US 12,177,240 B2
Machine learning based intrusion detection system for mission critical systems
Tamer Soliman, Toronto (CA)
Assigned to iS5 Communications Inc., Ontario (CA)
Filed by iS5 Communications, Inc., Mississauga (CA)
Filed on Feb. 28, 2023, as Appl. No. 18/115,208.
Application 18/115,208 is a continuation of application No. 16/570,386, filed on Sep. 13, 2019, granted, now 11,621,970.
Prior Publication US 2024/0080328 A1, Mar. 7, 2024
Int. Cl. H04L 9/40 (2022.01); G06N 3/044 (2023.01); G06N 3/045 (2023.01); G06N 3/08 (2023.01)
CPC H04L 63/1425 (2013.01) [G06N 3/044 (2023.01); G06N 3/045 (2023.01); G06N 3/08 (2013.01)] 37 Claims
OG exemplary drawing
 
1. A system for intrusion detection for network and control elements used in a mission critical environment connected to a network, the system comprising:
(a) a traffic aggregator module for mirroring and aggregating network traffic;
(b) a protocol category splitter module for receiving the mirrored and aggregated network traffic from the traffic aggregator and for splitting the mirrored and aggregated network traffic into a first and second protocol category;
(c) a first and second intrusion detection system (IDS) module for the first and second protocol categories, the first intrusion detection system module for analyzing the mirrored and aggregated network traffic from the first protocol category and for transmitting a first IDS associated data and the second intrusion detection system module for analyzing the mirrored and aggregated network traffic from the second protocol category and for transmitting a second IDS associated data;
(d) a first and second security information and event management (SIEM) module for each of the first and second protocol categories, the first SIEM module for processing the first IDS associated data to make a first protocol category alert available to a user and the second SIEM module for processing the second IDS associated data to make a second protocol category alert available to the user; and
(e) a first and second global threat intelligence platform (GTI) for the first and second IDS modules, comprising:
(i) the first GTI for receiving the first IDS associated data and further analyzing the first IDS associated data for transmitting a first GTI response data to the first IDS module, the first IDS module utilizing the first GTI response data in the analyzing of the mirrored and aggregated network traffic of the first protocol category by the first IDS module; and
(ii) the second GTI for receiving the second IDS associated data and further analyzing the second IDS associated data for transmitting a second GTI response data to the second IDS module, the second IDS module utilizing the second GTI response data in the analyzing of the mirrored and aggregated network traffic of the second protocol category by the second IDS module;
wherein the first and second IDS associated data each comprises alerts data and analytics data; and
wherein the first and second SIEM module receive the first and second alerts data of the first and second IDS associated data.