BT develops ‘network immune system’

• BT researchers working with Ericsson propose a response to cyber threats that mimics biological immunity
• The AI-based offering could be deployed internally and offered as a service to enterprise customers
• The speed of response and remediation is critical as threats to telcos escalate

Researchers at BT are developing a ‘network immune system’ (NIS) that aims to make the telco’s network infrastructure better able to respond to cybersecurity threats. BT believes the system may also pave the way for the development of network-based cybersecurity services for the enterprise sector. 

Developed by BT’s research and development team, with tools from its partnership with Ericsson, NIS uses programmable network capabilities to enhance security embedded in the network to autonomously prevent, detect and respond to cyberattacks in real time.

Real-time response and remediation is increasingly important as critical national infrastructure operators, such as BT, are subjected to more sophisticated and tailored attacks.

Developing a capability like this is important, not only to protect BT’s network but also to provide it with insights to protect its customers’ networks. There is intense competition in the supply of cybersecurity services to enterprises, and CSPs must use their network strengths as a differentiator to win enterprise contracts.

If NIS is launched commercially by BT – and it may be years until a commercial launch happens– it would mostly benefit enterprises in the UK market, which is the focus of the telco’s business-to-business (B2B) efforts now that it is seeking to offload its international operations as part of its new strategy.  

BT intends to provide NIS as a service. For example, it could offer temporary cybersecurity capabilities to protect a sport or entertainment event where the risk to people or assets (and the use of network assets) increases sharply for a defined period of time. This will help it differentiate against product vendors, some of which have services businesses, but are unable to provide burstable network services.

Demonstrating NIS at the recent Ericsson OSS/BSS Summit in London, BT indicated that it is aware of the need for scale in the development of NIS and it is seeking companies that can help it develop the concept.

NIS is intended to mimic biological immunity, using reinforcement learning, anomaly detection and threat simulation to identify and remediate attacks. None of these techniques are unique in isolation, so BT will need to develop differentiators based on its application of all of these to its network. Progress is likely to be boosted by Ericsson’s developments in AI-based autonomous network capabilities, which will allow the telco to define the outcome, with the network recommending how best to achieve it.

The intention, at this stage, is to keep humans in the loop for decision-making, in order to ensure that the network delivers the optimal actions. 

NIS is integrated with BT’s network management tools, and pools threat intelligence data from across its network. Using a digital twin of the network, it profiles in advance how threats might spread through the network in order to speed the response when a security incident occurs. This is useful for threats where the adversary is waiting to execute the next step in the cyber kill chain, though adversaries are also using AI capabilities and the window of opportunity to respond is sometimes narrow. 

Cybersecurity services is one of the key areas to which BT CEO Allison Kirkby has committed investment, and which continues to see demand from enterprises: Telcos are keen to evolve their cybersecurity offerings with network-based differentiators to win market share and protect their assets, which face millions of security events each day – see BT spots 2,000 signals of potential cyber-attacks every second.

Meanwhile, Nokia has just published its latest Threat Intelligence report, which reveals the worrying extent of the cybersecurity challenges facing telcos around the world.

– Richard Thurston, Contributing Editor, TelecomTV