Patent ID: 11924238
Assignee: DARKTRACE HOLDINGS LIMITED
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 16:
17. A cyber threat defense system, comprising:
a centralized cyber defense appliance configured to securely communicate and cooperate with a suite of two or more different lightweight probes that have 1) one or more protocol analyzers, 2) an address and mapping to a first interface with a third party protocol analyzer, 3) an address and mapping to a second interface for the centralized cyber defense appliance, that can ingest onboard traffic from a plurality of different independent systems using protocols for at least one of 1) a data link layer, and 2) a physical layer, as well as, protocols in one or more of 3) an application layer, 4) a transport layer, 5) a network layer, when a protocol is used in that layer in the independent system, where the centralized cyber defense appliance has one or more AI models configured to model a normal pattern of life in each of the independent systems using data and meta data from protocols in at least one of 1) a data link layer, and 2) a physical layer, as well as, protocols in one or more of 3) an application layer, 4) a transport layer, 5) a network layer, when a protocol is used in that layer in the independent system; and
an analyzer module configured to cooperate with the one or more AI models configured to model a normal pattern of life in each of the independent systems to determine when any of i) an abnormal behavior, ii) a suspicious activity, and iii) any combination of both is detected in that independent system, which uses the protocols in at least one of 1) the data link layer and 2) the physical layer; and
where any portions of the first lightweight probe implemented in software are configured to be stored in a first non-transitory storage medium in an executable format to be executed by a first set of one or more processors, and where any portions of the centralized cyber defense appliance implemented in software are configured to be stored in a second set of non-transitory storage mediums in an executable format to be executed by a second set of one or more processors.