Patent ID: 11886587
Assignee: KYNDRYL, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G

Claim 0:
1. A method comprising:
examining, by one or more processors, a process for indicators of compromise to the process;
determining, by the one or more processors, a categorization of the process based upon a result of the examination;
in response to determining that the categorization of the process does not correspond to a known benevolent process and a known malicious process, executing, by the one or more processors, the process in a secure enclave on a local host system;
collecting, by the one or more processors, telemetry data from executing the process in the secure enclave;
passing, by the one or more processors, the collected telemetry data from the secure enclave to a locally trained neural network system and a federated trained neural network system, wherein training data of the locally trained neural network system comprises other telemetry data from processes being executed on the local host system underlying the locally trained neural network system;
determining, by the one or more processors, a result of a first loss function for the locally trained neural network system;
comparing, by the one or more processors, the result of the first loss function for the locally trained neural network system with a result of a loss function at an end of a training of said locally trained neural network system;
aggregating, by the one or more processors, the result of the first loss function and a result of a second loss function for the federated trained neural network system that is trained differently than the locally trained neural network system; and
determining, by the one or more processors, whether the process is anomalous based on the aggregated results.