Patent ID: 11895124
Assignee: F-SECURE CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 13:
14. A method of data-efficient threat detection, the method comprising at a security server backend of a computer network:
receiving one or more local behaviour models related to multiple network nodes, wherein each behaviour model characterizes normal behaviour related to the respective network node;
generating at least one common model of normal behaviour on the basis of the generated local behaviour models related to the multiple network nodes for enabling filtering one or more of input events by using a measure for estimating the likelihood that the input event is produced by the generated common model of normal behaviour or by the received one or more local behaviour models, wherein only input events having a likelihood below a predetermined threshold of being produced by the common model of normal behaviour are passed through the filtering;
sharing the generated at least one common model of normal behaviour with one or more peer network nodes of the computer network for enabling the filtering of the input events at the network nodes; and
processing input events passed through the filtering for generating a security related decision.