Telefonaktiebolaget Lm Ericsson (publ)

Michael Liljenstam

Jakob Sternby

Björn Johansson

Erik Thormarker

Karl Norrman

Mats Näslund

Göran Selander

Luis Barriga

Patrik Lantz

Gunnar Mildh

Monica Wifvesson

Prajwol Kumar Nakarmi

Henrik Rydén

Patrik Salmela

Bernard Smeets

Oscar Ohlsson

Harald Kallin

Makan Pourzandi

Frank Hartung

Yi Cheng

Henrik Basilier

John Mattsson

Mattias Eld

Bengt Sahlin

András Méhes

Per-Olof Nerbrant

Alessandro Mordacci

Linus Andersson

Björn Bodén

Vasileios Giannokostas

Viktor Berggren

Kyösti Toivanen

Göran Eneroth

Patrick Salmela

András MÉHES

The present disclosure relates to a computer-implemented method and an apparatus for classifying anomalies of one or more feature-associated anomalies in network data traffic between devices in a first part of a network and devices in a second part of the network. The method comprises retrieving at least one network data traffic sample and determining one or more feature-associated anomaly scores for the retrieved at least one network data traffic sample. The method further comprises determining feature importance of each feature of a feature-associated anomaly score and classifying one or more anomalies based on the determined one or more feature-associated anomaly scores and the determined feature importance.

Computer-implemented method and arrangement for classifying anomalies

A neural network having one or more public parts and one or more confidential parts is trained to perform a primary task. A deployment instantiation of the neural network is trained based on optimal performance of the primary task, and based on sub-optimal performance of the primary task conditioned on the confidential parts of the deployment instantiation being inaccessible. An adversary instantiation of the neural network is trained based on optimal performance of the primary task conditioned on the public parts being identical for the deployment instantiation and for the adversary instantiation, and conditioned on the confidential parts of the deployment instantiation being inaccessible. The training of the deployment instantiation and the training of the adversary instantiation are based on a plurality of training data samples, and are performed iteratively by alternating between the training of the deployment instantiation and the training of the adversary instantiation.

Neural network confidentiality

Embodiments include methods for managed machine learning (ML) in a communication network, such as by one or more first network functions (NFs) of the communication network. Such methods include determining whether processing of an ML model in the communication network should be distributed to one or more user equipment (UEs) operating in the communication network, based on characteristics of the respective UEs. Such methods also include, based on determining that the processing of the ML model should be distributed to the one or more UEs, establishing trusted execution environments (TEEs) in the respective UEs and distributing the ML model for processing in the respective TEEs. Other embodiments include complementary methods for UEs, as well as UEs and NFs (or communication networks) configured to perform such methods.

Network controlled machine learning in user equipment

The present disclosure relates to a method and an apparatus for training a model for detecting anomalies in network data traffic between devices in a first part of a network and devices in a second part of the network. The method comprises collecting feature samples of network data traffic at a monitoring point between a first and a second part of the network, and training the model for detecting anomalies on the collected feature samples using a plurality of anomaly detection, AD, trees. The training comprises creating the plurality of AD trees using respective subsets of the collected feature samples, at least some of the AD tree comprising subspace selection nodes and anomaly-catching nodes to a predetermined AD tree depth limit. Each subspace selection node is arranged to bisect a set of feature samples reaching the subspace selection node to at least one anomaly-catching node when a number of feature samples leaving the subspace selection node for the at least one anomaly-catching node is below a predetermined threshold. The disclosure also relates to a method and an apparatus for anomalies in network data traffic using said model.

Method and arrangement for detecting anomalies in network data traffic

An efficient obfuscation of program control flow, comprising obscuring a control execution flow through a plurality of code blocks of a computer program. It involves obtaining a secret key, initializing a state variable based on the secret key, generating a switching value by processing the state variable through an encoding function, and selecting a code block from among a set of code blocks using the switching value. It further involves executing the block code, which comprises updating the state variable based on a present value of the state variable, and repeating the steps of generating a switching value, selecting a code block, and executing the code block to control execution flow through the set of code blocks.

Efficient obfuscation of program control flow

A method to obscure a control execution flow in a computer program includes initializing a state variable, q, and a switching variable, selecting a code block for execution using a present value of the switching variable, executing the code block, updating the state variable based on a present value of the state variable and a block-dependent constant that is associated with the code block to generate an updated state variable, and by applying a state update function to the updated state variable, and updating the switching variable by processing the state variable through a non-injective output function that generates a new value of the switching variable based on the state variable. The operations of selecting the code block, executing the code block, updating the state variable and updating the switching variable are repeated to control execution flow.

Lightweight dispatcher for program control flow flattening

This disclosure relates to methods and apparatuses for protection of control plane functionality of a network node of a communications network providing wireless communication to a mobile terminal. The network node is configured to support control plane signaling with the mobile terminal. A communication context for the mobile terminal is maintained, wherein the communication context is associated with a control signaling message exchange between the mobile terminal and the network node. One method includes establishing, for a received message, a communication context to which it belongs; determining, in relation to information in the established communication context, the received message to be a message conforming to a protection rule or a message violating a protection rule; and handling the message in accordance with rules of a protection policy. Related network nodes, computer programs, and computer program products are disclosed.

Method and devices for protection of control plane functionality

A node in a first network domain and a method performed thereby for transmitting a data packet to a VPN client in a second network domain, the node and the VPN client being part of a VPN, wherein the first and second network domain are connected by means of a third network domain are provided. The method comprises receiving, from an application server, a first packet comprising a first IP header and a payload; and determining a DCSP. The method further comprises adding a second header comprising the determined DCSP and an IP address of a VPN client resulting in a second packet and encrypting the second packet. Further the method comprises adding a third header to the encrypted second packet resulting in a third packet, the third header comprising a destination address of a node in the second network domain, and transmitting the third packet in an IP tunnel terminating at the node in the second network domain.

Method and arrangement for QOS differentiation of VPN traffic across domains

There is provided a method of authenticating a public land mobile network (PLMN) to a mobile station (MS). The PLMN provides a circuit switched access network to the MS, and the MS and a trusted service, TS, have established a security context. The initiation of a voice call or initiation of sending or receiving of a pushed message by the MS (S10.1) is detected, and the TS generates a response authentication token using a session identifier and the security context (S10.7). The TS sends a response comprising the response authentication token to the MS such that the response is delivered to the MS over a signalling channel of the PLMN using a mobile subscriber integrated services digital network-number (MSISDN) associated with the subscriber or subscription to direct the message (S10.9). The MS authenticates the response using the response authentication token, the security context, and the session identifier (S10.12) in order to authenticate the PLMN.

Authenticating public land mobile networks to mobile stations

There is described herein a device () for communicating with a network. The device () comprises a communications unit for receiving data, a notification device for providing a notification to a user, and a control unit for controlling the operation of the communications unit and notification unit. The communications unit is configured to receive an information message (), and to receive security authentication data () associated with the information message if such security authentication data is available. The control unit is configured to operate in a first or second configuration. In the first configuration it ignores the security authentication data, (), and instructs the notification unit to convey the notification to the user. In the second configuration, it verifies the information message () on the basis of the security authentication data and instructs the notification unit to convey the notification to the user if the verification is successful. The communications unit is configured to receive a configuration message () indicating the configuration in which the control unit should operate, and the control unit is configured to change configuration if the indicated configuration is different to the current configuration.

Authentication of warning messages in a network

The present invention relates to methods and devices for detecting persistency of a first network node (). In a first aspect of the invention, a method is provided comprising the steps of monitoring (S), during a specified observation period, whether the first network node has established a connection to a second network node (), and determining (S) a total number of sessions of connectivity occurring during said specified observation period in which the first network node connects to the second network node. Further, the method comprises the steps of determining (S), from the total number of sessions, a number of sessions comprising at least one communication flow between the first network node and the second network node, and determining (S) inter-session persistence of the first network node on the basis of the total number of sessions and the number of sessions comprising at least one communication flow.

Method for detection of persistent malware on a network node

The invention relates to a method, party challenging device () and computer program products for providing a challenge to a first terminal () intending to communicate with a second terminal () via two networks (N, N). The party challenging device receives a first electronic message (M) concerning a transfer of media from the first terminal to the second terminal sent from the first terminal () and addressed to the second terminal (), obtains communication contextual data associated with the first party or the first terminal, provides an electronic challenge message (CHM) including a challenge (CHl) based on the obtained data and sends the challenge message to the first terminal in order to enable a decision to be made how to process the invitation message for the second terminal based on the correctness of a response (RM) including a response to the challenge.

Challenging a first terminal intending to communicate with a second terminal

Method and arrangement in a mediating function () for supporting detection of fraud in a network, when a network security function () is employed for analyzing activities in the network in view of predefined alert criteria, and a fraud detection function () is employed for analyzing e.g. charging information of users. When a first alert is received from a first one of the network security function and the fraud detection function, indicating that the predefined alert criteria of said first function have been satisfied, the alert criteria of the second one of said network security function and fraud detection function are modified based on the received first alert. Thereby, the network security and fraud detection functions can be correlated and made more efficient regarding accuracy and/or speed in detecting fraud.

Method and arrangement for detecting fraud in telecommunication networks

A method and arrangement for distributing a security policy to a communication terminal having an association with a home communication network, but being present in a visited communication network. The home communication network generates its own preferred security policy Ph and the visited communication network generates its own preferred security policy Pv. A communication network entity in the visited communication network combines the security policies and selects security algorithms and/or functions to apply from the combined security policy. By generating security policy vectors of both networks and combining them before the security algorithms are selected, both networks are able to influence the selection without requiring the use of signaling messages.

Growing community of inventors

Solna, Sweden

Michael Liljenstam