Patent ID: 11902311
Assignee: RIBBON COMMUNICATIONS OPERATING COMPANY, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 14:
15. A non-transitory computer readable medium including a first set of computer executable instructions which when executed by a processor of a node cause the node to:
process a first set of traffic data including information about system traffic corresponding to a first time period, one or more pieces of data in said first set of traffic data being provided by sensors or sensor enforcer nodes monitoring traffic;
detect, based on the first set of traffic data, a first set of traffic instances which are found to be a first threat of a first type;
notify an operator of the first threat of the first type;
monitor to detect a response from the operator indicating an action to be taken in a system in response to the first; threat of the first type;
in response to detecting an operator indicated action to be taken in response to the first, threat of the first type, implementing said action;
in response to failing to detect an operator indicated action to be taken in response to the first threat of the first type within a first predetermined time, continuing system operation without taking an action in response to the first; threat of the first type;
store in a storage device information about the first threat of the first type and any action taken in response to the first threat of the first type;
process at the node a second set of traffic data including information about system traffic corresponding to a second time period, said second time period following said first time period;
detect, based on the second set of traffic data, a second set of traffic instances which are found to be a second threat of the first type;
notify the operator of the second threat of the first type, said notifying the operator of the second threat of the first type including sending a notification including alarm information to a plurality of computing devices of the operator;
monitor to detect a response from the operator indicating an action to be taken in response to the second threat of the first type; and
in response to failing to detect an operator indicated action to be taken in response to the second threat of the first type in a predetermined time,
check to determine if the second threat of the first type corresponds to an increased rate of threats of the first type or an increased level of threat; and
if the detected threat corresponds to an increased rate of threats or an increased level of threat take an automated action in response to the second threat of the first type in the absence of operator input.