Patent ID: 11895124
Assignee: F-SECURE CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 16:
17. An apparatus in a computer network system comprising:
at least one computing device comprising a memory and one or more processors, the one or more processors configured to:
receive raw data related to a network node, wherein dissimilar data types are aligned as input events;
generate one or more local behaviour models related to the network node on the basis of the received input events, wherein the local behaviour model characterizes normal behaviour related to the network node;
generate at least one common model of normal behaviour on the basis of local behaviour models related to multiple network nodes;
share the generated one or more local behaviour models related to the network node with one or more peer network nodes of the computer;
filter one or more of the input events by using a measure for estimating the likelihood that the input event is produced by the generated common model of normal behaviour and/or by the generated one or more local behaviour models, wherein only input events having a likelihood below a predetermined threshold of being produced by any one of the models are passed through the filtering; and
process input events passed through the filtering for generating a security related decision.