US 12,219,360 B1
Cellular IoT security using dynamic policy-driven mechanisms for threat mitigation
Milind Gunjan, Olathe, KS (US); Kallol Banerjee, San Jose, CA (US); and Jonathan Bosanac, Ennis, MT (US)
Assigned to Netskope, Inc., Santa Clara, CA (US)
Filed by Netskope, Inc., Santa Clara, CA (US)
Filed on Jul. 24, 2024, as Appl. No. 18/783,154.
Int. Cl. H04W 12/122 (2021.01); H04W 12/088 (2021.01)
CPC H04W 12/122 (2021.01) [H04W 12/088 (2021.01)] 18 Claims
OG exemplary drawing
 
1. A cellular security system driven by a plurality of policies to protect a cellular network of a plurality of cellular networks against a plurality of threats in a cloud-based environment, the cellular security system comprises one or more hardware processors with code for:
a tenant of a plurality of tenants using the plurality of cellular networks, the tenant includes a plurality of cellular devices;
a plurality of tunnels between a cellular device of the plurality of cellular devices and the cellular network, the plurality of tunnels is operable to:
receive traffic from the cellular device at the cellular network;
route the traffic to a gateway using a plurality of network identifiers;
monitor the traffic from the cellular device at the gateway; and
capture real-time traffic attributes and extract a plurality of relevant features;
an anomaly detection model to detect the plurality of threats in the cloud-based environment, wherein the anomaly detection model is operable to:
retrieve a plurality of baseline profiles from a threat database,
load the plurality of policies related to a threat of the plurality of threats,
compare real-time traffic features with the plurality of baseline profiles,
apply an anomaly detection algorithm to a traffic instance,
assign an anomaly score to the traffic instance and
raise a flag for detection of an anomaly;
an alert generator to send an alert to the tenant in the cloud-based environment; and
an anomaly reporter to notify a management plane for a remediation of the anomaly, wherein the anomaly is remediated at the management plane and the management plane is operable to:
analyze the anomaly,
correlate the anomaly with the threat database and get confirmation of the threat,
initiate a quarantined traffic upon confirmation of the threat,
send a request to update a network identifier for the quarantined traffic,
assess severity of the threat, and
update the threat database with new anomaly patterns and results.