Ai/ml approach for DDOS prevention on 5G CBRS networks

Patent metadata

Field	Value
Publication number	US-12041077-B2
Application number	US-202117160164-A
Country	US
Kind code	B2
Filing date	Jan 27, 2021
Priority date	Jan 27, 2021
Publication date	Jul 16, 2024
Grant date	Jul 16, 2024

Abstract

One example method includes collecting, in a closed network, raw network traffic from one or more devices in the closed network, extracting metadata from the raw network traffic, processing the metadata, analyzing the metadata after the metadata has been processed, and based on the analyzing, determining whether or not an actual attack or attack threat is present in the closed network. If an attack or threat of attack is determined to exist, one or more remedial actions may then be taken.

First claim

What is claimed is:

1. A method, comprising:
collecting, in a closed network, raw network traffic from one or more devices in the closed network;
extracting metadata from the raw network traffic;
creating aggregated data by aggregating the raw network traffic with the metadata;
processing the aggregated data into time series data;
inputting the time series data to an AI/ML model;
analyzing the time series data using the AI/ML model after the aggregated data has been processed; and
based on the analyzing, determining whether or not an actual attack or attack threat is present in the closed network.

2. The method as recited in claim 1 , wherein the method is performed by a VNF pod on an edge node of the closed network.

3. The method as recited in claim 1 , wherein the closed network is a 5G CBRS network.

4. The method as recited in claim 1 , wherein the extracted metadata comprises TCP headers.

5. The method as recited in claim 1 , wherein the determining indicates that an attack or attack threat is present in the closed network, and the method further comprises transmitting instructions to the one or more devices in the closed network not to accept calls from the one or more devices within the closed network which initiated the attack or present the attack threat.

6. The method as recited in claim 1 , wherein the one or more devices in the closed network were authorized to join the closed network, and one of the devices comprises an IoT device.

7. The method as recited in claim 1 , wherein the actual attack or attack threat comprises, respectively, a DOS attack or DOS attack threat.

8. The method as recited in claim 1 , further comprising identifying the one or more devices in the closed network which initiated the attack or present the attack threat.

9. The method as recited in claim 1 , wherein the raw network traffic is collected by way of a data plane through which all the raw network traffic passes.

10. A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
collecting, in a closed network, raw network traffic from one or more devices in the closed network;
extracting metadata from the raw network traffic;
creating aggregated data by aggregating the raw network traffic with the metadata;
processing the aggregated data into time series data;
inputting the time series data to an AI/ML model;
analyzing the time series data using the AI/ML model after the aggregated data has been processed; and
based on the analyzing, determining whether or not an actual attack or attack threat is present in the closed network.

11. The non-transitory storage medium as recited in claim 10 , wherein the operations are performed by a VNF pod on an edge node of the closed network.

12. The non-transitory storage medium as recited in claim 10 , wherein the closed network is a 5G CBRS network.

13. The non-transitory storage medium as recited in claim 10 , wherein the extracted metadata comprises TCP headers.

14. The non-transitory storage medium as recited in claim 10 , wherein the determining indicates that an attack or attack threat is present in the closed network, and the method further comprises transmitting instructions to the one or more devices in the closed network not to accept calls from the one or more devices within the closed network which initiated the attack or present the attack threat.

15. The non-transitory storage medium as recited in claim 10 , wherein the one or more devices in the closed network were authorized to join the closed network, and one of the devices comprises an IoT device.

16. The non-transitory storage medium as recited in claim 10 , wherein the actual attack or attack threat comprises, respectively, a DOS attack or DOS attack threat.

17. The non-transitory storage medium as recited in claim 10 , wherein the operations further comprise identifying the one or more devices in the closed network which initiated the attack or present the attack threat.

18. The non-transitory storage medium as recited in claim 10 , wherein the raw network traffic is collected by way of a data plane through which all the raw network traffic passes.

Assignees

• Emc Ip Holding Co Llc

Inventors

• Arnon Ohad
• Shapiro Dany
• Gaber Shiri

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L69/22

  Parsing or analysis of headers · CPC title

• H04L41/16

  using machine learning or artificial intelligence · CPC title

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title

• H04L41/142

  using statistical or mathematical methods · CPC title