Patent ID: 11924238
Assignee: DARKTRACE HOLDINGS LIMITED
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 0:
1. A cyber threat defense system, comprising:
a central cyber defense appliance configured to unite data from 1) one or more independent systems with 2) one or more traditional enterprise zones, in one environment for analysis of cyber threats to detect the cyber threats, which is facilitated by one or more extensions of the cyber threat defense system implemented in the form of lightweight probes, where a first lightweight probe is configured to integrate within a first independent system to extend monitoring and gathering of data capability of the centralized cyber defense appliance, where the first lightweight probe is further configured to provide at least remote monitoring and gathering on 1) data, 2) meta data, and 3) a combination of both, from one or more protocols and data types utilized in any of i) a data link layer, ii) a physical layer, or iii) both; and then, one or more of a following layers when that layer is utilized in the first independent system, where the following layers include any of iv) an application layer, v) a transport layer, vi) a network layer, and vii) any combination of these three layers,
where the centralized cyber defense appliance has one or more Artificial Intelligence (AD) models configured to model a normal pattern of life for independent systems connecting to the central cyber defense appliance, where a first AI model is configured to model the normal pattern of life for the first independent system from the data and/or the meta data from the protocols and data types in at least any of 1) the data link layer and/or ii) physical layer from the first independent system, where the first AI model of the normal pattern of life for the first independent system is configured to use unsupervised machine learning algorithms and feedback on the data and/or the meta data from protocols and data types in, at least, the i) data link layer and/or ii) the physical layer to routinely update the first AI model of the normal pattern of life of the first independent system, during an operation of the first independent system,
an analyzer module configured to cooperate with the one or more AI models configured to model a normal pattern of life in each of the independent systems to determine when any of i) an abnormal behavior, ii) a suspicious activity, and iii) any combination of both is detected in that independent system, which uses the protocols in at least one of 1) the data link layer and 2) the physical layer, and
where any portions of the first lightweight probe implemented in software are configured to be stored in a first non-transitory storage medium in an executable format to be executed by a first set of one or more processors, and where any portions of the centralized cyber defense appliance implemented in software are configured to be stored in a second set of non-transitory storage mediums in an executable format to be executed by a second set of one or more processors.