CPC H04W 12/122 (2021.01) [H04W 12/088 (2021.01)] | 18 Claims |
1. A cellular security system driven by a plurality of policies to protect a cellular network of a plurality of cellular networks against a plurality of threats in a cloud-based environment, the cellular security system comprises one or more hardware processors with code for:
a tenant of a plurality of tenants using the plurality of cellular networks, the tenant includes a plurality of cellular devices;
a plurality of tunnels between a cellular device of the plurality of cellular devices and the cellular network, the plurality of tunnels is operable to:
receive traffic from the cellular device at the cellular network;
route the traffic to a gateway using a plurality of network identifiers;
monitor the traffic from the cellular device at the gateway; and
capture real-time traffic attributes and extract a plurality of relevant features;
an anomaly detection model to detect the plurality of threats in the cloud-based environment, wherein the anomaly detection model is operable to:
retrieve a plurality of baseline profiles from a threat database,
load the plurality of policies related to a threat of the plurality of threats,
compare real-time traffic features with the plurality of baseline profiles,
apply an anomaly detection algorithm to a traffic instance,
assign an anomaly score to the traffic instance and
raise a flag for detection of an anomaly;
an alert generator to send an alert to the tenant in the cloud-based environment; and
an anomaly reporter to notify a management plane for a remediation of the anomaly, wherein the anomaly is remediated at the management plane and the management plane is operable to:
analyze the anomaly,
correlate the anomaly with the threat database and get confirmation of the threat,
initiate a quarantined traffic upon confirmation of the threat,
send a request to update a network identifier for the quarantined traffic,
assess severity of the threat, and
update the threat database with new anomaly patterns and results.
|