Method of threat detection in a threat detection network and threat detection network utilizing threat detection model and local consistency model

Abstract

A network node of a threat detection network, a backend system of a threat detection network including interconnected network nodes and a backend system, a threat detection network and a threat detection method for such network detect network threats. The backend system utilizes a backend threat detection model, and at least part of f the network nodes include security agent modules collecting data related to the respective network node. The network nodes utilize a local threat detection model and a local consistency model. The local consistency model provides confidence level information between the local and backend detection models. The method includes collecting data related to the network node by the security agent module at the network node, applying local threat detection model to the collected data, and making a decision at the endpoint based on the results of the local threat detection model and consistency models.