Virtual Security Agent Monitoring for Low-Latency Anomaly Tracing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems cause excessive delay and inefficiency in identifying the source of network anomalies, particularly in ultra-reliable low-latency communication (ULLC), by monitoring all wireless devices until the source is found.
Innovation Solution
Implementing a dynamic virtual security agent (VSA) system that proactively places VSAs at optimal physical and logical locations within the network, using AI/ML models to steer traffic and adjust monitoring granularity based on suspected devices, with a multi-tier strategy to narrow down the set of suspected devices and dynamically adjust the defense boundary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network security appliances monitor all wireless devices in the system to identify the source of anomalies, then the source can be detected, but the response time becomes too slow for ultra-reliable low-latency communication (ULLC)
Solution Approach 1:
The patent segments the network into multiple monitoring zones with distributed VSAs instead of using a single centralized monitoring point. Each VSA monitors a specific segment of the network, allowing parallel processing of multiple wireless devices simultaneously. This segmentation enables the system to maintain high detection accuracy across the entire network while reducing the time required to identify anomaly sources in any given segment.
Solution Approach 2:
The patent implements preliminary actions by proactively placing VSAs at optimal locations in the network before anomalies occur. The system pre-configures monitoring points and establishes baseline behavior patterns for wireless devices. When anomalies do occur, the pre-positioned VSAs can immediately begin investigation without the delay of deploying monitoring resources, thus maintaining both detection accuracy and fast response time for ULLC applications.
2Measurement precision
If the same network security appliance is applied to all wireless devices in the network, then comprehensive monitoring is achieved, but resource consumption becomes inefficient
Solution Approach 1:
The patent applies local quality by deploying VSAs with specialized monitoring capabilities at specific network locations rather than uniformly applying the same security appliance to all devices. Each VSA is strategically positioned and configured to monitor particular types of traffic or devices based on local network conditions and risk profiles. This approach ensures comprehensive monitoring coverage while optimizing resource consumption by avoiding redundant monitoring efforts across the entire network.
Solution Approach 2:
The patent implements partial action by having VSAs focus their monitoring efforts on specific subsets of wireless devices that are suspected or likely to be involved in anomalies, rather than continuously monitoring all devices with equal intensity. The system dynamically adjusts the scope and depth of monitoring based on detected patterns and threat levels, applying intensive monitoring only where necessary while maintaining lighter monitoring elsewhere, thus achieving comprehensive coverage with optimized resource usage.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
According to some embodiments, an orchestrator node (15) is configured to receive an indication of a first plurality of wireless devices (22) where each wireless device (22) of the first plurality of wireless devices (22) meets a first criteria associated with a first level of monitoring of bi-directional network communications; in response to the indication of the first plurality of wireless devices (22), configure a second VSA (32) to monitor communications associated with each of the first plurality of wireless devices (22); receive, from the second VSA (32), an indication of a first subset of the first plurality of wireless devices (22) where each wireless device (22) of the first subset of the first plurality of wireless devices (22) meets a second criteria associated with a second level of monitoring of bi-directional network communications; and modify a granularity of wireless device monitoring.