Patent ID: 11895124
Assignee: F-SECURE CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 0:
1. A method of data-efficient threat detection in a computer network, the method comprising:
receiving raw data related to a network node, wherein dissimilar data types are aligned as input events;
generating one or more local behaviour models related to the network node on the basis of the received input events, wherein the local behaviour model characterizes normal behaviour related to the network node;
sharing the generated one or more local behaviour models related to the network node with one or more peer network nodes of the computer network;
generating at least one common model of normal behaviour on the basis of local behaviour models related to multiple network nodes;
filtering one or more of the input events by using a measure for estimating the likelihood that the input event is produced by the generated common model of normal behaviour and/or by the generated one or more local behaviour models, wherein only input events having a likelihood below a predetermined threshold of being produced by any one of the models are passed through the filtering; and
processing input events passed through the filtering for generating a security related decision.