Patent ID: 11902311
Assignee: RIBBON COMMUNICATIONS OPERATING COMPANY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 13:
14. A communications system comprising:
a storage device; and
a first node, said first node including:
one or more processors configured to control the operation of the first node to perform one or more threat detection and mitigation operations including:
processing a first set of traffic data including information about system traffic corresponding to a first time period, one or more pieces of data in said first set of traffic data being provided by sensors or sensor enforcer nodes monitoring traffic;
detecting, based on the first set of traffic data, a first set of traffic instances which are found to be a first threat of a first type;
notifying an operator of the first threat of the first type;
monitoring to detect a response from the operator indicating an

action to be taken in the system in response to the first threat of the first type;
in response to detecting an operator indicated action to be taken in response to the first threat of the first type, implementing said action;
in response to failing to detect an operator indicated action to be taken in response to the first threat of the first type within a first predetermined time, continuing system operation without taking an action in response to the first threat of the first type;
storing information about the first threat of the first type and any action taken in response to the first threat of the first type in the storage device;
processing, at the first node, a second set of traffic data including information about system traffic corresponding to a second time period, said second time period following said first time period;
detecting, based on the second set of traffic data, a second set of traffic instances which are found to be a second threat of the first type;
notifying the operator of the second threat of the first type, said notifying the operator of the second threat of the first type including sending a notification including alarm information to a plurality of computing devices of the operator;
monitoring to detect a response from the operator indicating an action to be taken in response to the second threat of the first type; and
in response to failing to detect an operator indicated action to be taken in response to the second threat of the first type in a predetermined time,
checking to determine if the second threat of the first type corresponds to an increased rate of threats of the first type or an increased level of threat; and
if the detected threat corresponds to an increased rate of threats or an increased level of threat taking an automated action in response to the second threat of the first type in the absence of operator input.