System for anonymously detecting and blocking threats within a telecommunications network

1. A score requestor of a system for anonymously detecting and blocking threats within a telecommunications network, the system including the score requestor, a scoring engine, and a plurality of network analyzers, each of the plurality of network analyzers monitoring network traffic from a different telecommunications network, the score requestor comprising:

a processor and a memory storing executable instructions that, in response to execution by the processor, cause the score requestor to at least:

receive, from each one of the network analyzers:

an initial request for an associated threat score for a value of a data attribute of the network traffic that passed over the respective telecommunications network, wherein the network analyzer is configured to collect metadata including the value of the data attribute, and interpret the metadata and therefrom generate the request including at least the value of the data attribute; and

for each of the requests:

serve a secondary request to the scoring engine based on the initial request representing a transformation of the value to remove any portion from which the requesting network analyzer is identifiable;

receive a response from the scoring engine which includes a calculated associated threat score, generated from aggregate metadata associated with prior values of data attributes that were received from at least one other network analyzer and based thereon determines whether the value of the data attribute is associated with a known or predicted threat, for distribution to the respective network analyzers,

wherein each one of the network analyzers is configured to initiate a block or redirection of the traffic based on a relationship between the respective associated threat score and a predetermined risk threshold for the telecommunications network.

2. The score requestor of claim 1 , wherein the data attributes include sources and destinations of the traffic, network port and network protocol identifiers associated with the traffic, dates and timestamps of the traffic, data volume, and frequency and pattern identifiers of the traffic.

3. The score requestor of claim 1 , wherein each of the network analyzers are configured to encrypt and then transmit the request in such a format that the network analyzer is not identifiable to a third party, and the score requestor is configured to decrypt and then serve the request.

4. The score requestor of claim 1 , wherein the score requestor receives the request from, and serves the request to, the network analyzer respectively includes being configured to assign a token to the request upon receipt, and return the associated threat score to the network analyzer based at least in part on the token.

5. A computer-readable storage medium for implementing a score requestor of a system for anonymously detecting and blocking threats within a telecommunications network, the system including a scoring engine, and a plurality of network analyzers, each of the plurality of network analyzers monitoring network traffic from a different telecommunications network, the computer-readable storage medium having computer-readable program code stored therein that, in response to execution by a processor, cause the score requestor to at least:

receive, from each one of the network analyzers:

an initial request for an associated threat score for a value of a data attribute of the network traffic that passed over the respective telecommunications network, wherein the network analyzer is configured to collect metadata including the value of the data attribute, and interpret the metadata and therefrom generate the request including at least the value of the data attribute; and

for each of the requests:

serve a secondary request to the scoring engine based on the initial request representing a transformation of the value to remove any portion from which the requesting network analyzer is identifiable;

receive a response from the scoring engine which includes a calculated associated threat score, generated from aggregate metadata associated with prior values of data attributes that were received from at least one other network analyzer and based thereon determines whether the value of the data attribute is associated with a known or predicted threat, for distribution to the respective network analyzers,

wherein each one of the network analyzers is configured to initiate a block or redirection of the traffic based on a relationships between the respective associated threat score and a predetermined risk threshold for the telecommunications network.

6. The computer readable storage medium of claim 5 , wherein the data attributes include sources and destinations of the traffic, network port and network protocol identifiers associated with the traffic, dates and timestamps of the traffic, and frequency and pattern identifiers of the traffic.

7. The computer readable storage medium of claim 5 , wherein each of the network analyzers are configured to encrypt and then transmit the request in such a format that the network analyzer is not identifiable to a third party, and the score requestor is configured to decrypt and then serve the request.

8. The computer readable storage medium of claim 5 , wherein the score requestor receives the request from, and serves the request to, the network analyzer respectively includes being configured to assign a token to the request upon receipt, and return the associated threat score to the network analyzer based at least in part on the token.

9. A system for anonymously detecting and blocking threats within a telecommunications network, the system comprising:

a score requestor, a scoring engine, and a plurality of network analyzers, each of the plurality of network analyzers monitoring network traffic from a different telecommunications network;

the score requestor comprising a processor and a memory storing executable instructions that, in response to execution by the processor, cause the score requestor to at least:

receive, from each one of the network analyzers:

a request for an associated threat score for a value of a data attribute of the network traffic that passed over the respective telecommunications network, wherein the network analyzer is configured to collect metadata including the value of the data attribute, and interpret the metadata and therefrom generate the request including at least the value of the data attribute; and

for each of the requests:

serve the request from the scoring engine based on a secondary request without the value and instead including a transformation of the value to remove any portion from which the requesting network analyzer is identifiable; and

the scoring engine comprising a processor and a memory storing executable instructions that, in response to execution by the processor, cause the scoring engine to at least:

calculate, for each of the secondary requests, the associated threat score by aggregating metadata associated with prior values of data attributes that were received from another network analyzer, and based thereon determine whether the value of the data attribute is associated with a known or predicted threat; and

wherein each one of the network analyzer is configured to initiate a block or redirection of the traffic based on the respective associated threat score.

10. The system of claim 9 , wherein the network analyzer comprises:

a processor and a memory storing executable instructions that, in response to execution by the processor, cause the network analyzer to at least:

collect metadata including values of data attributes associated with the traffic based on the traffic so intercepted or log files so received;

interpret the metadata and therefrom generate the request for an associated threat score for the value of a data attribute of the data attributes, the request including at least the value of the data attribute;

transmit the request to the score requestor; and

receive the associated threat score from the score requestor and based thereon initiate a block or redirection of the traffic based on a relationship between the respective associated threat score and a predetermined risk threshold for the telecommunications network.

11. The network analyzer of claim 10 , wherein the data attributes include sources and destinations of the traffic, network port and network protocol identifiers associated with the traffic, dates and timestamps of the traffic, data volume, and frequency and pattern identifiers of the traffic.

12. The network analyzer of claim 10 , wherein the memory stores further executable instructions that, in response to execution by the processor, cause the network analyzer to further at least:

determine if the associated threat score for the value of the data attribute is locally stored at the network analyzer, the network analyzer being caused to generate and transmit the request, and receive the associated threat score from the score requestor, in an instance in which the associated threat score is not locally stored at the network analyzer; and

in another instance in which the associated threat score is locally stored at the network analyzer, retrieve the associated threat score from local storage of the network analyzer and based thereon automatically initiate the block or redirection of the traffic.

13. The network analyzer of claim 10 , wherein the network analyzer being caused to initiate the block or redirection of the traffic includes being caused to at least:

notify an end-user of a threat associated with the traffic, and initiate the block of the traffic, in an instance in which the associated threat is above the predetermined threshold; or

otherwise, initiate the redirection of the traffic to an identified source or destination in an instance in which the associated threat is below a predetermined threshold.