US 11,811,791 B2
Generative adversarial network based predictive model for collaborative intrusion detection systems
Makarand Bhonsle, Mountain View, CA (US); Sirisha Myneni, Santa Clara, CA (US); Anirban Sengupta, Saratogo, CA (US); and Subrahmanyam Manuguri, San Jose, CA (US)
Assigned to VMWARE, INC., Palo Alto, CA (US)
Filed by VMware, Inc., Palo Alto, CA (US)
Filed on Jan. 9, 2020, as Appl. No. 16/738,305.
Prior Publication US 2021/0218757 A1, Jul. 15, 2021
Int. Cl. G06F 21/00 (2013.01); H04L 9/40 (2022.01); G06F 17/18 (2006.01); G06F 21/56 (2013.01); G06N 3/045 (2023.01); G06N 3/047 (2023.01)
CPC H04L 63/1416 (2013.01) [G06F 17/18 (2013.01); G06F 21/564 (2013.01); G06N 3/045 (2023.01); G06N 3/047 (2023.01)] 20 Claims
OG exemplary drawing
 
1. A method for distributing knowledge of intrusion attacks derived from a plurality of software defined data centers (SDDCs) in a given region, each of the plurality of SDDCs in the given region having a respective convolutional neural network (CNN), the plurality of SDDCs in the given region being linked to each other, the method comprising:
transferring knowledge derived from training of the respective CNN of each of the plurality of SDDCs in the given region to a centralized generative adversarial neural network (GANN) for the given region that includes a discriminator and a generator, wherein the respective CNN of each of the plurality of SDDCs in the given region is trained with intrusion signatures available to the respective CNN based on local intrusion attacks at an SDDC of the plurality of SDDCs in the given region that is associated with the respective CNN, and wherein the discriminator of the GANN receives the knowledge of the respective CNN of each of the plurality of SDDCs in the given region and trains the generator of the GANN;
receiving and transferring knowledge in the generator of the centralized GANN to the respective CNN of each of the plurality of SDDCs in the given region, wherein the respective CNN of each of the plurality of SDDCs in the given region can use either knowledge derived from its training or the received knowledge from the generator to perform intrusion detection and prevention of incoming data packets; and
detecting, by the respective CNN of a given SDDC of the plurality of SDDCs in the given region, a distributed attack targeting multiple SDDCs of the plurality of SDDCs in the given region based on the received knowledge from the generator.