Proactive identification of potential security threats on residential gateway devices
A system and a method are provided for an external server for use with a first network device and an external network. The external server contains: a memory having a priori data stored therein, the a priori data includes a plurality of potential security attack signatures; and a processor configured to execute instructions stored on the memory to cause the external server to: monitor the first network device for actions on the first network device; identify an action on the first network device that matches one of the plurality of potential security attack signatures of the a priori data; and notify the first network device that the action is a potential security attack.
1. An external server for use with a first network device and an external network, said external server comprising:
a memory having a priori data stored therein, the a priori data includes a plurality of security attack signatures, each of which includes a respective plurality of data values; and
a processor configured to execute instructions stored on said memory to cause said external server to:
train a supervised machine learning algorithm of a machine learning program stored in the memory based on the a priori data that includes one or more at risk parameters that are indicators of attempted security attacks and one or more benign parameters that are indicators of benign communications;
receive, from the first network device, first data that is an indicator of a benign communication, the indicator not having been previously identified or associated with security attacks;
generate one or more signatures based on the first data indicative of the benign communication;
store the one or more signatures as part of the a priori data stored on the memory;
receive from the first network device unlabeled data that has not been previously identified as one of the plurality of security attack signatures;
process by an unsupervised machine learning process, performed by the processor, the unlabeled data for pattern identification;
monitor the first network device for actions on the first network device by collecting a number of data parameters of the unlabeled data from the first network device;
identify an action of the actions on the first network device when a number m of the number of data parameters matches at least the number m of the plurality of data values of one of the plurality of security attack signatures of the a priori data; and
notify the first network device that the action is a security attack, wherein m is greater than or equal to a predetermined threshold number n;
send a remediation instruction to the first network device based on a type of the security attack to cause the first network device to perform one or more prevention or mitigation actions;
label the unlabeled data based on the pattern identification and additional data received from the unsupervised machine learning process for storage as part of the a priori data stored on the memory so as to train the supervised machine learning algorithm, wherein the additional data is one or more new data patterns that are also one or more signatures of one or more security attacks discovered by performing the unsupervised machine learning process; and
send the labeled data to the supervised machine learning process for additional learning.
2. The external server of claim 1 , wherein said processor is configured to execute instructions stored on said memory to additionally cause said external server to update the a priori data based on the action on the first network device that matches the one of the plurality of security attack signatures of the a priori data.
3. The external server of claim 1 , wherein one of the plurality of security attack signatures is based on an action on a second network device and is associated with a degradation of service provided by the second network device.
4. A method of using an external server with a first network device and an external network, said method comprising:
storing, into a memory, a priori data including a plurality of security attack signatures, each of which includes a respective plurality of data values;
training a supervised machine learning algorithm of a machine learning program stored in the memory based on the a priori data that includes one or more at risk parameters that are indicators of attempted security attacks and one or more benign parameters that are indicators of benign communications;
receiving, from the first network device, first data that is an indicator of a benign communication, the indicator not having been previously identified or associated with security attacks;
generating one or more signatures based on the first data indicative of the benign communication;
storing the one or more signatures as part of the a priori data stored on the memory;
receiving from the first network device unlabeled data that has not been previously identified as one of the plurality of security attack signatures;
processing by an unsupervised machine learning process, performed by the processor, the unlabeled data for pattern identification;
monitoring, via a processor configured to execute instructions stored on the memory, the first network device for actions on the first network device by collecting a number of data parameters of the unlabeled data from the first network device;
identifying, via the processor, an action of the actions on the first network device when a number m of the number of data parameters matches at least the number m of the plurality of data values of one of the plurality of security attack signatures of the a priori data; and
notifying, via the processor, the first network device that the action is a security attack, wherein m is greater than or equal to a predetermined threshold number n; and
sending a remediation instruction to the first network device based on a type of the security attack to cause the first network device to perform one or more prevention or mitigation actions;
labeling the unlabeled data based on the pattern identification and additional data received from the unsupervised machine learning process for storage as part of the a priori data stored on the memory so as to train the supervised machine learning algorithm, wherein the additional data is one or more new data patterns that are also one or more signatures of one or more security attacks discovered by performing the unsupervised machine learning process; and
sending the labeled data to the supervised machine learning process for additional learning.
5. The method of claim 4 , further comprising updating, via the processor, the a priori data based on the action on the first network device that matches the one of the plurality of security attack signatures of the a priori data.
6. The method of claim 4 , wherein one of the plurality of security attack signatures is based on an action on a second network device and is associated with a degradation of service provided by the second network device.
7. A non-transitory, computer-readable media having computer-readable instructions stored thereon, the computer-readable instructions being capable of being read by an external server with a first network device and an external network, wherein the computer-readable instructions are capable of instructing the external server to perform the method comprising:
storing, into a memory, a priori data including a plurality of security attack signatures, each of which includes a respective plurality of data values;
training a supervised machine learning algorithm of a machine learning program stored in the memory based on the a priori data that includes one or more at risk parameters that are indicators of attempted security attacks and one or more benign parameters that are indicators of benign communications;
receiving, from the first network device, first data that is an indicator of a benign communication, the indicator not having been previously identified or associated with security attacks;
generating one or more signatures based on the first data indicative of the benign communication;
storing the one or more signatures as part of the a priori data stored on the memory;
receiving from the first network device unlabeled data that has not been previously identified as one of the plurality of security attack signatures;
processing by an unsupervised machine learning process, performed by the processor, the unlabeled data for pattern identification;
monitoring, via a processor configured to execute instructions stored on the memory, the first network device for actions on the first network device by collecting a number of data parameters of the unlabeled data from the first network device;
identifying, via the processor, an action of the actions on the first network device when a number m of the number of data parameters matches at least the number m of the plurality of data values of one of the plurality of security attack signatures of the a priori data;
notifying, via the processor, the first network device that the action is a security attack, wherein m is greater than or equal to a predetermined threshold number n;
sending a remediation instruction to the first network device based on a type of the security attack to cause the first network device to perform one or more prevention or mitigation actions;
labeling the unlabeled data based on the pattern identification and additional data received from the unsupervised machine learning process for storage as part of the a priori data stored on the memory so as to train the supervised machine learning algorithm, wherein the additional data is one or more new data patterns that are also one or more signatures of one or more security attacks discovered by performing the unsupervised machine learning process; and
sending the labeled data to the supervised machine learning process for additional learning.
8. The non-transitory, computer-readable media of claim 7 , wherein the computer-readable instructions are capable of instructing the external server to perform the method further comprising updating, via the processor, the a priori data based on the action on the first network device that matches the one of the plurality of security attack signatures of the a priori data.
9. The non-transitory, computer-readable media of claim 7 , wherein the computer-readable instructions are capable of instructing the external server to perform the method wherein one of the plurality of security attack signatures is based on an action on a second network device and is associated with a degradation of service provided by the second network device.