Anomaly detection with security agents distributed in a communication network

Abstract

Controller equipment (500) is configured for anomaly detection in a communication network (10) within which security agents (14) are distributed. The controller equipment (500) obtains a reputation score (26) for a security agent (14) in the communication network (10). The reputation score (26) quantifies a reputation that the security agent (14) has, amongst the security agents (14) distributed in the communication network (10), for how accurately or inaccurately the security agent (14) identifies features (20-1...20-M) of anomalies (22-1...22-M) in the communication network (10). Based on the reputation score (26) for the security agent (14), the controller equipment (500) controls how influential the security agent (14) is in defining which features (20-1...20-M) characterize which anomalies (22-1...22-M) to be monitored for in the communication network (10).

Description

[0001] ANOMALY DETECTION WITH SECURITY AGENTS DISTRIBUTED IN A

[0002] COMMUNICATION NETWORK

[0003] TECHNICAL FIELD

[0004] The present application relates generally to anomaly detection in a communication network, and relates more particularly to anomaly detection with security agents distributed in such a communication network.

[0005] BACKGROUND

[0006] In a 5G communication network, a Network Data Analytics Function (NWDAF) analyzes data from the network in order to generate insights and take appropriate actions, e.g., to enhance end-user experience. The 3rdGeneration Partnership Project (3GPP) Technical Report (TR) 23.700-91 V17.0.0 has identified one use of the NWDAF in this regard as detecting cyber-attacks by monitoring events and data packets in user equipments (UEs) and the network, with the support of machine-learning algorithms. To detect cyber-attacks, the NWDAF can collaborate with UEs and other network functions (NFs) to collect data as input and provide alerts of anomaly events as outputs to Operation and Maintenance (OAM) and other NFs which have subscribed to the alerts so that they can take proper action. Furthering the NWDAF’s role in cyber-attack detection, Y. Yuan, et. al, “Insight of Anomaly Detection with NWDAF in 5G”, IEEE CITS, 2022, proposes a collaborative NWDAF framework for abnormal behavior detection in order to improve 5G network security against network attacks.

[0007] Problematically, though, these known approaches to network security assume the NWDAF is trusted and fail to account for the possibility that the NWDAF may itself be compromised. Known approaches for example prove vulnerable to an attack where attackers collaborate between each other in order to infect the NWDAF, leading to the NWDAF itself behaving as a malicious NF. An infected NDWAF could then cause widespread compromise of cyber-attack detection in the network. Challenges therefore remain as to how to exploit an NWDAF for detecting cyber-attacks and other anomalies while securing the network against a compromised NWDAF.

[0008] SUMMARY

[0009] An object of the invention is to enable anomaly detection in a communication network which is robust as against internal network compromise, e.g., a compromised NWDAF.

[0010] Towards this end, some embodiments distribute security agents in a communication network for anomaly detection, but account for the possibility that one or more of those security agents might be compromised from a security perspective. Indeed, rather than outright trusting each security agent, some embodiments effectively scrutinize each security agent’s contribution to anomaly detection, as against other security agents’ contributions, and control how influential each security agent is in view of that scrutiny. One or more embodiments in this regard quantify the reputation that a security agent has, amongst other security agents, for how accurately or inaccurately the security agent identifies features of anomalies, and, based on that quantified reputation, control how influential the security agent is in defining features of anomalies to be monitored. According to some embodiments, then, if a compromised security agent (e.g., a compromised NWDAF) maliciously mischaracterizes features of anomalies, the compromised security agent will develop a reputation for identifying anomaly features with poor accuracy and will correspondingly lose influence over defining which features characterize which anomalies to be monitored. Some embodiments thereby advantageously enable anomaly detection via distributed security agents while safeguarding against security agent compromise.

[0011] More particularly, embodiments herein include a method performed by controller equipment for anomaly detection in a communication network within which security agents are distributed. The method comprises obtaining a reputation score for a security agent in the communication network. In some embodiments, the reputation score quantifies a reputation that the security agent has, amongst the security agents distributed in the communication network, for how accurately or inaccurately the security agent identifies features of anomalies in the communication network. The method also comprises, based on the reputation score for the security agent, controlling how influential the security agent is in defining which features characterize which anomalies to be monitored for in the communication network.

[0012] In some embodiments, the reputation score for the security agent quantifies the reputation of the security agent according to a consensus among the security agents distributed in the communication network.

[0013] In some embodiments, obtaining the reputation score for the security agent comprises determining one or more accuracy metrics reflecting the reputation that the security agent has, amongst the security agents distributed in the communication network, for how accurately or inaccurately the security agent identifies features of anomalies in the communication network. In some embodiments, obtaining the reputation score for the security agent comprises computing the reputation score as a function of the one or more accuracy metrics. In some embodiments, the one or more accuracy metrics include an accurate identification rate indicating a rate at which the security agent accurately identifies features of anomalies in the communication network, according to a consensus amongst the security agents about which features characterize which anomalies. In some embodiments, the one or more accuracy metrics include an inaccurate identification rate indicating a rate at which the security agent inaccurately identifies features of anomalies in the communication network, according to a consensus amongst the security agents about which features characterize which anomalies. In some embodiments, computing the reputation score comprises computing the reputation score as exponentially increasing with the accurate identification rate and as linearly decreasing with the inaccurate identification rate. In some embodiments, obtaining the reputation score for the security agent further comprises determining a network cost rate for the security agent comprising a rate of resources required for the security agent to identify features of anomalies with at least a threshold level of accuracy. In some embodiments, computing the reputation score comprises computing the reputation score also as a function of the network cost rate.

[0014] In some embodiments, said controlling comprises, based on the reputation score for the security agent, activating or deactivating functionality at the security agent that monitors for features of anomalies in the communication network. In other embodiments, said controlling additionally or alternatively comprises, based on the reputation score for the security agent, controlling whether the security agent is allowed to monitor for features of anomalies in the communication network and / or contribute to defining which features characterize which anomalies in the communication network. In yet other embodiments, said controlling additionally or alternatively comprises, based on the reputation score for the security agent, declaring whether or not the security agent is a malicious security agent that is not allowed to contribute to defining which features characterize which anomalies in the communication network.

[0015] In some embodiments, the method comprises computing a level of trust given to the security agent, and wherein said controlling comprises controlling whether the security agent monitors for features of anomalies in the communication network based on the level of trust.

[0016] In some embodiments, the security agents include one or more security agents deployed at one or more respective edge computing servers in the communication network. In other embodiments, the security agents alternatively or additionally include one or more security agents deployed at one or more network data analytics functions, NWDAFs, in the communication network. In yet other embodiments, the security agents alternatively or additionally include one or more security agents deployed at one or more access and mobility functions, AMFs, in the communication network.

[0017] Other embodiments herein include a method performed by a security agent device configured to host a security agent included among multiple security agents distributed in a communication network for anomaly detection. The method comprises exchanging feature reports with other security agents in the communication network. In some embodiments, a feature report from a security agent reports features identified by the security agent as being features of an anomaly in the communication network. The method also comprises, based on the feature reports, forming a consensus amongst the security agents. In some embodiments, forming a consensus amongst the security agents comprises forming a consensus amongst the security agents on at least which features characterize which anomalies in the communication network. In other embodiments, forming a consensus amongst the security agents comprises forming a consensus amongst the security agents on at least accuracy metrics for respective security agents reflecting how accurately or inaccurately the security agents identify features of anomalies in the communication network. In yet other embodiments, forming a consensus amongst the security agents comprises forming a consensus amongst the security agents on at least reputation scores for respective security agents. In some embodiments, the reputation score for a security agent quantifies a reputation of the security agent for how accurately or inaccurately the security agent identifies features of anomalies in the communication network.

[0018] In some embodiments, forming the consensus comprises computing the reputation score for a security agent by, based on the feature reports, determining one or more accuracy metrics reflecting the reputation that the security agent has, amongst the security agents distributed in the communication network, for how accurately or inaccurately the security agent identifies features of anomalies in the communication network. In some embodiments, forming the consensus comprises computing the reputation score for a security agent by computing the reputation score as a function of the one or more accuracy metrics. In some embodiments, the one or more accuracy metrics include an accurate identification rate indicating a rate at which the security agent accurately identifies features of anomalies in the communication network, according to a consensus amongst the security agents about which features characterize which anomalies. In some embodiments, the one or more accuracy metrics include an inaccurate identification rate indicating a rate at which the security agent inaccurately identifies features of anomalies in the communication network, according to a consensus amongst the security agents about which features characterize which anomalies. In some embodiments, computing the reputation score comprises computing the reputation score as exponentially increasing with the accurate identification rate and as linearly decreasing with the inaccurate identification rate. In some embodiments, forming the consensus comprises computing the reputation score for a security agent further by determining a network cost rate for the security agent comprising a rate of resources required for the security agent to identify features of anomalies with at least a threshold level of accuracy. In some embodiments, computing the reputation score comprises computing the reputation score also as a function of the network cost rate.

[0019] In some embodiments, the security agents include one or more security agents deployed at one or more respective edge computing servers in the communication network. In other embodiments, the security agents alternatively or additionally include one or more security agents deployed at one or more network data analytics functions, NWDAFs, in the communication network. In yet other embodiments, the security agents alternatively or additionally include one or more security agents deployed at one or more access and mobility functions, AMFs, in the communication network. Other embodiments herein include controller equipment configured to control anomaly detection in a communication network within which security agents are distributed. The controller equipment is configured to obtain a reputation score for a security agent in the communication network. In some embodiments, the reputation score quantifies a reputation that the security agent has, amongst the security agents distributed in the communication network, for how accurately or inaccurately the security agent identifies features of anomalies in the communication network. The controller equipment is also configured to, based on the reputation score for the security agent, control how influential the security agent is in defining which features characterize which anomalies to be monitored for in the communication network.

[0020] In some embodiments, the controller equipment is configured to perform the steps described above for anomaly detection in a communication network within which security agents are distributed.

[0021] Other embodiments herein include a security agent device configured to host a security agent in a communication network within which multiple security agents are distributed for anomaly detection. The security agent device is configured to exchange feature reports with other security agents in the communication network. In some embodiments, a feature report from a security agent reports features identified by the security agent as being features of an anomaly in the communication network. The security agent device is also configured to, based on the feature reports, form a consensus amongst the security agents. In some embodiments, forming a consensus amongst the security agents comprises forming a consensus amongst the security agents on at least which features characterize which anomalies in the communication network. In other embodiments, a consensus amongst the security agents comprises a consensus amongst the security agents on at least reputations of respective security agents for how accurately or inaccurately the security agents identify features of anomalies in the communication network. In yet other embodiments, a consensus amongst the security agents comprises a consensus amongst the security agents on at least reputation scores for respective security agents, wherein the reputation score for a security agent quantifies a reputation of the security agent for how accurately or inaccurately the security agent identifies features of anomalies in the communication network.

[0022] In some embodiments, the security agent device is configured to perform the steps described above for a security agent included among multiple security agents distributed in a communication network for anomaly detection.

[0023] In some embodiments, a computer program comprising instructions which, when executed by at least one processor of controller equipment, causes the controller equipment to perform the steps described above for anomaly detection in a communication network within which security agents are distributed. In some embodiments, a computer program comprising instructions which, when executed by at least one processor of security agent device, causes the security agent device to perform the steps described above for the security agent device. In some embodiments, a carrier containing the computer program is one of an electronic signal, optical signal, radio signal, or computer readable storage medium.

[0024] Other embodiments herein include controller equipment configured to control anomaly detection in a communication network within which security agents are distributed. The controller equipment comprises processing circuitry. The processing circuity is configured to obtain a reputation score for a security agent in the communication network. In some embodiments, the reputation score quantifies a reputation that the security agent has, amongst the security agents distributed in the communication network, for how accurately or inaccurately the security agent identifies features of anomalies in the communication network. The processing circuity is also configured to, based on the reputation score for the security agent, control how influential the security agent is in defining which features characterize which anomalies to be monitored for in the communication network.

[0025] In some embodiments, the processing circuity is configured to perform the steps described above for controller equipment configured to control anomaly detection in a communication network within which security agents are distributed.

[0026] Other embodiments herein include a security agent device configured to host a security agent in a communication network within which multiple security agents are distributed for anomaly detection. The security agent device comprises processing circuitry. The processing circuitry is configured to exchange feature reports with other security agents in the communication network. In some embodiments, a feature report from a security agent reports features identified by the security agent as being features of an anomaly in the communication network. The processing circuitry is also configured to, based on the feature reports, form a consensus amongst the security agents. In some embodiments, forming a consensus amongst the security agents comprises forming a consensus amongst the security agents on at least which features characterize which anomalies in the communication network. In other embodiments, forming a consensus amongst the security agents comprises forming a consensus amongst the security agents on at least reputations of respective security agents for how accurately or inaccurately the security agents identify features of anomalies in the communication network. In yet other embodiments, forming a consensus amongst the security agents comprises forming a consensus amongst the security agents on at least reputation scores for respective security agents. In some embodiments, the reputation score for a security agent quantifies a reputation of the security agent for how accurately or inaccurately the security agent identifies features of anomalies in the communication network.

[0027] In some embodiments, the processing circuity is configured to perform the steps described above for the security agent device. Other embodiments herein include a non-transitory computer-readable storage medium on which is stored instructions that, when executed by a processor of controller equipment configured to control anomaly detection in a communication network within which security agents are distributed, causes the controller equipment to obtain a reputation score for a security agent in the communication network. In some embodiments, the reputation score quantifies a reputation that the security agent has, amongst the security agents distributed in the communication network, for how accurately or inaccurately the security agent identifies features of anomalies in the communication network. The non-transitory computer-readable storage medium also causes the controller equipment to, based on the reputation score for the security agent, control how influential the security agent is in defining which features characterize which anomalies to be monitored for in the communication network.

[0028] Other embodiments herein include a non-transitory computer-readable storage medium on which is stored instructions that, when executed by a processor of a security agent device configured to host a security agent in a communication network within which multiple security agents are distributed for anomaly detection, causes the security agent device to exchange feature reports with other security agents in the communication network, wherein a feature report from a security agent reports features identified by the security agent as being features of an anomaly in the communication network. The non-transitory computer- readable storage medium also causes the security agent device to, based on the feature reports, form a consensus amongst the security agents. In some embodiments, forming a consensus amongst the security agents comprises forming a consensus amongst the security agents on at least which features characterize which anomalies in the communication network. In other embodiments, forming a consensus amongst the security agents comprises forming a consensus amongst the security agents on at least reputations of respective security agents for how accurately or inaccurately the security agents identifies features of anomalies in the communication network. In yet other embodiments, forming a consensus amongst the security agents comprises forming a consensus amongst the security agents on at least reputation scores for respective security agents. In some embodiments, the reputation score for a security agent quantifies a reputation of the security agent for how accurately or inaccurately the security agent identifies features of anomalies in the communication network.

[0029] Of course, the present disclosure is not limited to the above features and advantages. Indeed, those skilled in the art will recognize additional features and advantages upon reading the following detailed description, and upon viewing the accompanying drawings.

[0030] BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 is a block diagram of a communication network within which security agents are distributed according to some embodiments. Figure 2 is a block diagram of collaboration between the security agents in Figure 1 for identifying features of anomalies in a communication network according to some embodiments.

[0032] Figure 3 is a block diagram of a security agent controller according to some embodiments.

[0033] Figure 4 is a block diagram of a 5G network within which security agents are distributed according to some embodiments.

[0034] Figure 5 is a block diagram of a security agent according to some embodiments.

[0035] Figure 6 is a block diagram of a security agent deployed at an NWDAF (SWF) according to some embodiments.

[0036] Figure 7 is a logic flow diagram of processing performed by security agents according to some embodiments.

[0037] Figure 8 is a chart comparing APR between different detection frameworks according to some embodiments.

[0038] Figure 9 is a logic flow diagram of a method performed by controller equipment for anomaly detection according to some embodiments.

[0039] Figure 10 is a logic flow diagram of a method performed by a security agent device according to some embodiments.

[0040] Figure 11 is a block diagram of a security agent device according to some embodiments. Figure 12 is a block diagram of controller equipment according to some embodiments.

[0041] DETAILED DESCRIPTION

[0042] Figure 1 shows a communication network 10 (e.g., a 5G+ network) according to some embodiments. The communication network 10 provides communication service to one or more communication devices 12, e.g., user equipment (UE). The communication network 10 may for example provide wireless communication service to the one or more communication devices 12.

[0043] The communication network 10 includes security agents 14-1 ... 14-N, generally referred to as security agents 14. The security agents 14 collaborate with one another to detect anomalies in the communication network 10. An anomaly as used herein refers to a deviation from what is standard, normal, or expected in the communication network 10. An anomaly, for example, may be an attack on the communication network 10 (e.g., a denial of service attack), or may be the direct or indirect impact of such an attack (e.g., a higher rate of access request rejection due to overloading, a lower number of connected devices, lower system throughput, etc.). In such an example, an attack itself may be detected, or the direct or indirect impact of such an attack may be detected. Generally, though, an anomaly may be detected in the sense that some sort of deviation from what is standard, normal, or expected is detected, e.g., where a decision on the existence of a deviation may be made based on a machine learning model reflecting what is standard, normal, or expected. Regardless, the security agents 14-1 ... 14-N detect anomalies at respective targets 16-1 ... 16-N in the communication network 10, generally referred to as targets 16. A target 16-n as used herein refers to any network node or function that a security agent 14 scrutinizes for evidence of the existence of an anomaly. In one embodiment, a security agent 14-n may be co-located with the target 16-n at which the security agent 14-n detects anomalies. In this and other embodiments, the distribution of security agents 14 may reflect the distribution of the targets 16 at which the security agents 14 detect anomalies.

[0044] The security agents 14 and / or the targets may be distributed in one or more dimensions, which may for example include geography and / or functionality. In some embodiments, for instance, at least some of the security agents 14 and / or the targets are geographically distributed in the communication network 10, e.g., at different parts of the communication network’s coverage area. For example, at least some of the security agents 14 may be distributed at different respective radio access nodes, at different respective edge computing servers, and / or at different respective core network nodes in the communication network 10. Alternatively or additionally, at least some of the security agents 14 and / or the targets 16 may be functionally distributed in the communication network 10, e.g., for detecting anomalies at different types of network functions or network equipment. In another example, at least some of the security agents 14 may be distributed at different Network Data Analytics Functions (NWDAFs) in the communication network 10 and / or at different Access and Mobility Functions (AMFs) in the communication network 10. As another example, at least some of the security agents 14 may be distributed at different instances of a core network function such as an Access and Mobility Management Function (AMF), Session Management Function (SMF), Network Slice Selection Function (NSSF), Policy Control Function (PCF), or Unified Data Management (UDM) in a 5G network.

[0045] Despite the distributed nature of the security agents 14, the security agents 14 nonetheless collaborate with one another on how to identify anomalies in the communication network 10 on the basis of features characteristic of those anomalies. A feature as used herein is an individual measurable property or attribute, e.g., data rate, CPU consumption, signal strength intensity, jitter, etc. As shown in Figure 2 in this regard, the security agents 14 are configured to exchange feature reports 18 with one another. A feature report 18 from a security agent 14 reports features identified by the security agent 14 as being features of an anomaly in the communication network 10. In the example feature report shown, for instance, a feature report 18 maps certain features 20-1 to a certain type of anomaly 22-1 in order to indicate that those features 20-1 are characteristic of that type of anomaly 22-1 , and maps other features 20- M to a different type of anomaly 22-M in order to indicate that those other features 20-M are characteristic of that other type of anomaly 22-M. By sending a feature report 18, then, a security agent 14 makes a representation to other security agents 14 about which features characterize which anomalies in the communication network 10. This feature reporting may be performed for reporting features of new anomalies not yet experienced in the communication network 10 before, and / or for reporting updated features of existing anomalies previously experienced in the communication network 10.

[0046] In order to generate a feature report 18, a security agent 14 may form its own independent assessment of which features characterize which anomalies, e.g., on the basis of local observations at the target 16 being monitored by that security agent 14. The security agent 14 may for instance perform feature engineering or feature learning, e.g., using machine learning or pattern recognition, so that features characteristic of an anomaly can be used to detect that anomaly.

[0047] The exchange of feature reports 18 amongst distributed security agents 14 advantageously provides each security agent 14 with more robust information about how to identify anomalies in the communication network 10. Indeed, rather than a security agent 14 basing anomaly detection only on anomaly features defined locally at the target 16 it is monitoring, the security agent 14 may base anomaly detection also on anomaly features defined by other security agents 14 at other targets 16. Any given security agent 14 may thereby learn or benefit from feature identification by other security agents 14.

[0048] Some embodiments herein nonetheless account for the possibility that one or more of the security agents 14 might be or become compromised from a security perspective. Some embodiments for example recognize that a compromised security agent 14 infected by a security attack could behave maliciously by broadcasting inaccurate feature reports 18 or by withholding feature reports 18, so as to pollute or otherwise degrade the feature reporting that benign security agents 14 rely on for characterizing anomalies and thereby compromise anomaly detection in the communication network. 10. Rather than outright trusting each security agent 14, then, some embodiments effectively scrutinize each security agent’s feature reporting, as against other security agents’ feature reporting, and control how influential each security agent 14 is in view of that scrutiny.

[0049] Figure 2 in this regard shows that security agent controllers (SACs) 24-1 , 24-2,...24-N in the communication network 10, generally referred to as SACs 24, are configured to control respective security agents 14-1 , 14-2,... 14-N. In some embodiments, a security agent controller 24 is specific to, collocated with, hosted by, and / or comprised in the security agent 14 that it controls. In other embodiments, a security agent controller 24 is separate from the security agent 14 that it controls, from a geographical, logical, or functional perspective, and / or is common to or shared by multiple security agents 14.

[0050] Figure 3 illustrates additional details of a security agent controller 24 configured to control a security agent 14 according to some embodiments. The security agent controller 24 includes a reputation scorer 24R configured to obtain a reputation score 26 for a security agent 14, e.g., by calculating the reputation score 26 from feature reports 18. The reputation score 26 quantifies the reputation that the security agent 14 has, amongst the security agents 14 distributed in the communication network 10, for how accurately or inaccurately the security agent 14 identifies features of anomalies in the communication network 10. A larger reputation score 26 may for example indicate a reputation for more accurate (i.e. , more reputable) feature identification whereas a smaller reputation score 26 may indicate a reputation for less accurate (i.e., less reputable) feature identification. A security agent’s reputation score 26 thereby constitutes a measure of how accurate or inaccurate the security agent’s feature identification is according to the widespread view or experience of other security agents 14. Indeed, in some embodiments, a security agent’s reputation, as quantified by its reputation score 26, may generally characterize the security agent’s tendency or propensity for identifying anomaly features accurately or inaccurately, e.g., as judged by the other security agents 14 and / or as updated over time as the security agent 14 identifies new features.

[0051] Based on the security agent’s reputation score 26, a controller 24C controls how influential the security agent 14 is in defining which features characterize which anomalies to be monitored for in the communication network 10, i.e., how influential the security agent 14 is on anomaly feature definition. A security agent 14 that has a reputation for identifying features less accurately is to have a smaller influence than a security agent 14 that has a reputation for identifying features more accurately, relatively speaking. The controller 24C in this regard may lessen a security agent’s influence over anomaly feature definition the less reputable the security agent’s feature identification. In fact, in some embodiments, if a security agent’s reputation score 26 drops below a minimum required score, the security agent 14 is to no longer have any influence at all over defining which features characterize which anomalies to be monitored for.

[0052] The controller 24C in Figure 3 may for instance generate control signaling 28 as a function of the security agent’s reputation score 26, for controlling the influence of the security agent 14 on anomaly feature definition in the communication network 10. The control signaling 28 may directly control the security agent 14, by controlling whether the security agent 14 provides (or is allowed to provide) feature reports 18, with the implication being that a security agent which does not provide feature reports 18 has no influence over defining which features characterize which anomalies to be monitored in the communication network 10. Or, the control signaling 28 may control other security agents or other nodes, by controlling whether or how much those other security agents or other nodes take into account (and thereby are influenced by) any feature reports 18 from the security agent 18. By controlling production of feature reports 18 by the security agent 14, or by controlling whether or how other security agents or other nodes take into account feature reports 18 from the security agent 14, the controller 24C effectively controls how influential the security agent 14 is in defining which features characterize which anomalies to be monitored.

[0053] More particularly, based on a security agent’s reputation score 26, the controller 24C in one embodiment activates or deactivates functionality at the security agent 14 that monitors for features of anomalies in the communication network 10. For example, the controller 24C may activate the feature monitoring functionality if the security agent’s reputation score 26 is above a minimum required reputation score or deactivate the feature monitoring functionality if the security agent’s reputation score 26 is below the minimum required reputation score. This way, if a security agent 14 develops a reputation for having poor feature identification, the security agent 14 will be controlled to no longer monitor for and / or report features of anomalies to other security agents, and will thereby be controlled to no longer influence how features of anomalies are defined.

[0054] In a similar example, based on a security agent’s reputation score 26, the controller 24C in another embodiment controls whether the security agent 14 is allowed to monitor for features of anomalies in the communication network 10 and / or contribute to defining which features characterize which anomalies in the communication network 10. The controller 24C may for instance generate the control signaling 28 to indicate to other security agents 14 that a particular security agent with a poor reputation score 26 is no longer allowed to monitor for features and / or contribute to feature definition in the communication network 10, e.g., so that the other security agents 14 can ignore any feature reports 18 from that security agent 14. By controlling the security agent’s permission or authorization in this way, the controller 24C effectively illegitimizes any feature reports 18 that a security agent 14 with a poor reputation for feature identification accuracy may produce.

[0055] As yet another example, based on a security agent’s reputation score 26, the controller 24C may declare whether or not a security agent 14 is a malicious security agent that is not allowed to contribute to defining which features characterize which anomalies in the communication network 10. The controller 24C in this case may generate the control signaling 28 to indicate the benign or malicious classification of a security agent 14, with a recipient of the control signaling 28 understanding the implications of the indicated classification. For example, if the security agent 14 itself receives control signaling 28 indicating its classification as a malicious security agent, the security agent 14 may understand that it is commanded to deactivate its feature monitoring. Or, if other security agents receive control signaling 28 indicating another security agent’s classification as a malicious security agent, the other security agents 14 may understand that they are to ignore any feature reports 18 received from such a malicious security agent.

[0056] No matter the particular implementation of the security agent controller 24, then, if a compromised security agent (e.g., a compromised NWDAF) maliciously mischaracterizes or misreports features of anomalies, the compromised security agent will develop a reputation for identifying anomaly features with poor accuracy and will correspondingly lose influence over defining which features characterize which anomalies to be monitored. Some embodiments thereby advantageously enable anomaly detection via distributed security agents 14 while safeguarding against security agent compromise.

[0057] In fact, according to some embodiments, the security agents 14 are distributed in the communication network 10 as part of a zero-trust architecture (ZTA). See, e.g., the ZTA approach described in K. Ramezanpour, et al., “Intelligent Zero Trust Architecture for 5G / 6G Tactical Networks: Principles, Challenges, and the Role of Machine Learning”, arXiv, 2021. The security agents 14 in these and other embodiments may monitor for and detect anomalies in the communication network 10 on the basis that the security agents 14 themselves cannot be trusted.

[0058] Consider now additional details of how to calculate a reputation score 26 for a security agent 14 according to some embodiments. In one embodiment, the reputation score 26 for a security agent 14 is computed as a function of one or more accuracy metrics for the security agent 14. The accuracy metric(s) may for instance include an accurate identification rate C indicating a rate at which the security agent 14 accurately identifies features of anomalies, e.g., computed as the number of correct determinations of anomaly features over the total number of security agents 14. Alternatively or additionally, the accuracy metric(s) may include an inaccurate identification rate F indicating a rate at which the security agent 14 inaccurately identifies features of anomalies, e.g., computed as the number of incorrect determinations of anomaly features over the total number of security agents 14. As an example, the reputation score 26 may be computed as increasing with the accurate identification rate C and as decreasing with the inaccurate identification rate, e.g., so that the reputation score 26 reflects a better reputation the more accurate the security agent’s feature identification over time but reflects a poorer reputation the less accurate the security agent’s feature identification over time. In one specific implementation, though, the rate at which the reputation score 26 increases with improvements in feature identification accuracy is faster than the rate at which the reputation score 26 decreases with degradation in feature identification accuracy. For example, the reputation score 26 may be computed as exponentially increasing with the accurate identification rate C and as linearly decreasing with the inaccurate identification rate F, e.g., as: where Insecurity reputation 'sthe reputation score 26 and and a2are weight scores, each with a range between 0 and 1 according to a desired weighting between the relative impact of the accurate identification rate C and the inaccurate identification rate F. Notice here that the accurate identification rate C is indexed with an exponential function, so that the reputation score 26 exponentially increases with the accurate identification rate C. In these and other embodiments, the reputation score 26 may be a value between -1.0 and 1.0. A higher reputation value generally indicates a reputation for more accurate feature identification and a lower reputation value generally indicates a reputation for less accurate feature identification.

[0059] In fact, in some embodiments, a security agent 14 with a reputation score 26 below a threshold is considered malicious, e.g., in the sense that the security agent 14 must be artificially withholding feature reports 18 and / or reporting inaccurate feature reports 18 for malicious purposes. In this case, a security agent’s reputation score dropping below this threshold may be attributable to an unusually low rate of feature reporting and / or an unusually high rate of inaccurate feature reporting.

[0060] In some embodiments, the reputation score 26 for a security agent 14 is computed also as a function of a network cost rate O for the security agent 14. Here, the network cost rate O for a security agent 14 is the rate of resources (e.g., compute, memory, and / or network resources) required for the security agent 14 to identify features of anomalies with at least at least a threshold level of accuracy (e.g., where the threshold level may correspond to a high level of accuracy). In some embodiments, the network cost rate O converges to one when the total resources required are consumed; otherwise the network cost rate O is close to zero. Regardless, in some embodiments that incorporate the network cost rate O, the reputation score 26 may be computed as:

[0061] In this case, the reputation score 26 decreases as the network cost rate O increases, with the implication being that a security agent’s reputation decreases the higher the rate of resources the security agent 14 demands. Some embodiments herein thereby safeguard against a malicious security agent that maliciously consumes excessive resources for the level of feature identification accuracy provided, by lessening the security agent’s influence on feature definition.

[0062] No matter how the reputation score 26 is calculated, the reputation score 26 in some embodiments indicates the reputation that a security agent 14 has according to a consensus among the security agents 14, e.g., as reached according to a defined consensus protocol such as a blockchain consensus protocol. In one such case, then, the reputation score 26 reflects the security agent’s reputation on the basis of a common understanding or agreement by the security agents 14 in the communication network 10. The consensus nature of the reputation score 26 safeguards the reputation score 26 against some of the security agents 14 (less than the majority) being compromised and colluding to artificially raise the reputations of malicious security agents.

[0063] In some embodiments, the reputation score 26 reflects a consensus among the security agents 14 on which features characterize which anomalies in the communication network 10. For example, in one embodiment, the security agents 14 exchange feature reports 18 as part of a protocol for reaching a consensus among the security agents 14 about which features characterize which anomalies. This may involve the security agents 14 each evaluating received feature reports 18 in conjunction with its own in order to determine what the consensus among the security agents 14 is for which features characterize which anomalies. This consensus on which features characterize which anomalies then forms the basis for a security agent controller 24 to compute accuracy metric(s) (e.g., an accurate identification rate C and / or an inaccurate identification rate F) that reflect how accurately or inaccurately a security agent 14 identifies features, and to then compute the reputation score 26 for that security agent 14 as a function of the accuracy metric(s). In this case, then, because the reputation score 26 is computed on the basis of a consensus among the security agents 14 about which features characterize which anomalies, the reputation score 26 effectively quantifies the reputation that the security agent 14 would have among the security agents 14 for feature identification accuracy.

[0064] In other embodiments, the reputation score 26 for a security agent 14 reflects a consensus among the security agents 14 on the actual value of that security agent’s reputation score 26. In this case, each security agent 14 calculates a respective reputation score 26 for every other security agent 14. The security agents 14 then exchange the computed reputation scores 26 as part of a protocol for reaching a consensus among the security agents 14 about the reputation score 26 that each security agent 14 is to have, e.g., in view of the feature report 18 provided by that security agent 14 as compared to the feature reports 18 provided by other security agents 14.

[0065] In still other embodiments, the reputation score 26 for a security agent 14 reflects a consensus among the security agents 14 on the value(s) of underlying accuracy metric(s) based on which the reputation score 26 is calculated, e.g., on value(s) of the accurate identification rate C and / or the inaccurate identification rate F for the security agent 14. In this case, each security agent 14 calculates respective accuracy metric(s) for every other security agent 14. The security agents 14 then exchange the computed accuracy metric(s) as part of a protocol for reaching a consensus among the security agents 14 about the accuracy metric value(s) that each security agent 14 is to have, e.g., in view of the feature report 18 provided by that security agent 14 as compared to the feature reports 18 provided by other security agents 14. For example, in some embodiments, the accurate identification rate C for a security agent 14 is the number of correct determinations of anomaly features (according to a consensus among the security agents 14) over the total number of security agents 14, e.g., where the consensus reflects the number of correct determinations of anomaly feature as verified and confirmed by all or almost all of the security agents 14. Alternatively or additionally, in some embodiments, the inaccurate identification rate F) for a security agent 14 is the number of incorrect determinations of anomaly features (according to a consensus among the security agents 14) over the total number of security agents 14, e.g., where the consensus reflects the number of incorrect determinations of anomaly feature as verified and confirmed by all or almost all of the security agents 14.

[0066] Generally, then, based on the feature reports 18, the security agents 14 may form a consensus on (i) which features characterize which anomalies; (ii) accuracy metrics for respective security agents 14 reflecting how accurately or inaccurately the security agents 14 identify features of anomalies; and / or (iii) reputation scores 26 for respective security agents 14.

[0067] Note that a security agent 14 herein may constitute hardware, software, or a combination thereof. A security agent 14 may for example constitute dedicated hardware or equipment configured with circuitry and / or computer program instructions for performing the functionality described, where the hardware or equipment may be centralized or distributed. In another embodiment, a security agent 14 constitutes a specific virtualized instance of such hardware or equipment. In these and other embodiments, then, a security agent 14, whether in the form of hardware, software, or a combination thereof, may be hosted on or by a security agent device 14D.

[0068] Figure 4 shows a specific example implementation of some embodiments where the distributed security agents 14 are deployed at edge computing servers (as Security Edge (SE) Agents, SEAs), at one or more instances of an NWDAF (as a Security NWDAF, SWF, agent), and at one or more instances of an AMF (as a Security AMF, SAMF, agent) in a 5G network, for detecting anomalies in the form of attacks. In this example implementation, then, security agent devices 14D that host distributed security agents 14 are exemplified as edge computing servers, AMF instance(s), and NWDAF instance(s). These distributed security agents are not assumed to be trusted. The example however also employs a centralized security agent that is assumed to be trusted. The centralized security agent aggregates anomaly detection decisions from the distributed security agents. The centralized security agent may be deployed as a security information and event management (SIEM) agent.

[0069] As shown in Figure 4, a UE 12 provides user data 13 to the communication network 10, illustrated as a 5G network. The 5G network includes one or more instances of an NWDAF 30. A security agent 14 in the form of an SWF agent 14A is deployed at the NWDAF 30. Another security agent 14 in the form of an SE agent 14B is deployed at an edge NWDAF 32. And still another security agent 14 in the form of an SAMF agent 14C is deployed at an AMF 34.

[0070] In this context, the security agents 14A, 14B, and / or 14C detect cyber-attacks in the communication network 10 consistent with 3GPP TR 23.700-91 V17.0.0, except the NWDAF 30, Edge NWDASF 32, and / or AMF 34 are not assumed to be secure security network functions. Accordingly, this example secures the NWDAF 30, Edge NWDAF 32, and / or AMF 34 from internal attacks and detects a malicious NWADF 30, Edge NWDAF 32, and / or AMF 34 using a collaborative cyber detection and reaction scheme based on the ZTA principles.

[0071] The security agents 14A, 14B, and 14C collaborate between each other to execute feature monitoring, trust evaluation, and reaction processes, as described below. Figure 5 for example shows that each security agent 14A, 14B, and 14C is equipped with the following security modules: a feature monitoring module 40, an attack detection module 44, and a trust monitoring module 48. The feature monitoring module 40 as shown is configured to identify features 42 of anomalies to be monitored for in the communication network 10. The feature monitoring module 40 may for example rely on a rules-based attack monitoring technique. This technique is based on a set of security rules to monitor the behaviors of target node(s) (e.g., NF) and extract the relevant attacks’ features of the target that is suspected to behave as a malicious target. Those relevant attacks’ features could be for instance the data rate, CPU consumption, signal strength intensity, and / or jitter (time between two subsequent packets).

[0072] The security agent 14A, 14B, or 14C executes the rules-based attack monitoring technique. In case the feature monitoring module 40 of the security agent 14A, 14B, or 14C identifies a new attack’s features, the data verification process is executed. In this data verification process, the goal is to verify whether the new attack’s features are correct, as opposed to the features having been fabricated in case the security agent is compromised or malicious. Hence, the purpose of the data verification process is to reduce false positives. In this verification process, the security agent 14A, 14B, 14C shares the determined attack’s features with other security agents. If there is consensus among the security agents about the attack’s features, e.g., if almost all of the security agents agree that the features characterize the attack, the security reputation of the security agent 14A, 14B, 14C increases. Broadly applied across the security agents, then, the security reputation of those security agents that agree about the attack’s features increase and the security reputation of the other security agents that do not agree on the attack’s features decrease, e.g., as shown in equation 2. It is noted that, the threshold governing how many of the security agents must agree to reach a consensus may correspond to a value that is strictly superior (i.e., >>) to half of the total number of security agents, e.g., where this threshold value is provided by a security expert and updated over time.

[0073] Accordingly, the distributed security agents interact with each other via their respective feature monitoring modules. Over time, the security agents evaluate the relevance of determined attacks’ features to both (i) detect the relevant attacks’ features 42 (that will be used as inputs to the attack detection module 44 for the new attack detection); and (ii) detect any malicious security agent (such as malicious NWDAF), e.g., as exhibiting a low security reputation (i.e., F + a3. O > a . ec). If any malicious security agent is detected, that security agent will no longer have the right to play the role of a security agent.

[0074] With regard to the attack detection module 44, the security agent 14A, 14B, 14C collaborates with other security agents to detect internal and external attacks and specifically detect any malicious NWDAF and / or malicious NFs (such as malicious AMF). The feature monitoring modules from the security agents that exhibit high security reputation values provide for each the relevant and new attacks’ features to the attack detection modules 44, with a goal to detect the known and unknow attacks (based on those new determined attacks’ features). The attack detection technique executed by each security agent is based on a dynamic detection process. This process means that the detection technique switches from the machine learning based attack detection to the hybrid detection technique with a goal to reduce the false positive generated by the security agent (e.g., SE, SWF or / and SAMF agents); and switch back from hybrid detection technique to machine learning based attack detection with a goal to lighten the detection process (reduce the cost such as computation overhead).

[0075] It is noted that machine learning based attack detection has the ability to detect attacks with a high attack detection rate. However, high false positives could be generated specifically when the number of attacks is high or / and the used attacks’ features are not relevant for the detection. The attack detection module 44 according to some embodiments herein addresses this using a hybrid detection technique that is a hybrid of a machine learning based detection technique and a rules-based detection technique. The rule-based detection technique aims to reduce false positives generated by the machine learning algorithm, thanks to rules which may be updated by a security expert over time. Each security agent that detects a new attack shares a detection report with other security agents, where the detection report includes the kind of detected attack, time of detection and the related attack’s features. Afterwards, each security agent (SE, SWF and SAMF agents) verifies if the new detected attack corresponds really to a cyber / network attack. Each security agent in this regard assigns a detection score for each neighborhood security agent as shown in Eq. 3:

[0076] ^Detection Score where ft are weight scores ]0, 1[, D is the number of correct detections provided by the monitored security agent (that detects the new attack) and confirmed by the monitoring security agent (that receives the new detected attack) over the number of interactions between the monitored and monitoring security agents. P is the number of false positive generated by the monitored security agent and detected by the monitoring security agent over the number of interactions between the monitored and monitoring security agents. X is the network cost rate (e.g., computation overhead rate) required to achieve a high accuracy detection (i.e. , High D and Low F). From Eq (2) the neighborhood monitoring security agents request the monitored security agent to switch from the machine learning based attack detection technique to the hybrid detection technique when P2->:>Pi- D (with a goal to reduce the false positive rate). And the neighborhood monitoring security agents request the monitored security agent to switch back from the hybrid detection technique to the machine learning based attack detection technique when ?3. X » D (with a goal to reduce the network cost rate).

[0077] As shown in Figure 4, the workflow according to some embodiments is as follows. First, user data 13 is generated by a UE 12 and sent to the 5G network 10. Second, the NWDAF 30 gathers information from related NFs in the 5G network 10. Third, as shown in Figure 6, the SWF 14A (within he NWDAF 30) determines the security reputation ^Security reputation and the detection score ^Detection Score related to security agents SE 14B and SAMF 14C. That is, the SWF 14A evaluates the accuracy of attack features determined by SE 14B and SAMF 14C. And the SWF 14A evaluates the accuracy of attack detection provided by SE 14B and SAMF 14C (and activation of optimal detection technique). The process is similar for the other security agents, SE 14B and SAMF 14C.

[0078] Considering now the trust monitoring module 48 in Figure 5, the detection score, ^Detection Score related to each monitored security agent is sent (by the monitoring security agent that computed it) to a centralized security agent that is trusted (such as security information and event management-SIEM) for an aggregation process. This centralized security agent first verifies if this monitoring security agent has exhibited correct attack detection in the past and how many correct attack detections are provided by that monitoring security agent. Afterward, the centralized security agent computes an aggregated detection score related to the monitoring security agent, as shown in Eq. 4: j j* _ t=i ^Detection Score , ...

[0079] ^Detection Score—NW

[0080] Here, N is the number of monitoring security agents that receive the detected new attack from the monitored security agent.

[0081] The goal of the trusted security agent is to evaluate the trust of security agents (SE 14B, SWF 14A, and SAMF 14C), and then request each security agent to execute a specific security action according to the monitored aggregated detection score. Some embodiments operate based on a security game that recognizes SE, SWF or / and SAMF agents may be malicious security agent(s). In the security game, there are two kinds of players. Security players include the trusted SE, SWF and SAMF agents 14A, 14B, 14C, and a centralized security agent such as SIEM. The malicious players include malicious SE, SWF and SAMF agents. The goal of security players is to maximize the utility function, ^Detection Scoreas shown in Eq. (5), where the goal of the malicious players is to minimize the utility function as shown in Eq. (6).

[0082] The centralized security agent computes and monitors Usecurity playersanc* ^Malicious players related to the monitored security agents, and computes the Trust Monitoring Score defined in Eq. 7: According to the obtained score, the centralized security agent requests the security agents to activate both security actions (i.e. , feature monitoring and attack detection), activate only feature monitoring, or in the worst case (when the score is very low) deactivate all security actions so that the monitored security agents are no longer able to play the role of security agents.

[0083] Figure 7 shows the overall process according to these embodiments. As shown, the SE, SWF, and SAMF agents 14A, 14B, 14C activate their respective feature monitoring modules 40 (Block 100). With those modules 40 activated, the SE, SWF, and SAMF agents 14A, 14B, 14C monitor the respective security reputation scores Usecurity reputation (Block 105). If a monitored security agent’s security reputation scoresSecurity reputation 'sbelow a threshold of 0, which occurs if F + ct3. O > a . ec) (YES at Block 110), the monitored security agent is categorized as a malicious agent (Block 115). For any monitored security agent that is not categorized as a malicious agent (NO at Block 110), the security agent activates its attack detection module (Block 120) and monitors the respective detection score U[)etectonscore (Block 125).

[0084] If 02. P » Pl.D (YES at Block 130) or ?3. X » Block 135) in a security agent’s detection score UDetection Score, the monitored security agent switches from the machine learning based attack detection technique to the hybrid detection technique (Block 140). Otherwise (NO at Block 130 and YES at Block 135), the monitored security agent switches back to the machine learning based attack detection technique (Block 145). The SE, SWF, and SAMF agents 14A, 14B, 14C furthermore activate their trust monitoring modules 48 (Block 150) and monitor U security players and Uj\^anciousplayers (Block 155). The SE, SWF, and SAMF agents 14A, 14B, 14C then take one of three actions depending on the y2. ^Malicious players (YES at Block 160), Action 1 is taken (Block 165). Action 1 may for instance be that the security agent activates its feature monitoring module 40 and its attack detection module 44.

[0085] Otherwise (NO at Block (YES at Block 170), Action 2 is taken (Block 175). Action 2 may for instance be that the security agent activates only its feature monitoring module 40. ES at Block 180), Action 3 is taken (Block 185). Action 8 may for instance be that the security agent is categorized as a malicious security agent, e.g., whereby both its feature monitoring module 40 and its attack detection module 44 are deactivated.

[0086] Otherwise (NO at Block 180), the SE, SWF, and SAMF agents 14A, 14B, 14C update (Block 125).

[0087] Note that, in some embodiments, the detection framework herein may be controlled and operated by the network operator, since the security agents, SWF and SAMF are activated within the core network, where those security agents could be connected to the NWDAF and AMF to monitor all the network streams that traverse those network functions.

[0088] Some embodiments herein advantageously provide improved security performance. Consider an example detection framework according to some embodiments based on a Federated Learning (FL) algorithm, where the security agents, SE, SWF and SAMF run a FL algorithm and each agent may play the role of FL client or FL server. For instance, in one scenario, SE and SAMF agents play the role of FL clients and SWF plays the role of FL server. The proposed hierarchical attack detection framework (i.e. , equipped with hierarchical agents, SE, SWF and SAMF) is compared with the centralized attack detection framework. This latter centralized framework means that only one security agent activated at the edge or core network executes the feature monitoring and attack detection process. Using the open-source attack data set NSL KDD (https: / / www.unb.ca / cic / datasets / nsl.html, retrieved on 27 July 2023), Figure 8 shows the Accuracy Prevention Rate (APR) as compared between the two frameworks. The APR is computed as the attack detection rate minus the false positive rate. The attack detection rate corresponds to the number of attacks detected by the security agent(s) over the total number of attacks. The false positive rate corresponds to the number of false detection (i.e., detecting the malicious behavior as normal and vice versa) generated by the security agent(s) over the total number of attacks.

[0089] The NSL KDD contains a total of 4,898,431 records and each record contains a set of features, such as number of packets sent and received per second, time between two subsequent packets, number of dropped packets, information of the used communication protocols, etc. The NSL KDD is categorized into two classes, normal and attack classes. Among the attacks that could be launched in the context of a 5G architecture, DoS attack is cited. In the proposed security use case, the security agents, SE, SWF and SAMF use 60% of all traffic records for the training process and the remaining 40% for the classification and detection process. During the training and detection process, the security agents extract all the relevant features, I.e., relevant computed and / or collected data (e.g., the number of packets sent and number of dropped packets) from NSL KDD and then those relevant features are forwarded to the artificial intelligence (Al) algorithms for the training and attack detection process. The DoS attack that is launched corresponds to an Internet of Things (loT) attacks, where the attacker is a botnet attack that aims to execute external threats against a radio access network (RAN) with the goal to execute at the end internal threats within the core network and hence infect the core network function such as NWDAF.

[0090] As illustrated in Figure 8, the amount of malicious data traffic is varied from 5% to 40% and the APR of two attack detection frameworks are analyzed; namely, the attack detection framework based on distributed security agents as described herein and a comparison detection framework based on a centralized security agent, such as the SIEM. From Figure 8, it is apparent that when the malicious data traffic increases and specifically reaches 40% of total traffic data, the detection framework based on distributed security agents exhibits a high APR as compared to the centralized detection framework. This is mainly due to the fact that the centralized detection framework generates a high false positive. The detection framework based on distributed security agents by contrast relies on a collaborative feature monitoring and collaborative attack detection in addition to the trust evaluation mechanism with the goal to reduce further the false positives and hence increases the APR.

[0091] Some embodiments herein thereby provide a new collaborative cyber detection and reaction scheme based on the ZTA principles such as Zero Trust, Trust Evaluation and Data Monitoring. The proposed cyber detection and reaction scheme in one embodiment aims to secure the NWDAF and NFs that interact with the NWDAF, e.g., as an improvement in the context of TR 23.700-91 V17.0.0.

[0092] Some embodiments in this regard provide a set of security agents 14 deployed at an edge computing server (Security Edge-SE Agent), NWDAF (Security NWDAF- SWF agent) and at NFs such as AMF (defined as Security AMF-SAMF Agent). The security agents collaborate between each other to execute feature monitoring, trust evaluation, and reaction process. Feature monitoring determines the relevant security information (new attacks’ features) based on the monitoring of security reputations (related to the monitored SE, SWF and SAMF agents). Attach detection aims to detect the attacks, while considering the balance between the accuracy of attack detection, false positive and network cost. This achieved by monitoring a detection score related to each security agent. The purpose of trust monitoring is the optimal activation of feature monitoring and attack detection, by monitoring and analyzing a trust monitoring score.

[0093] Certain embodiments may provide one or more of the following technical advantage(s). Some embodiments improve the security of NWDAF and accounts for the fact that the NWDAF could play the role of a malicious agent (security against the malicious NWDAF). Alternatively or additionally, some embodiments activate optimally the security modules of the proposed security agents by considering the generated false positives and the required network cost to achieve a high level of security. Alternatively or additionally, some embodiments may be used to enhance the security by improving the accuracy of attacks detection, specifically for the zero trust frameworks that generate high false positives and false negatives (for instance when complex and unknown attacks are occurring, such as zero- day attacks). Alternatively or additionally, some embodiments provide a collaborative detection process between SE, SWF and SAMF agents with the goal to lead only the trusted security agents to participate in the feature monitoring and attack detection process.

[0094] In view of the modifications and variations herein, Figure 9 depicts a method performed by controller equipment 500 for anomaly detection in a communication network 10 within which security agents 14 are distributed in accordance with particular embodiments. The method includes obtaining a reputation score 26 for a security agent 14 in the communication network 10 (Block 200). The method also includes, based on the reputation score 26 for the security agent 14, controlling how influential the security agent 14 is in defining which features characterize which anomalies to be monitored for in the communication network 10 (Block 210).

[0095] In some embodiments, the reputation score 26 for the security agent 14 quantifies the reputation of the security agent 14 according to a consensus among the security agents 14 distributed in the communication network 10.

[0096] In some embodiments, obtaining the reputation score 26 for the security agent 14 comprises determining one or more accuracy metrics reflecting the reputation that the security agent 14 has, amongst the security agents 14 distributed in the communication network 10, for how accurately or inaccurately the security agent 14 identifies features of anomalies in the communication network 10. In some embodiments, obtaining the reputation score 26 for the security agent 14 comprises computing the reputation score 26 as a function of the one or more accuracy metrics. In some embodiments, the one or more accuracy metrics include an accurate identification rate indicating a rate at which the security agent 14 accurately identifies features of anomalies in the communication network 10, according to a consensus amongst the security agents 14 about which features characterize which anomalies. In some embodiments, the one or more accuracy metrics include an inaccurate identification rate indicating a rate at which the security agent 14 inaccurately identifies features of anomalies in the communication network 10, according to a consensus amongst the security agents 14 about which features characterize which anomalies. In some embodiments, computing the reputation score 26 comprises computing the reputation score 26 as exponentially increasing with the accurate identification rate and as linearly decreasing with the inaccurate identification rate. In some embodiments, obtaining the reputation score 26 for the security agent 14 further comprises determining a network cost rate for the security agent 14 comprising a rate of resources required for the security agent 14 to identify features of anomalies with at least a threshold level of accuracy. In some embodiments, computing the reputation score 26 comprises computing the reputation score 26 also as a function of the network cost rate.

[0097] In some embodiments, said controlling comprises, based on the reputation score 26 for the security agent 14, activating or deactivating functionality at the security agent 14 that monitors for features of anomalies in the communication network 10. In other embodiments, said controlling additionally or alternatively comprises, based on the reputation score 26 for the security agent 14, controlling whether the security agent 14 is allowed to monitor for features of anomalies in the communication network 10 and / or contribute to defining which features characterize which anomalies in the communication network 10. In yet other embodiments, said controlling additionally or alternatively comprises, based on the reputation score 26 for the security agent 14, declaring whether or not the security agent 14 is a malicious security agent 14 that is not allowed to contribute to defining which features characterize which anomalies in the communication network 10.

[0098] In some embodiments, the method comprises computing a level of trust given to the security agent 14, and wherein said controlling comprises controlling whether the security agent 14 monitors for features of anomalies in the communication network 10 based on the level of trust.

[0099] In some embodiments, the security agents 14 include one or more security agents 14 deployed at one or more respective edge computing servers in the communication network 10. In other embodiments, the security agents 14 alternatively or additionally include one or more security agents 14 deployed at one or more network data analytics functions, NWDAFs, in the communication network 10. In yet other embodiments, the security agents 14 alternatively or additionally include one or more security agents 14 deployed at one or more access and mobility functions, AMFs, in the communication network 10.

[0100] Figure 10 depicts a method performed by a security agent device 14D configured to host a security agent 14 included among multiple security agents 14 distributed in a communication network 10 for anomaly detection in accordance with other particular embodiments. The method includes exchanging feature reports 18 with other security agents 14 in the communication network 10 (Block 300). The method also includes, based on the feature reports 18, forming a consensus amongst the security agents 14 (Block 310). In some embodiments, forming a consensus amongst the security agents 14 comprises forming a consensus amongst the security agents 14 on at least which features characterize which anomalies in the communication network 10 (Block 320). In other embodiments, forming a consensus amongst the security agents 14 comprises forming a consensus amongst the security agents 14 on at least accuracy metrics for respective security agents 14 reflecting how accurately or inaccurately the security agents 14 identify features of anomalies in the communication network 10 (Block 330). In yet other embodiments, forming a consensus amongst the security agents 14 comprises forming a consensus amongst the security agents 14 on at least reputation score 26s for respective security agents 14 (Block 340).

[0101] In some embodiments, forming the consensus comprises computing the reputation score 26 for a security agent by, based on the feature reports 18, determining one or more accuracy metrics reflecting the reputation that the security agent has, amongst the security agents 14 distributed in the communication network 10, for how accurately or inaccurately the security agent identifies features of anomalies in the communication network 10. In some embodiments, forming the consensus comprises computing the reputation score 26 for a security agent by computing the reputation score 26 as a function of the one or more accuracy metrics. In some embodiments, the one or more accuracy metrics include an accurate identification rate indicating a rate at which the security agent accurately identifies features of anomalies in the communication network 10, according to a consensus amongst the security agents 14 about which features characterize which anomalies. In some embodiments, the one or more accuracy metrics include an inaccurate identification rate indicating a rate at which the security agent inaccurately identifies features of anomalies in the communication network 10, according to a consensus amongst the security agents 14 about which features characterize which anomalies. In some embodiments, computing the reputation score 26 comprises computing the reputation score 26 as exponentially increasing with the accurate identification rate and as linearly decreasing with the inaccurate identification rate. In some embodiments, forming the consensus comprises computing the reputation score 26 for a security agent further by determining a network cost rate for the security agent comprising a rate of resources required for the security agent to identify features of anomalies with at least a threshold level of accuracy. In some embodiments, computing the reputation score 26 comprises computing the reputation score 26 also as a function of the network cost rate.

[0102] In some embodiments, the security agents 14 include one or more security agents 14 deployed at one or more respective edge computing servers in the communication network 10. In other embodiments, the security agents 14 alternatively or additionally include one or more security agents 14 deployed at one or more network data analytics functions, NWDAFs, in the communication network 10. In yet other embodiments, the security agents 14 alternatively or additionally include one or more security agents 14 deployed at one or more access and mobility functions, AMFs, in the communication network 10.

[0103] Embodiments herein also include corresponding apparatuses. Embodiments herein for instance include a security agent device 14D configured to perform any of the steps of any of the embodiments described above for the security agent device 14D.

[0104] Embodiments also include a security agent device 14D comprising processing circuitry and power supply circuitry. The processing circuitry is configured to perform any of the steps of any of the embodiments described above for the security agent device 14D. The power supply circuitry is configured to supply power to the security agent device 14D.

[0105] Embodiments further include a security agent device 14D comprising processing circuitry. The processing circuitry is configured to perform any of the steps of any of the embodiments described above for the security agent device 14D. In some embodiments, the security agent device 14D further comprises communication circuitry.

[0106] Embodiments further include a security agent device 14D comprising processing circuitry and memory. The memory contains instructions executable by the processing circuitry whereby the security agent device 14D is configured to perform any of the steps of any of the embodiments described above for the security agent device 14D.

[0107] Embodiments herein also include controller equipment 500 configured to perform any of the steps of any of the embodiments described above for security agent controller 24.

[0108] Embodiments also include controller equipment 500 comprising processing circuitry and power supply circuitry. The processing circuitry is configured to perform any of the steps of any of the embodiments described above for the security agent controller 24. The power supply circuitry is configured to supply power to the controller equipment 500.

[0109] Embodiments further include controller equipment 500 comprising processing circuitry. The processing circuitry is configured to perform any of the steps of any of the embodiments described above for the security agent controller 24. In some embodiments, the controller equipment 500 further comprises communication circuitry. Embodiments further include controller equipment 500 comprising processing circuitry and memory. The memory contains instructions executable by the processing circuitry whereby the controller equipment 500 is configured to perform any of the steps of any of the embodiments described above for the security agent controller 24.

[0110] More particularly, the apparatuses described above may perform the methods herein and any other processing by implementing any functional means, modules, units, or circuitry. In one embodiment, for example, the apparatuses comprise respective circuits or circuitry configured to perform the steps shown in the method figures. The circuits or circuitry in this regard may comprise circuits dedicated to performing certain functional processing and / or one or more microprocessors in conjunction with memory. For instance, the circuitry may include one or more microprocessor or microcontrollers, as well as other digital hardware, which may include digital signal processors (DSPs), special-purpose digital logic, and the like. The processing circuitry may be configured to execute program code stored in memory, which may include one or several types of memory such as read-only memory (ROM), random-access memory, cache memory, flash memory devices, optical storage devices, etc. Program code stored in memory may include program instructions for executing one or more telecommunications and / or data communications protocols as well as instructions for carrying out one or more of the techniques described herein, in several embodiments. In embodiments that employ memory, the memory stores program code that, when executed by the one or more processors, carries out the techniques described herein.

[0111] Figure 11 for example illustrates a security agent device 14D as implemented in accordance with one or more embodiments. As shown, the security agent device 14D includes processing circuitry 410 and communication circuitry 420. The communication circuitry 420 is configured to transmit and / or receive information to and / or from one or more other nodes, e.g., via any communication technology. The processing circuitry 410 is configured to perform processing described above, e.g., in Figure 9, such as by executing instructions of a computer program 435 stored in a computer-readable storage medium 430. The processing circuitry 410 in this regard may implement certain functional means, units, or modules.

[0112] Figure 12 illustrates a controller equipment 500 as implemented in accordance with one or more embodiments. As shown, the controller equipment 500 includes processing circuitry 510 and communication circuitry 520. The communication circuitry 520 is configured to transmit and / or receive information to and / or from one or more other nodes, e.g., via any communication technology. The processing circuitry 510 is configured to perform processing described above, e.g., in Figure 10, such as by executing instructions of a computer program 535 stored in a computer-readable storage medium 530. The processing circuitry 510 in this regard may implement certain functional means, units, or modules. Those skilled in the art will also appreciate that embodiments herein further include corresponding computer programs.

[0113] A computer program 435 comprises instructions which, when executed on at least one processor of a security agent device 14D, cause the security agent device 14D to carry out any of the respective processing described above. A computer program 435 in this regard may comprise one or more code modules corresponding to the means or units described above.

[0114] Embodiments further include a carrier containing such a computer program. This carrier may comprise one of an electronic signal, optical signal, radio signal, or computer-readable storage medium 430.

[0115] In this regard, embodiments herein also include a computer program product stored on a non-transitory computer readable (storage or recording) medium 434 and comprising instructions that, when executed by a processor of a security agent device 14D, cause the security agent device 14D to perform as described above.

[0116] Embodiments further include a computer program product comprising program code portions for performing the steps of any of the embodiments herein when the computer program product is executed by a security agent device 14D. This computer program product may be stored on a computer-readable recording medium 430.

[0117] A computer program 5345 comprises instructions which, when executed on at least one processor of controller equipment 500, cause the controller equipment 500 to carry out any of the respective processing described above. A computer program 535 in this regard may comprise one or more code modules corresponding to the means or units described above.

[0118] Embodiments further include a carrier containing such a computer program 535. This carrier may comprise one of an electronic signal, optical signal, radio signal, or computer- readable storage medium 530.

[0119] In this regard, embodiments herein also include a computer program product stored on a non-transitory computer readable (storage or recording) medium 530 and comprising instructions that, when executed by a processor of controller equipment 500, cause the controller equipment 500 to perform as described above.

[0120] Embodiments further include a computer program product comprising program code portions for performing the steps of any of the embodiments herein when the computer program product is executed by controller equipment 500. This computer program product may be stored on a computer-readable recording medium 530.

[0121] Although the computing devices described herein (e.g., network device and / or lawful interception device) may include the illustrated combination of hardware components, other embodiments may comprise computing devices with different combinations of components. It is to be understood that these computing devices may comprise any suitable combination of hardware and / or software needed to perform the tasks, features, functions and methods disclosed herein. Moreover, while components are depicted as single boxes located within a larger box, or nested within multiple boxes, in practice, computing devices may comprise multiple different physical components that make up a single illustrated component, and functionality may be partitioned between separate components. For example, a communication interface may be configured to include any of the components described herein, and / or the functionality of the components may be partitioned between the processing circuitry and the communication interface. In another example, non-computationally intensive functions of any of such components may be implemented in software or firmware and computationally intensive functions may be implemented in hardware.

[0122] In certain embodiments, some or all of the functionality described herein may be provided by processing circuitry executing instructions stored on in memory, which in certain embodiments may be a computer program product in the form of a non-transitory computer- readable storage medium. In alternative embodiments, some or all of the functionality may be provided by the processing circuitry without executing instructions stored on a separate or discrete device-readable storage medium, such as in a hard-wired manner. In any of those particular embodiments, whether executing instructions stored on a non-transitory computer- readable storage medium or not, the processing circuitry can be configured to perform the described functionality. The benefits provided by such functionality are not limited to the processing circuitry alone or to other components of the computing device, but are enjoyed by the computing device as a whole, and / or by end users and a wireless network generally.

Claims

CLAIMS1. A method performed by controller equipment (500) for anomaly detection in a communication network (10) within which security agents (14) are distributed, the method comprising: obtaining (200) a reputation score (26) for a security agent (14) in the communication network (10), wherein the reputation score (26) quantifies a reputation that the security agent (14) has, amongst the security agents (14) distributed in the communication network (10), for how accurately or inaccurately the security agent (14) identifies features (20-1...20-M) of anomalies (22-1 ...22-M) in the communication network (10); and based on the reputation score (26) for the security agent (14), controlling (210) how influential the security agent (14) is in defining which features (20-1 ...20-M) characterize which anomalies (22-1 ...22-M) to be monitored for in the communication network (10).

2. The method of claim 1, wherein the reputation score (26) for the security agent (14) quantifies the reputation of the security agent (14) according to a consensus among the security agents (14) distributed in the communication network (10).

3. The method of any one of claims 1-2, wherein obtaining the reputation score (26) for the security agent (14) comprises: determining one or more accuracy metrics reflecting the reputation that the security agent (14) has, amongst the security agents (14) distributed in the communication network (10), for how accurately or inaccurately the security agent (14) identifies features (20-1...20-M) of anomalies (22-1 ...22-M) in the communication network (10); and computing the reputation score (26) as a function of the one or more accuracy metrics.

4. The method of claim 3, wherein the one or more accuracy metrics include: an accurate identification rate indicating a rate at which the security agent (14) accurately identifies features (20-1 ...20-M) of anomalies (22-1 ...22-M) in the communication network (10), according to a consensus amongst the security agents (14) about which features (20-1 ...20-M) characterize which anomalies (22-1...22-M); and an inaccurate identification rate indicating a rate at which the security agent (14) inaccurately identifies features (20-1 ...20-M) of anomalies (22-1...22-M) in the communication network (10), according to a consensus amongst the securityagents (14) about which features (20-1 ...20-M) characterize which anomalies (22-1...22-M).

5. The method of claim 4, wherein computing the reputation score (26) comprises computing the reputation score (26) as exponentially increasing with the accurate identification rate and as linearly decreasing with the inaccurate identification rate.

6. The method of any one of claims 3-5, wherein obtaining the reputation score (26) for the security agent (14) further comprises determining a network cost rate for the security agent (14) comprising a rate of resources required for the security agent (14) to identify features (20-1 ...20-M) of anomalies (22-1 ...22-M) with at least a threshold level of accuracy, and wherein computing the reputation score (26) comprises computing the reputation score (26) also as a function of the network cost rate.

7. The method of any one of claims 1-6, wherein said controlling comprises, based on the reputation score (26) for the security agent (14): activating or deactivating functionality at the security agent (14) that monitors for features (20-1 ...20-M) of anomalies (22-1 ...22-M) in the communication network (10); controlling whether the security agent (14) is allowed to monitor for features (20-1...20- M) of anomalies (22-1 ...22-M) in the communication network (10) and / or contribute to defining which features (20-1 ...20-M) characterize which anomalies (22-1 ...22-M) in the communication network (10); and / or declaring whether or not the security agent (14) is a malicious security agent that is not allowed to contribute to defining which features (20-1 ...20-M) characterize which anomalies (22-1...22-M) in the communication network (10).

8. The method of any one of claims 1-7, comprising computing a level of trust given to the security agent (14), and wherein said controlling comprises controlling whether the security agent (14) monitors for features (20-1...20-M) of anomalies (22-1 ...22-M) in the communication network (10) based on the level of trust.

9. The method of any one of claims 1-8, wherein the security agents (14) include: one or more security agents (14) deployed at one or more respective edge computing servers in the communication network (10); one or more security agents (14) deployed at one or more network data analytics functions, NWDAFs, in the communication network (10); and / orone or more security agents (14) deployed at one or more access and mobility functions, AMFs, in the communication network (10).

10. A method performed by a security agent device (14D) configured to host a security agent (14) included among multiple security agents (14) distributed in a communication network (10) for anomaly detection, the method comprising: exchanging (300) feature reports (18) with other security agents (14) in the communication network (10), wherein a feature report (18) from a security agent (14) reports features (20-1 ...20-M) identified by the security agent (14) as being features (20-1 ...20-M) of an anomaly (22-1 ...22-M) in the communication network (10); and based on the feature reports (18), forming (310) a consensus amongst the security agents (14) on one or more of: which features (20-1 ...20-M) characterize which anomalies (22-1 ...22-M) in the communication network (10); accuracy metrics for respective security agents (14) reflecting how accurately or inaccurately the security agents (14) identify features (20-1 ...20-M) of anomalies (22-1...22-M) in the communication network (10); or reputation scores (26) for respective security agents (14), wherein the reputation score (26) for a security agent (14) quantifies a reputation of the security agent (14) for how accurately or inaccurately the security agent (14) identifies features (20-1 ...20-M) of anomalies (22-1 ...22-M) in the communication network (10).

11. The method of claim 10, wherein forming the consensus comprises computing the reputation score (26) for a security agent (14) by: based on the feature reports (18), determining one or more accuracy metrics reflecting the reputation that the security agent (14) has, amongst the security agents (14) distributed in the communication network (10), for how accurately or inaccurately the security agent (14) identifies features (20-1...20-M) of anomalies (22-1...22- M) in the communication network (10); and computing the reputation score (26) as a function of the one or more accuracy metrics.

12. The method of claim 11, wherein the one or more accuracy metrics include: an accurate identification rate indicating a rate at which the security agent (14) accurately identifies features (20-1 ...20-M) of anomalies (22-1 ...22-M) in the communication network (10), according to a consensus amongst the securityagents (14) about which features (20-1 ...20-M) characterize which anomalies (22-1...22-M); and an inaccurate identification rate indicating a rate at which the security agent (14) inaccurately identifies features (20-1 ...20-M) of anomalies (22-1...22-M) in the communication network (10), according to a consensus amongst the security agents (14) about which features (20-1 ...20-M) characterize which anomalies (22-1...22-M).

13. The method of claim 12, wherein computing the reputation score (26) comprises computing the reputation score (26) as exponentially increasing with the accurate identification rate and as linearly decreasing with the inaccurate identification rate.

14. The method of any one of claims 11-13, wherein forming the consensus comprises computing the reputation score (26) for a security agent (14) further by determining a network cost rate for the security agent (14) comprising a rate of resources required for the security agent (14) to identify features (20-1 ...20-M) of anomalies (22-1 ...22-M) with at least a threshold level of accuracy, and wherein computing the reputation score (26) comprises computing the reputation score (26) also as a function of the network cost rate.

15. The method of any one of claims 10-14, wherein the security agents (14) include: one or more security agents (14) deployed at one or more respective edge computing servers in the communication network (10); one or more security agents (14) deployed at one or more network data analytics functions, NWDAFs, in the communication network (10); and / or one or more security agents (14) deployed at one or more access and mobility functions, AMFs, in the communication network (10).

16. Controller equipment (500) configured to control anomaly detection in a communication network (10) within which security agents (14) are distributed, the controller equipment (500) configured to: obtain a reputation score (26) for a security agent (14) in the communication network (10), wherein the reputation score (26) quantifies a reputation that the security agent (14) has, amongst the security agents (14) distributed in the communication network (10), for how accurately or inaccurately the security agent (14) identifies features (20-1...20-M) of anomalies (22-1 ...22-M) in the communication network (10); andbased on the reputation score (26) for the security agent (14), control how influential the security agent (14) is in defining which features (20-1 ...20-M) characterize which anomalies (22-1...22-M) to be monitored for in the communication network (10).

17. The controller equipment (500) of claim 16, configured to perform the method of any one of claims 2-9.

18. A security agent device (14D) configured to host a security agent (14) in a communication network (10) within which multiple security agents (14) are distributed for anomaly detection, the security agent device (14D) configured to: exchange feature reports (18) with other security agents (14) in the communication network (10), wherein a feature report (18) from a security agent (14) reports features (20-1 ...20-M) identified by the security agent (14) as being features (20- 1 ...20-M) of an anomaly (22-1 ...22-M) in the communication network (10); and based on the feature reports (18), form a consensus amongst the security agents (14) on one or more of: which features (20-1 ...20-M) characterize which anomalies (22-1 ...22-M) in the communication network (10); reputations of respective security agents (14) for how accurately or inaccurately the security agents (14) identify features (20-1...20-M) of anomalies (22- 1 ...22-M) in the communication network (10); or reputation scores (26) for respective security agents (14), wherein the reputation score (26) for a security agent (14) quantifies a reputation of the security agent (14) for how accurately or inaccurately the security agent (14) identifies features (20-1 ...20-M) of anomalies (22-1 ...22-M) in the communication network (10).

19. The security agent device (14D) of claim 18, configured to perform the method of any one of claims 11-15.

20. A computer program (535) comprising instructions which, when executed by at least one processor of controller equipment (500), causes the controller equipment (500) to perform the method of any one of claims 1-9.

21. A computer program (435) comprising instructions which, when executed by at least one processor of a security agent device (14D), causes the security agent device (14D) to perform the method of any one of claims 10-15.

22. A carrier containing the computer program of any one of claims 20-21 , wherein the carrier is one of an electronic signal, optical signal, radio signal, or computer-readable storage medium (430, 530).

23. Controller equipment (500) configured to control anomaly detection in a communication network (10) within which security agents (14) are distributed, the controller equipment (500) comprising processing circuitry (510) configured to: obtain a reputation score (26) for a security agent (14) in the communication network (10), wherein the reputation score (26) quantifies a reputation that the security agent (14) has, amongst the security agents (14) distributed in the communication network (10), for how accurately or inaccurately the security agent (14) identifies features (20-1...20-M) of anomalies (22-1 ...22-M) in the communication network (10); and based on the reputation score (26) for the security agent (14), control how influential the security agent (14) is in defining which features (20-1 ...20-M) characterize which anomalies (22-1...22-M) to be monitored for in the communication network (10).

24. The controller equipment (500) of claim 23, wherein the processing circuitry (510) is configured to perform the method of any one of claims 2-9.

25. A security agent device (14D) configured to host a security agent (14) in a communication network (10) within which multiple security agents (14) are distributed for anomaly detection, the security agent device (14D) comprising processing circuitry (410) configured to: exchange feature reports (18) with other security agents (14) in the communication network (10), wherein a feature report (18) from a security agent (14) reports features (20-1 ...20-M) identified by the security agent (14) as being features (20- 1 ...20-M) of an anomaly (22-1 ...22-M) in the communication network (10); and based on the feature reports (18), form a consensus amongst the security agents (14) on one or more of: which features (20-1 ...20-M) characterize which anomalies (22-1 ...22-M) in the communication network (10); reputations of respective security agents (14) for how accurately or inaccurately the security agents (14) identify features (20-1...20-M) of anomalies (22- 1 ...22-M) in the communication network (10); orreputation scores (26) for respective security agents (14), wherein the reputation score (26) for a security agent (14) quantifies a reputation of the security agent (14) for how accurately or inaccurately the security agent (14) identifies features (20-1 ...20-M) of anomalies (22-1 ...22-M) in the communication network (10).

26. The security agent device (14D) of claim 25, wherein the processing circuitry (410) is configured to perform the method of any one of claims 11-15.

27. A non-transitory computer-readable storage medium (530) on which is stored a computer program (535) comprising instructions that, when executed by a processor of controller equipment (500) configured to control anomaly detection in a communication network (10) within which security agents (14) are distributed, causes the controller equipment (500) to: obtain a reputation score (26) for a security agent (14) in the communication network (10), wherein the reputation score (26) quantifies a reputation that the security agent (14) has, amongst the security agents (14) distributed in the communication network (10), for how accurately or inaccurately the security agent (14) identifies features (20-1...20-M) of anomalies (22-1 ...22-M) in the communication network (10); and based on the reputation score (26) for the security agent (14), control how influential the security agent (14) is in defining which features (20-1 ...20-M) characterize which anomalies (22-1...22-M) to be monitored for in the communication network (10).

28. A non-transitory computer-readable storage medium (430) on which is stored a computer program (435) comprising instructions that, when executed by a processor of a security agent device (14D) configured to host a security agent (14) in a communication network (10) within which multiple security agents (14) are distributed for anomaly detection, causes the security agent device (14D) to: exchange feature reports (18) with other security agents (14) in the communication network (10), wherein a feature report (18) from a security agent (14) reports features (20-1 ...20-M) identified by the security agent (14) as being features (20- 1 ...20-M) of an anomaly (22-1 ...22-M) in the communication network (10); and based on the feature reports (18), form a consensus amongst the security agents (14) on one or more of: which features (20-1 ...20-M) characterize which anomalies (22-1 ...22-M) in the communication network (10);reputations of respective security agents (14) for how accurately or inaccurately the security agents (14) identifies features (20-1 ...20-M) of anomalies (22-1 ...22-M) in the communication network (10); or reputation scores (26) for respective security agents (14), wherein the reputation score (26) for a security agent (14) quantifies a reputation of the security agent (14) for how accurately or inaccurately the security agent (14) identifies features (20-1 ...20-M) of anomalies (22-1 ...22-M) in the communication network (10).

Images