British Telecommunications Public Limited Company

British Telecommunications Corporation

Fadi El-Moussa

George Kallos

Ian Herwono

Theo Dimitrakos

Claudia Cristina

Simon A Beddus

Ben Azvine

Ali Sajjad

Joshua Daniel

Mark A Shackleton

Fabio Giubilo

Xiaofeng Du

Karl Smith

Nektarios Georgalas

Pramod Pawar

George Vafiadis

Behnam Azvine

Jonathan Roscoe

Max Smith-creasey

Daniel Bastos

Xavier Jover Segura

Yair Diaz-Tellez

Abdullahi Arabo

Georgios Vafiadis

Andreas Mauthe

Hui Min June Tay

Angelos Marnerides

Behnan Azvine

Michael Watson

Simon Beddus

Andrew Paverd

Mark Shackleton

Method of Operating a Telecommunications Network A computer-implemented method () of operating a telecommunications network (), the telecommunications network comprising a client device () and a server (), wherein the server and the client device are connected via an access point (), the method comprising the steps of: receiving a service request from the client device, said service request requesting a service from the server (); identifying client device characteristic information associated with the client device (); identifying service requirement information associated with the requested service (); comparing the identified client device characteristic information with the identified service requirement information so as to determine if the client device information complies with the service requirement information (); and in response to said comparison: permitting the server to provide the requested service in accordance with the service request if the client device information complies with the service requirement information (); and preventing the server from providing the requested service in accordance with the service request if the client device information does not comply with the service requirement information ().

Method of operating a telecommunications network

A computer implemented method to detect an anomalous change to a web application, the web application executing with a web server, the method including receiving a first set of records for the web application operating in a training mode of operation, each record including characteristics of a content of a web page for the web application; generating a sparse distributed representation of the set of records to form a training set for a hierarchical temporal memory (HTM); training the HTM based on the training set in order that the trained HTM provides a model of the operation of the web application in the training mode of operation; receiving a second set of records for the web application, each record including characteristics of content of the web page; generating a sparse distributed representation of the second set of records to form an input set for the trained HTM; executing the trained HTM based on the input set to determine a degree of recognition of the records of the input set; and responsive to a determination that a degree of recognition of one or more records of the input set is below a threshold degree, identifying an anomalous change to the web page.

Detecting changes to web page characteristics using machine learning

One aspect of the present disclosure provides a computer-implemented method of automatically securing a computer system or network against a suspect binary file (SBF) by, in response to detection of the SBF, initiating an automatic defence strategy. The automatic defence strategy includes a first action known to mitigate a known threat posed by a known malicious binary file (KMBF); and a further action predicted to mitigate a predicted threat posed by a discrepant function present in the SBF but not the KMBF. Further aspects of the present disclosure relate to corresponding data processing systems, computer programs, computer-readable data carriers and data carrier signals.

Computer-implemented automatic security methods and systems

A computer-implemented method of analysing anomalous network traffic in a telecommunications network, said telecommunications network comprising a plurality of network entities () and a security analyser (-), wherein the method comprises the steps of: receiving at the security analyser a network communication from a first network entity; identifying the first network entity; by means of the security analyser: analysing the network communication and/or a performance of the first network entity thereby to identify the network communication as an anomalous communication (); in response to identifying the network communication as an anomalous communication, communicating an instruction to the identified first network entity to respond with origin information regarding the anomalous communication, wherein the origin information identifies a preceding network entity from which the anomalous communication was directly received by the first network entity (); and commencing with the preceding network entity, iteratively communicating an instruction to a preceding network entity to respond with origin information for identifying another preceding network entity from which the anomalous communication was directly received until a source network entity from which the anomalous communication originated is identified (; and applying a security policy to the identified source network entity ().

Method of analysing anomalous network traffic

A method of detecting blockchain miner code executing in a web browser including receiving a profile for the browser identifying typical resource consumption by the browser in use; responsive to a detection of a deviation of the resource consumption by the browser from the profile, intercepting a communication with the browser including a cryptographic nonce, training a plurality of classifiers based on generated training examples, each training example being generated by applying a hashing algorithm to the nonce such that each classifier is trained with training examples generated using a different hashing algorithm; intercepting one or more second communications with the browser, each of the second communications including a hash value; executing at least a subset of the classifiers based on the hash value of each of the second communications; and identifying malicious miner code executing in the browser.

Crypto-jacking detection

A computer implemented method of improved security of an application for deployment to a virtualized computing environment, the method including receiving configuration information for the application; accessing a set of configuration descriptors for a known security attack, each descriptor encoding at least a portion of an application configuration so as to identify one or more descriptors matching at least part of the configuration information, each descriptor in the set having a probability that the security attack will occur in a deployed application having a configuration consistent with the descriptor; evaluating a risk score for a risk of occurrence of the security attack, the risk score evaluated from the probabilities associated with the identified descriptors; identifying a set of compatible alternative configurations for the application; evaluating a risk score for a risk of occurrence of the security attack for each alternative configuration; selecting an alternative configuration having a risk score meeting a predetermined threshold; and adjusting the application configuration information to implement the selected alternative configuration.

Application deployment

A method of managing a network of connected network devices can include detecting that a device descriptor file for a first network device has been updated and stored to a data store managed by a peer-to-peer network of computing systems; analyzing the updated device descriptor file stored to the data store; analyzing historical information stored in the data store regarding other device descriptor file updates related to the first network device or related to other network devices; performing predictive analytics processing on the results of the analyzing and generating a result; and storing the result of the performing predictive analytics processing to the data store.

Device descriptor file management with predictive capability

A computer implemented method for determining a plurality of data sources providing seed parameters for generation of an encryption key by a ransomware algorithm, the method including exposing a target computer system to the ransomware algorithm; monitoring application programming interface (API) calls made to an operating system of the target computer system to identify a set of API calls for retrieving data about one or more hardware components of the target computer system, the data about the hardware components being determined to constitute the seed parameters.

Encryption key seed determination

A security system in a network connected computing device, the device executing a software component that receives information stored in a matrix barcode, the information including a reference to a resource accessible via the network, the system including: a service bar that blocks the software component from accessing services of the computing device; and a logic unit that determines services of the computing device needed by the software component to access the resource, wherein the service bar is adapted to, responsive to a verification of permission of the software component to access the determined services, unblock the software component in order that the software component can access the resource and accesses the determined services.

Secure matrix barcode

Systems and methods of protecting data in a message for communication from a sender to a receiver, the sender and receiver sharing a secret including splitting the message into a number of ordered message blocks, the order being a proper order such that an aggregation of the blocks in the proper order constitutes the message; generating an encoded indication of a position of the block in the proper order of blocks, the encoding being reversible and based on at least a hash value for the block, a secret shared between the sender and the receiver, and a position of the block in the proper order; communicating the blocks and the encoded indications to the receiver, the blocks being communicated in an order different to the proper order so as to obfuscate the message, such that the blocks can be reassembled by the receiver in the proper order on the basis of the shared secret.

Variable data protection

A computer implemented method to detect anomalous behavior of a software container having a software application executing therein, the method including receiving a sparse data representation of each of a: first set of container network traffic records; a first set of application traffic records; and a first set of container resource records, and training an hierarchical temporal memory (HTM) for each first set, wherein the container network traffic records correspond to network traffic communicated with the container, the application traffic records correspond to network traffic communicated with the software application, and the container resource records correspond to the use of computer resources by the container; receiving a sparse data representation of each of a: second set of container network traffic records; a second set of application traffic records; and a second set of container resource records; executing the trained HTMs based on each respective second set to determine a degree of recognition of each of the second sets; responsive to an identification of a coincidence of a degree of recognition of each of the second sets being below a threshold degree in each of the HTMs, identifying anomalous behavior of the software container.

Software container application security

The present disclosure relates to securing networks against attacks launched via connection of peripheral devices to networked devices. According to one aspect, there is provided a computer-implemented method of automatically updating a network security policy, the method comprising: running a machine learning algorithm to continuously update a plurality of weighting coefficients associated with a respective plurality of threat factors, the threat factors each having values defined for each of a plurality of requests for respective peripheral devices to connect to one or more networked devices which are communicably coupled to a secure network; and automatically updating a security policy associated with the secure network in respect of a particular threat factor when that threat factor's associated weighting coefficient changes by more than a predetermined amount in a predetermined period, wherein requests for peripheral devices to connect to the networked devices are automatically approved or denied in dependence on that policy.

Computer-implemented security methods and systems

A computer implemented security method operable with a communications network in a vehicle, the network communicatively connecting devices including sensors and actuators in the vehicle such that information provided by sensors and states of actuators are determinable by data communicated via the network, the method including defining a Markov decision process model for the vehicle, the model specifying states of the vehicle and actions constituting transitions between states, wherein a state of the vehicle is indicated by information provided by one or more sensors and a state of one or more actuators, and an action corresponds to a change in the information provided by one or more sensors and/or a change to a state of one or more actuators, each action having associated a probability of occurrence; determining, by accessing data communicated via the network, a current state of the vehicle in the model; accessing data communicated via the network; responsive to the accessed data indicating an action to change the vehicle state to a new state, determining, from the model, a probability of the action; responsive to a determination that the determined probability falls below a predetermined threshold probability, generating an indication that the vehicle state transition is anomalous.

Vehicular network security

A computer implemented method to determine a security configuration for a target virtual machine (VM) in a virtualized computing environment, the method including training a machine learning algorithm to determine a vector of security vulnerabilities for the target VM based on a vector of configuration characteristics for the target VM, the machine learning algorithm being trained using training examples each including a configuration for a training VM and an associated vulnerability vector based on an observed security occurrence at the training VM, wherein each training example further includes an identification of one of set of security configurations for the training VM; selecting at least a subset of the set of security configurations and, for each security configuration in the subset, executing the machine learning algorithm with the vector of configuration characteristics for the target VM and an identification of the security configuration, so as to generate a set of vulnerability vectors including a vulnerability vector for each security configuration in the selected subset; and selecting a security configuration for the target VM based on the set of vulnerability vectors.

Security configuration determination

A computer implemented method to generate training data for a machine learning algorithm for determining security vulnerabilities of a virtual machine (VM) in a virtualized computing environment is disclosed. The machine learning algorithm determines the vulnerabilities based on a vector of configuration characteristics for the VM.

Growing community of inventors

London, United Kingdom

Fadi El-Moussa