Virtual Security Agent Monitoring for Low-Latency Anomaly Tracing

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing network security systems cause excessive delay and inefficiency in identifying the source of network anomalies, particularly in ultra-reliable low-latency communication (ULLC), by monitoring all wireless devices until the source is found.

Innovation Solution

Implementing a dynamic virtual security agent (VSA) system that proactively places VSAs at optimal physical and logical locations within the network, using AI/ML models to steer traffic and adjust monitoring granularity based on suspected devices, with a multi-tier strategy to narrow down the set of suspected devices and dynamically adjust the defense boundary.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If network security appliances monitor all wireless devices in the system to identify the source of anomalies, then the source can be detected, but the response time becomes too slow for ultra-reliable low-latency communication (ULLC)

Engineering Contradiction:
Improveanomaly source detection accuracyVSAvoidresponse time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The patent segments the network into multiple monitoring zones with distributed VSAs instead of using a single centralized monitoring point. Each VSA monitors a specific segment of the network, allowing parallel processing of multiple wireless devices simultaneously. This segmentation enables the system to maintain high detection accuracy across the entire network while reducing the time required to identify anomaly sources in any given segment.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent implements preliminary actions by proactively placing VSAs at optimal locations in the network before anomalies occur. The system pre-configures monitoring points and establishes baseline behavior patterns for wireless devices. When anomalies do occur, the pre-positioned VSAs can immediately begin investigation without the delay of deploying monitoring resources, thus maintaining both detection accuracy and fast response time for ULLC applications.

Inventive Principle:
Principle #10Preliminary action

2Measurement precision

If the same network security appliance is applied to all wireless devices in the network, then comprehensive monitoring is achieved, but resource consumption becomes inefficient

Engineering Contradiction:
Improvemonitoring coverageVSAvoidresource consumption
Core Design Contradiction:
Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The patent applies local quality by deploying VSAs with specialized monitoring capabilities at specific network locations rather than uniformly applying the same security appliance to all devices. Each VSA is strategically positioned and configured to monitor particular types of traffic or devices based on local network conditions and risk profiles. This approach ensures comprehensive monitoring coverage while optimizing resource consumption by avoiding redundant monitoring efforts across the entire network.

Inventive Principle:
Principle #3Local quality

Solution Approach 2:

The patent implements partial action by having VSAs focus their monitoring efforts on specific subsets of wireless devices that are suspected or likely to be involved in anomalies, rather than continuously monitoring all devices with equal intensity. The system dynamically adjusts the scope and depth of monitoring based on detected patterns and threat levels, applying intensive monitoring only where necessary while maintaining lighter monitoring elsewhere, thus achieving comprehensive coverage with optimized resource usage.

Inventive Principle:
Principle #16Partial or excessive action

Data Source

PatentEP4476875B1Proactive malicious actor monitoring in a network using a virtual security agent (VSA)
Publication Date: 2026.04.08 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)
  • EP4476875B1 patent drawingFigure 1
  • EP4476875B1 patent drawingFigure 2
  • EP4476875B1 patent drawingFigure 3

AI summary

According to some embodiments, an orchestrator node (15) is configured to receive an indication of a first plurality of wireless devices (22) where each wireless device (22) of the first plurality of wireless devices (22) meets a first criteria associated with a first level of monitoring of bi-directional network communications; in response to the indication of the first plurality of wireless devices (22), configure a second VSA (32) to monitor communications associated with each of the first plurality of wireless devices (22); receive, from the second VSA (32), an indication of a first subset of the first plurality of wireless devices (22) where each wireless device (22) of the first subset of the first plurality of wireless devices (22) meets a second criteria associated with a second level of monitoring of bi-directional network communications; and modify a granularity of wireless device monitoring.