detection models, such as local threat detection models and backend threat detection models.

[0053] In one embodiment, when a threat is detected, further actions may be taken to secure the computer network and / or any associated network nodes, such as increasing the level of data collection, sending data that does not match the generated local behavior model and / or received behavior model to the backend, increasing the risk level of users, increasing the risk level of nodes, and / or alerting operators, and / or taking immediate action by modifying the configuration of network nodes to ensure that attackers are stopped and no trace of their movements is destroyed. Modifying the configuration may, for example, prevent one or more nodes (which may be computers or other devices) from being switched off to retain information in RAM, switch on firewalls on one or more nodes to immediately block attackers, slow down or block network connections on one or more network nodes, remove or isolate suspicious files, collect logs from network nodes, execute a set of commands on network nodes, warn that a threat or anomaly has been detected to users on one or more nodes and that their workstations are under investigation, and / or, in response to the detection of signs of deviation from normal behavior, system updates or software patches may be sent from the threat detection backend to the nodes. In one embodiment of the present invention, one or more of these actions may be automatically initiated by the model or algorithm described above. For example, using the method described above, data is collected and shared with nodes and a threat detection backend in a computer network, and a threat model or analysis algorithm determines that a threat has been detected. As soon as the model / algorithm makes a decision about the threat, it can generate and issue commands to the relevant network nodes without human intervention, automatically initiating one or more of the actions described above on the nodes. By doing this, corruption can be stopped and / or damage minimized very quickly and automatically without human intervention.

[0054] In one embodiment, suspicious events among the monitored events may be detected by one or more detection mechanisms used. In one embodiment, the detection mechanisms used to detect suspicious events may include using a scanning engine, heuristic rules, statistical anomaly detection, fuzzy logic-based models, or any predetermined rules (in addition to machine learning models).

[0055] The inputs for the machine learning models used in the solutions of the present invention, such as backend threat detection models, local threat detection models, and local integrity models, can be a variety of objects. These may be, for example, executable files and documents, URIs, log trace entities, and aggregates thereof across time windows, processes, users, etc. Different input types can be represented by their own sets of features.

[0056] The output of a machine learning model used in the solution of the present invention may depend on the problem that the model is trying to address. For malware detection domains, the output of a model may be, for example, binary (i.e., binary classification task, e.g., "malicious" or "benign"), categorical (i.e., multi-class classification problem, categories may be, for example, "adware", "riskware", "malware", "grayware", etc.), and / or numerical (e.g., regression task such as risk score or anomaly level assessment). In the case of MDR or EDR machine learning models, the output may be of the same type, representing results that generate local detection, response behavior, anomaly levels of events, processes, users, various priority assignment recommendations, etc.

[0057] The type of machine learning model used in the solution of the present invention may depend on the problem (e.g., the type of input and / or output features) and the available data (e.g., the availability of labels and their types). For example, a binary classification task may suggest the availability of labels in the training data and can be solved using several methods, including logistic regression, neural networks, decision trees, and advanced versions thereof that rely on bagging and boosting techniques.

[0058] In one embodiment, the method may further include preparing and training machine learning models used for threat detection, such as a local threat detection model, a backend threat detection model, a locally consistent model, and / or as a response to a threat by utilizing one or more approaches used to train machine learning models, such as distributed learning through combining local and global information and model parts, reinforcement learning through obtaining feedback on successful final results, meta-learning through utilizing external information in the learning process, and / or coordinating information sharing and learning behavior to a bootstrap model.

[0059] In one embodiment of the present invention, the threat detection models used in the solution of the present invention, such as a backend threat detection model and a local threat detection model, are trained on existing data, i.e., training data. The training data may include, for example, multiple training data elements that can be associated with at least one malicious-related characteristic or feature. This trained model can be deployed to generate predictions about new relevant objects. For example, as threats evolve and the training data is not complete, the performance of the model may need to be continuously controlled over time. To maintain the required level of performance, the training data can be updated and the model can be retrained, for example, periodically.

[0060] In one embodiment of the present invention, during the preparation phase, the training data can undergo preprocessing to find and select a suitable set of features that can effectively represent the given data. Such features can then be utilized during the preparation of the decision model. After the completion of the preparation phase, both the feature definitions and the trained model can be used for incoming unknown input objects. Each object in the input flow of previously unseen items is mapped to the appropriate space as indicated by the selected features. Such representations of the input objects can then be fed into the trained model, and the model's predictions are collected along with any further outputs for the model.

[0061] Local threat detection models can function, for example, at the endpoint or device side. Local threat detection models can generally be trained using features that make performance faster for the cost of predictive power (this is by applying a limited number of features and lightweight feature extraction routines that are often less beneficial compared to more advanced ones). Models can rely on features that are fast, computationally inexpensive to obtain (e.g., lightweight features available from static processing) and secure (not requiring potentially insecure local behavior such as controlled execution). For example, in endpoint protection products, these features may relate to other internal structures and data blocks available from static analysis of byte n-grams, strings, file header contents, and embedded active content (as well as analysis sections and disassembly results of executable code, embedded scripts, and macros). In detection and response services, features may also include information from available traces of computer programs and systems and / or user logs, as well as other facts available from sensor-side auxiliary systems such as malware detection engines, memory scanners, and reputation services.

[0062] Backend threat detection models can be trained with features that improve their predictive ability relative to the cost of performance (this may result, for example, from using a larger number of features and applying more advanced and resource-intensive feature extraction techniques). Backend threat detection models can access all inputs available for local threat detection models and can also rely on features that are difficult to obtain for a single endpoint, such as the results of dynamic analysis of embedded active content (e.g., controlled execution, emulation, and sandboxing) and attributes that become available after applying dynamic analysis techniques (e.g., byte n-grams, strings, file header contents, and other internal structures and data blocks inaccessible for static analysis techniques), for example, for endpoint protection products. In detection and response services, model features can include information available from traces of computer programs and system and / or user logs, as well as other facts obtainable from all sensors, and thus they can use general context in addition to local context.

[0063] The local consistency model operates on the endpoint side and therefore deals with features that can be obtained locally at the endpoint or device, for example. At the same time, in one embodiment of the present invention, the feature set used by the consistency model does not need to be the same as that on which the local threat detection model depends, as it focuses on different purposes of presenting the level of consistency between the local threat detection model and the backend threat detection model for a given input.

[0064] If labels are used, for example, for training data, at least some of these may originate from analysts, threat hunters, incident investigators, and other individuals with domain knowledge, as well as from other sources such as various open reputation services and information exchange programs. In some embodiments, labeled data is not required, and for example, many anomaly detection methods can be applied using unsupervised learning methods.

[0065] While preferred embodiments of the present invention have been described above, it should be understood that these embodiments are merely illustrative and the claims are not limited to these embodiments. Those skilled in the art will be able to modify and substitute based on the disclosures that are considered to be within the scope of the appended claims. Each feature disclosed or illustrated herein may be incorporated into the present invention alone or in any suitable combination with any other features disclosed or illustrated herein. The list and group of examples provided in the above description are not exhaustive unless specifically noted.

Claims

1. A threat detection method in a threat detection network, The threat detection network includes interconnected network nodes and a backend system. The aforementioned backend system utilizes a backend threat detection model, At least a portion of the network nodes includes a security agent module that collects data related to each of the network nodes, The aforementioned network node utilizes a local threat detection model and a local integrity model, The local consistency model is configured to provide trust level information between the local threat detection model and the backend threat detection model. The aforementioned threat detection method is The security agent module collects data related to the network node at the aforementioned network node. A local threat detection model is applied to the collected data. Based on the results of the local threat detection model and the local integrity model, security-related decisions are made at the endpoint. Threat detection methods.

2. The confidence level information between the local threat detection model and the backend threat detection model includes an estimation of agreement between the verdicts provided by the local threat detection model and the backend threat detection model utilized by the backend system. The threat detection method according to claim 1.

3. When the reliability level information provided by the local consistency model exceeds a predetermined reliability level value, the security-related decisions at the network node are made independently by the network node. A threat detection method according to claim 1 or claim 2.

4. When the reliability level information provided by the local consistency model falls below a predetermined reliability level value, the security-related decisions at the network node are made based on the context of the network node. The context of the aforementioned network node is network connectivity, including the availability of internet connectivity. A threat detection method according to claim 1 or claim 2.

5. The threat detection method according to claim 1 or 2, wherein, when the network node and / or the security agent module of the network node is online, the network node queries the backend to utilize the backend threat detection model on the detected object, and security-related decisions are made based on the backend security threat model.

6. If the network node and / or the security agent module of the network node are offline, the network node moves to isolate the detected object. If the network node and / or the security agent module of the network node are online, the backend is queried and the backend threat detection model is utilized for the object in order to make security-related decisions based on the backend security threat model. A threat detection method according to claim 1 or claim 2.

7. When the confidence level information provided by the local consistency model is moderate and / or between predetermined confidence level values, the security-related decisions at the network node are made based on the context of the network node, including network connectivity, and further contextual information about the network node, such as the type of network node and / or the risk level of active users using it. A threat detection method according to claim 1 or claim 2.

8. The set of attributes extracted from objects on the network node for the local threat detection model includes a subset of the set of attributes extracted from the network node for the backend. A threat detection method according to claim 1 or claim 2.

9. The local consistency model is prepared based on the results of verification between the local threat detection model and the backend threat detection model. A threat detection method according to claim 1 or claim 2.

10. Preparing a machine learning-based threat detection model involves Define the characteristics of the backend threat model, Define the characteristics of the local threat model, The backend threat detection model and the local threat detection model are trained based on the training data. The integrity model is trained based on validation data, local threat detection models, and backend threat models, and / or The backend threat detection model, the local threat detection model, and / or the integrity model are prepared in the backend system. A threat detection method according to claim 1 or claim 2.

11. A network node of the threat detection network, The threat detection network includes interconnected network nodes and a backend system. The aforementioned network node is At least one or more processors, At least one security agent module configured to collect data related to each of the aforementioned network nodes, Includes, The aforementioned network node is further configured to utilize a local threat detection model and a local integrity model. The local integrity model, trained and / or provided by the backend system, is configured to provide trust level information between the local threat detection model and the backend threat detection model. The aforementioned network node is The security agent module collects data related to the network node at the aforementioned network node. A local threat detection model is applied to the collected data. Based on the results of the local threat detection model and the local integrity model, security-related decisions are made at the endpoint. It is structured in such a way. Network node.

12. A backend system for a threat detection network, The threat detection network includes interconnected network nodes and a backend system. The backend system includes at least one processor and at least one server configured to utilize a backend threat detection model. The backend system is further configured to train and / or provide local threat detection models and integrity models to network nodes. The local integrity model trained and / or provided by the backend system is configured to provide trust level information between the local threat detection model and the backend threat detection model. The aforementioned backend system is The network node receives data related to the network node collected by the security agent module. The received data is then subjected to a backend threat detection model. Based on the results of the backend threat detection model, it provides information relevant to endpoint security-related decisions. It is structured in such a way. Backend system.

13. At least one network node according to claim 11, and / or At least one backend system according to claim 12, A threat detection network that includes this.

14. Configured to perform the method described in claim 2, Threat detection network.

15. A computer program that, when executed by a computer, includes instructions causing the computer to perform the method according to claim 1 or claim 2.

16. A computer-readable medium comprising the computer program described in claim 15.

Images