Selectively prioritizing received alarms for prioritization system

Abstract

According to one aspect, a computer-implemented method includes generating a historical risk score for a current cyber-security event in response to detecting the current cyber-security event. In addition to an abnormal risk score generated for a current network security event, a sigma rule detection score is generated for the current network security event. An IOC score is further generated for the current network security event. The machine learning model is used to evaluate a historical risk score, a sigma rule detection score, an abnormal risk score, and an IoC score. The machine learning model is also used for creating a comprehensive risk score corresponding to the current network security event, wherein the comprehensive risk score comprises a historical risk score, a sigma rule detection score, an abnormal risk score and an IoC score.

Description

Technical Field

[0001] The present invention relates to evaluating alerts received for a system, and more particularly, the present invention relates to providing a comprehensive and accurate assessment of potential threats based on the current operating conditions of the system. Background Art

[0002] The penetration of computer systems has increased with the Internet and technologies such as Bluetooth. TM and Wi-Fi TM The number of connected devices is increasing due to advances in wireless networking standards. Additionally, the adoption and development of smart devices (e.g., such as smartphones, televisions, tablets, and other devices in the Internet of Things (IoT)) is increasing as processing power and functionality improve.

[0003] In addition, electronic source materials have many benefits compared to physical documents. For example, electronic documents are easier to store and access than physical documents. Accessing physical documents involves manually searching each document in a collection until the desired document is found, while multiple electronic documents can be automatically compared to one or more keywords. In addition, electronic documents can be uploaded and / or downloaded from any device connected to a network, while tangible documents (e.g., paper) must be physically transferred between locations. Similarly, electronic documents take up much less space than their physical counterparts.

[0004] Given these benefits, an increasing amount of physical materials have been digitized. While this digital transformation improves data storage and data accessibility, it also increases the importance of maintaining cybersecurity (e.g., computer security). Cybersecurity involves protecting computer systems and networks from attacks by malicious actors. Depending on the type of computer system and / or network affected, a cybersecurity attack may result in unauthorized disclosure of information, damage to hardware and / or software, corruption of data, etc. While some platforms have been developed to protect computer systems and networks from such attacks, the threats continue to evolve. As a result, computer systems and networks are exposed to various types of incidents over time. Summary of the invention

[0005] According to one approach, a computer-implemented method includes generating a historical risk score for a cybersecurity event in response to detecting a cybersecurity event. In addition to the anomaly risk score generated for the cybersecurity event, a sigma rule detection score is also generated for the cybersecurity event. An indicator of compromise (IoC) score is further generated for the cybersecurity event. A machine learning model is used to evaluate the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. The machine learning model is also used to create a composite risk score corresponding to the cybersecurity event, the composite risk score comprising the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score.

[0006] According to another aspect, a computer program product includes a computer-readable storage medium having program instructions embodied therewith. The program instructions are readable by a processor, executable by a processor, or readable and executable by a processor to cause the processor to perform the aforementioned method in response to detecting a network security event.

[0007] According to another aspect, an advanced threat prioritization system includes a processor and logic integrated with the processor, executable by the processor, or integrated with the processor and executable by the processor. In addition, the logic is configured to perform the aforementioned method in response to detecting a network security event.

[0008] According to another aspect, a computer-implemented method includes training a machine learning model. The machine learning model is trained by collecting information associated with (i) different types of cybersecurity events experienced over time and (ii) actions taken in response to the respective cybersecurity events experienced. The collected information is further examined to develop a comprehensive understanding of the risks associated with the different types of cybersecurity events. The trained machine learning model is also used to evaluate newly received cybersecurity events. Thus, the trained machine learning model is capable of generating a historical risk score for a respective new cybersecurity event.

[0009] According to yet another aspect, a computer-implemented method includes training a machine learning model to generate a comprehensive risk score for a cybersecurity incident. This involves training the machine learning model to generate a weighted value for each of the following: a historical risk score, a sigma rule detection score, an anomaly risk score, and an IoC score. The machine learning model is further trained to apply the weighted values ​​to the corresponding historical risk score, sigma rule detection score, anomaly risk score, and IoC score. The weighted historical risk score, weighted sigma rule detection score, weighted anomaly risk score, and weighted IoC score are also combined by the machine learning model to form a comprehensive risk score.

[0010] Other aspects and embodiments of the present invention will become apparent from the following detailed description, which, taken in conjunction with the accompanying drawings, illustrate, by way of example, the principles of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 is a diagram of a computing environment according to a scheme.

[0012] Figure 2A is a representative view of a distributed system with an Advanced Threat Prioritization System (ATPS) according to one scheme.

[0013] Figure 2B According to a plan Figure 2A A detailed view of one of the nodes in ATPS.

[0014] Figure 2C According to a plan Figure 2A A detailed view of one of the nodes in ATPS.

[0015] Figure 2D According to a plan Figure 2A A detailed view of one of the nodes in ATPS.

[0016] Figure 2E According to a plan Figure 2A A detailed view of one of the nodes in ATPS.

[0017] Figure 2F According to a plan Figure 2A A detailed view of one of the nodes in ATPS.

[0018] Figure 3A is a flow chart of a method according to one approach.

[0019] Figure 3B is used according to a scheme Figure 3A A flowchart of a sub-process of one of the operations in the method.

[0020] Figure 4 is a flow chart of a method according to one approach. DETAILED DESCRIPTION

[0021] The following description is for the purpose of illustrating the general principles of the present invention and is not meant to limit the inventive concept claimed herein.In addition, the specific features described herein can be used in combination with other described features in each of the various possible combinations and permutations.

[0022] Unless otherwise specifically defined herein, all terms should be given their broadest possible interpretation, including the meaning implied from the specification and the meaning understood by those skilled in the art and / or the meaning as defined in dictionaries, treatises, etc.

[0023] It must also be noted that, as used in the specification and the appended claims, the singular forms "a", "an", and "the" include plural referents unless otherwise indicated. It will be further understood that, when used in this specification, the terms "include" and / or "comprise" specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0024] The following description discloses several preferred embodiments of systems, methods, and computer program products for providing a comprehensive and accurate assessment of potential threats based on current operating conditions. Implementations herein are capable of generating an assessment of events that can be used to guide corrective actions performed to overcome undesirable (e.g., network security) events experienced. In other words, the embodiments herein can develop an understanding of events that affect a system, and use that understanding to efficiently respond to situations and restore the operating efficiency of the system. Trained machine learning models can be used to develop an understanding of events that lead to undesirable events, for example, as described in further detail below.

[0025] In one general approach, a computer-implemented method includes, in response to detecting a current cybersecurity event, causing a historical risk score to be generated for a current cybersecurity event. As described above, computer-based attacks have become an increasingly significant threat to computer systems and networks. Furthermore, cybersecurity attacks continue to evolve, increasing the desire for a system that can identify different types of attacks and determine the order in which they should be addressed. Comparing a current cybersecurity event to past cybersecurity events and other events can allow for identification of patterns and other similarities, thereby providing insights into how the current cybersecurity event can be most efficiently addressed.

[0026] The computer-implemented method also includes generating a Sigma rule detection score for the current cybersecurity event. Although some insights can be provided by comparing the current cybersecurity event with historical information, additional assessments can be performed to determine how the current cybersecurity event affects the underlying system and / or how the current cybersecurity event should be overcome. For example, it should be noted that "Sigma rules" are intended to refer to a collection of rules for threat detection and security monitoring. The rules are designed to provide a standardized format and can therefore be used to search for patterns and indicators of compromise (IoC) in log data, making it easier to detect potential security threats. In addition, rules can be written to detect a variety of different security threats, including malware, phishing, credential theft, and the like.

[0027] The computer-implemented method also includes causing an anomaly risk score to be generated for the current cybersecurity event. In other words, evaluating the details of the current cybersecurity event may involve determining whether any values ​​are outside of an expected range. The detected anomalies may provide insight into the contribution of the current cybersecurity event being experienced. This information may further provide insight into how the current cybersecurity event may be addressed and overcome.

[0028] The computer-implemented method also includes generating an IoC score for the current cybersecurity event. The IoC score is also used to quantify the performance of the system in the current situation. This can be based on data provided by a threat intelligence service (TIS), which can utilize various data sources, for example, including internal security research, external threat feeds, third-party intelligence sources, etc.

[0029] The computer-implemented method also includes using a machine learning model to evaluate each of the generated scores. In other words, the machine learning model is used to evaluate the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. These machine learning models can be trained to develop an understanding of the events that contributed to the cybersecurity incident. In addition, this understanding allows the machine learning model to develop a more detailed understanding of how the cybersecurity incident can be overcome.

[0030] Therefore, the computer-implemented method also includes using the machine learning model to create a comprehensive risk score. The comprehensive risk score is created based on the current cybersecurity event, and the comprehensive risk score includes the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. The comprehensive risk score thus provides a summary that can be used to determine how much impact the cybersecurity event has on the underlying system and / or network.

[0031] In some embodiments, causing a historical risk score to be generated for a current cybersecurity event includes: comparing the current cybersecurity event to historical cybersecurity events using another machine learning model. As described above, comparing the current cybersecurity event to cybersecurity events and other events that occurred in the past can allow for identification of patterns and other similarities. This desirably provides insights into how the current cybersecurity event can be most efficiently resolved. Thus, the historical risk score can be based at least in part on the comparison and corresponding responses to historical cybersecurity events. In some embodiments, comparing the current cybersecurity event to historical cybersecurity events includes comparing log severity scores, model upgrade probabilities, rare scores, and / or observable scores.

[0032] In some embodiments, determining the historical risk score includes applying time decay to historical cybersecurity events and corresponding responses. Time decay is preferably used to assign higher importance to more recent (e.g., related to the current event) historical events and responses, while assigning lower importance to events and responses from further in the past. Therefore, more recent events may have a greater impact than events that occurred further in the past.

[0033] In some embodiments, generating a sigma rule detection score for a current cybersecurity event includes: identifying a number of rules that have been triggered due to the current cybersecurity event, and determining a risk score based at least in part on the number of rules that have been triggered. Likewise, the rules are designed to provide a standardized format and thus can be used to search for patterns and IoCs in log data, making it easier to detect potential security threats.

[0034] In some embodiments, causing a sigma rule detection score to be generated for the current cybersecurity event includes normalizing the determined risk score. The normalized risk score can help to appropriately quantify the risk score compared to other events. For example, the normalized risk score can be in the same unit of measure as other normalized risk scores, thereby improving the ability to compare risk scores.

[0035] In some embodiments, generating an anomaly risk score for a current cybersecurity event includes: examining information associated with the current cybersecurity event and identifying anomalies in the information. Again, the anomalies may point to portions of the information that indicate a source of the cybersecurity event. Thus, these anomalies may help guide a response to the cybersecurity event.

[0036] In some embodiments, generating an anomaly risk score for the current cybersecurity event further comprises: determining a numerical value for each anomaly. The numerical value preferably indicates the amount by which the corresponding anomaly deviates from the majority of information associated with the current and / or previous cybersecurity events. Thus, the severity of the anomaly being different from the expected value can be used to determine the degree of impact of the current cybersecurity event on the system.

[0037] In some embodiments, causing an IoC score to be generated for a current cybersecurity event includes: examining information associated with the current cybersecurity event, and identifying one or more types of IoCs in the information. Identifying IoCs related to the current cybersecurity event helps quantify the performance of the system in the current situation. This can be based on data provided by TIS, which can utilize various data sources, including, for example, internal security research, external threat feeds, third-party intelligence sources, etc. In addition, one or more types of IoCs identified in the information are determined based on the current cybersecurity event.

[0038] In some implementations, the identified IoCs are compared to information associated with historical cybersecurity incidents. Thus, an IoC score is determined based at least in part on the overlap between the identified IoCs and past incidents. Again, by comparing current information to historical records, patterns can be identified and used to shape how to overcome current cybersecurity incidents.

[0039] In some embodiments, creating a composite risk score using a machine learning model includes generating a weighted value for each of the following: a historical risk score, a sigma rule detection score, an anomaly risk score, and an IoC score. In addition, the weighted value is applied to each of the corresponding scores.

[0040] Different weighting values ​​can be applied to different types of risk scores. For example, one or more machine learning models have been trained to apply weights to each type of risk score. According to some schemes, the weighted value of a given risk score can be determined by identifying the amount by which a given score changes in response to a single feature value being shuffled. In other words, the machine learning model evaluates the amount by which the model score decreases in response to a single feature value being randomly shuffled. This process effectively breaks the relationship between the feature and the target. Therefore, the reduction in the model score indicates the amount by which a given model depends on the feature. Therefore, the importance of the feature can be used as an indicator of the appropriate weight that should be assigned to the risk score given the current situation. It follows that the weighted historical risk score, the weighted sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score are combined in some embodiments to form a comprehensive risk score.

[0041] In some embodiments, the advanced threat prioritization system includes a historical risk scoring module configured to generate a historical risk score, a sigma rule detection scoring module configured to generate a sigma rule detection score, an abnormal risk scoring module configured to generate an abnormal risk score, and an IoC scoring module configured to generate an IoC score. In addition, a random forest classifier and / or a permutation importance algorithm can be used to train the machine learning model of this article to generate a weighted value for each of the historical risk score, the sigma rule detection score, the abnormal risk score, and the IoC score. The training layer can use these algorithms to learn the appropriate weights for different individual scores. For example, a random forest classifier algorithm can be used to ensure that the individual scores can make meaningful predictions about the overall outcome of the alert. The permutation importance algorithm can also be used to calculate the individual weights for each individual score.

[0042] In another general approach, a computer program product includes a computer-readable storage medium having program instructions embodied therewith. The program instructions are readable by a processor, executable by a processor, or readable and executable by a processor to cause the processor to perform the aforementioned method in response to detecting a network security event.

[0043] In yet another general approach, an advanced threat prioritization system includes a processor and logic integrated with, executable by, or integrated with and executable by the processor. In addition, the logic is configured to perform the aforementioned method in response to detecting a network security event.

[0044] In another general approach, a computer-implemented method includes training a machine learning model. The machine learning model is trained by collecting information associated with (i) different types of cybersecurity events experienced over time and (ii) actions taken in response to the respective cybersecurity events experienced. The computer-implemented method also includes examining the collected information to develop a comprehensive understanding of the risks associated with the different types of cybersecurity events. Again, by comparing the current cybersecurity event with cybersecurity events and other events that occurred in the past, it can allow for the identification of patterns and other similarities when training the machine learning model. This desirably provides insights into how the current cybersecurity event can be most efficiently resolved.

[0045] The computer-implemented method also includes using the trained machine learning model to evaluate newly received cybersecurity events and generate a corresponding historical risk score for the new cybersecurity events. As can be seen, although some situations involve receiving cybersecurity events that have not yet been experienced, the machine learning model is able to provide valuable insights by comparing the new events with events that occurred in the past, for example, to perform correlation. This allows the machine learning model to efficiently evaluate and provide insights on how to handle events as they occur in real time.

[0046] According to another method, a computer-implemented method includes training a machine learning model to generate a comprehensive risk score for a cybersecurity incident. This involves training a machine learning model to generate a weighted value for each of the following: a historical risk score, a sigma rule detection score, an anomaly risk score, and an IoC score. Different weighted values ​​can be applied to different types of risk scores. For example, one or more machine learning models have been trained to apply weights to each type of risk score. According to some schemes, the weighted value of a given risk score can be determined by identifying the amount by which a given score changes in response to a single feature value being shuffled. In other words, the machine learning model evaluates the amount by which the model score decreases in response to a single feature value being randomly shuffled. This process effectively breaks the relationship between the feature and the target. Therefore, the reduction in the model score indicates the amount by which a given model depends on the feature. Therefore, the importance of the feature can be used as an indicator of the appropriate weight that should be assigned to the risk score given the current situation. It follows that the weighted historical risk score, the weighted sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score are combined in some embodiments to form a comprehensive risk score.

[0047] Therefore, the computer-implemented method also includes training a machine learning model to apply weighted values ​​to the corresponding scores. The weighted scores are also combined by the machine learning model to form a comprehensive risk score.

[0048] Various aspects of the present disclosure are described by narrative text, flow charts, block diagrams of computer systems, and / or block diagrams of machine logic included in a computer program product (CPP) implementation. With respect to any flow chart, depending on the technology involved, the operations may be performed in an order different from the order shown in a given flow chart. For example, again depending on the technology involved, two operations shown in consecutive flow chart blocks may be performed in reverse order, as a single integrated step, simultaneously, or in a manner that at least partially overlaps in time.

[0049] Computer program product (CPP) is a term used in this disclosure to describe any collection of one or more storage media (also referred to as "media") collectively included in a collection of one or more storage devices that collectively include machine-readable code corresponding to instructions and / or data for performing the computer operations specified in a given CPP claim. A "storage device" is any tangible device that can retain and store instructions for use by a computer processor. Without limitation, a computer-readable storage medium may be an electronic storage medium, a magnetic storage medium, an optical storage medium, an electromagnetic storage medium, a semiconductor storage medium, a mechanical storage medium, or any suitable combination of the foregoing. Some known types of storage devices that include these media include: magnetic disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), static random access memories (SRAM), compact disk read-only memories (CD-ROM), digital versatile disks (DVD), memory sticks, floppy disks, mechanical encoding devices (such as punch cards or pits / ridges formed in a major surface of a disk), or any suitable combination of the foregoing. As the term is used in this disclosure, computer-readable storage media should not be construed as storage in the form of transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides, light pulses through fiber-optic cables, electrical signals transmitted through wires, and / or other transmission media. As will be appreciated by those skilled in the art, data is typically moved at some occasional point in time during the normal operation of the storage device, such as during access, defragmentation, or garbage collection, but this does not make the storage device transient because the data is not transient when stored.

[0050] The computing environment 100 includes an example of an environment for executing at least some of the computer codes involved in executing the method of the present invention, such as the improved alarm response code at box 150, for providing a comprehensive and accurate assessment of potential threats based on the current operating situation. In addition to box 150, the computing environment 100 includes, for example, a computer 101, a wide area network (WAN) 102, an end-user device (EUD) 103, a remote server 104, a public cloud 105, and a private cloud 106. In this embodiment, the computer 101 includes a processor set 110 (including a processing circuit 120 and a cache 121), a communication structure 111, a volatile memory 112, a persistent storage device 113 (including an operating system 122 and a block 150, as described above), a peripheral device set 114 (including a user interface (UI) device set 123, a storage device 124, and an Internet of Things (IoT) sensor set 125) and a network module 115. The remote server 104 includes a remote database 130. The public cloud 105 includes a gateway 140 , a cloud orchestration module 141 , a host physical machine set 142 , a virtual machine set 143 , and a container set 144 .

[0051] Computer 101 may take the form of a desktop computer, laptop computer, tablet computer, smart phone, smart watch or other wearable computer, mainframe computer, quantum computer, or any other form of computer or mobile device now known or to be developed in the future that is capable of running programs, accessing a network, or querying a database (such as remote database 130). As is well understood in the field of computer technology, and depending on the technology, the execution of the computer-implemented method may be distributed among multiple computers and / or among multiple locations. On the other hand, in this presentation of computing environment 100, the detailed discussion focuses on a single computer (specifically, computer 101) to keep the presentation as simple as possible. Computer 101 may be located in the cloud, even if it is not in the cloud. Figure 1 On the other hand, except to any extent that may be indicated with certainty, computer 101 need not be in the cloud.

[0052] Processor group 110 includes one or more computer processors of any type now known or developed in the future. Processing circuit 120 may be distributed over multiple packages (e.g., multiple coordinated integrated circuit chips). Processing circuit 120 may implement multiple processor threads and / or multiple processor cores. Cache 121 is a memory located in (one or more) processor chip packages and is typically used for data or code that should be available for quick access by threads or cores running on processor group 110. Cache memory is typically organized into multiple levels based on relative proximity to the processing circuit. Alternatively, some or all of the caches for the processor group may be located “off chip.” In some computing environments, processor group 110 may be designed to work with quantum bits and perform quantum computing.

[0053] Computer-readable program instructions are typically loaded onto the computer 101 to cause the processor group 110 of the computer 101 to perform a series of operating steps to implement a computer-implemented method, such that the instructions so executed will instantiate the method specified in the flowchart and / or narrative description of the computer-implemented method included in this document (collectively referred to as the "method of the present invention"). These computer-readable program instructions are stored in various types of computer-readable storage media, such as cache 121 and other storage media discussed below. The program instructions and associated data are accessed by the processor group 110 to control and direct the execution of the method of the present invention. In the computing environment 100, at least some of the instructions for performing the method of the present invention may be stored in the persistent storage device 113 in the box 150.

[0054] Communications fabric 111 is the signaling pathways that allow the various components of computer 101 to communicate with each other. Typically, the fabric is made of switches and conductive pathways, such as those that make up a bus, a bridge, physical input / output ports, etc. Other types of signal communication pathways may be used, such as fiber optic communication pathways and / or wireless communication pathways.

[0055] The volatile memory 112 is any type of volatile memory now known or developed in the future. Examples include dynamic type random access memory (RAM) or static type RAM. Typically, the volatile memory 112 is characterized by random access, but this is not required unless explicitly indicated. In the computer 101, the volatile memory 112 is located in a single package and is internal to the computer 101, but alternatively or additionally, the volatile memory may be distributed over multiple packages and / or located externally relative to the computer 101.

[0056] Persistent storage 113 is any form of non-volatile storage for computers known now or to be developed in the future. The non-volatility of the storage means that the stored data is maintained regardless of whether power is supplied to computer 101 and / or directly to persistent storage 113. Persistent storage 113 may be a read-only memory (ROM), but typically at least a portion of the persistent storage allows data to be written, deleted, and rewritten. Some common forms of persistent storage include magnetic disks and solid-state storage devices. Operating system 122 may take several forms, such as various known proprietary operating systems or open source portable operating system interface type operating systems using a kernel. The code included in block 150 typically includes at least some of the computer code involved in executing the method of the present invention.

[0057] The peripheral device set 114 includes a peripheral device set of the computer 101. The data communication connection between the peripheral device and other components of the computer 101 can be implemented in various ways, such as a Bluetooth connection, a near field communication (NFC) connection, a connection by a cable (such as a universal serial bus (USB) type cable), a plug-in type connection (e.g., a secure digital (SD) card), a connection through a local area network, and even a connection through a wide area network (such as the Internet). In various implementations, the UI device set 123 may include components such as display screens, speakers, microphones, wearable devices (such as goggles and smart watches), keyboards, mice, printers, touchpads, game controllers, and tactile devices. The storage device 124 is an external storage device (such as an external hard drive) or a pluggable storage device (such as an SD card). The storage device 124 can be persistent and / or volatile. In some embodiments, the storage device 124 can take the form of a quantum computing storage device for storing data in the form of quantum bits. In embodiments where it is necessary for computer 101 to have a large amount of storage (e.g., where computer 101 locally stores and manages a large database), the storage may be provided by a peripheral storage device designed to store very large amounts of data, such as a storage area network (SAN) shared by multiple geographically distributed computers. IoT sensor set 125 consists of sensors that can be used in IoT applications. For example, one sensor may be a thermometer, while another sensor may be a motion detector.

[0058] The network module 115 is a collection of computer software, hardware, and firmware that allows the computer 101 to communicate with other computers via the WAN 102. The network module 115 may include hardware such as a modem or a Wi-Fi signal transceiver, software for packetizing and / or depacketizing data for transmission over a communication network, and / or web browser software for transmitting data over the Internet. In some embodiments, the network control function and the network forwarding function of the network module 115 are executed on the same physical hardware device. In other implementations (e.g., implementations utilizing software defined networks (SDNs)), the control function and the forwarding function of the network module 115 are executed on physically separate devices, so that the control function manages several different network hardware devices. Computer-readable program instructions for executing the method of the present invention can typically be downloaded to the computer 101 from an external computer or an external storage device via a network adapter card or a network interface included in the network module 115.

[0059] WAN 102 is any wide area network (e.g., the Internet) capable of transmitting computer data over non-local distances by any technology now known or to be developed in the future for transmitting computer data. In some embodiments, WAN 102 may be replaced and / or supplemented by a local area network (LAN) designed to transmit data between devices located in a local area (such as a Wi-Fi network). WANs and / or LANs typically include computer hardware such as copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers, and edge servers.

[0060] End-user device (EUD) 103 is any computer system used and controlled by an end-user (e.g., a customer of an enterprise operating computer 101), and may take any of the forms discussed above in connection with computer 101. EUD 103 typically receives helpful and useful data from the operation of computer 101. For example, in the hypothetical case where computer 101 is designed to provide recommendations to an end-user, the recommendations would typically be transmitted from network module 115 of computer 101 to EUD 103 via WAN 102. In this manner, EUD 103 may display or otherwise present the recommendations to the end-user. In some implementations, EUD 103 may be a client device, such as a thin client, a heavy client, a mainframe computer, a desktop computer, or the like.

[0061] Remote server 104 is any computer system that provides at least some data and / or functionality to computer 101. Remote server 104 may be controlled and used by the same entity that operates computer 101. Remote server 104 represents a machine(s) that collects and stores helpful and useful data for use by other computers, such as computer 101. For example, in the hypothetical case where computer 101 is designed and programmed to provide recommendations based on historical data, then that historical data may be provided to computer 101 from remote database 130 of remote server 104.

[0062] The public cloud 105 is any computer system that is available to multiple entities and provides on-demand availability of computer system resources and / or other computer capabilities, particularly data storage (cloud storage) and computing capabilities, without direct active management by users. Cloud computing typically exploits the sharing of resources to achieve consistency and economies of scale. The direct and active management of the computing resources of the public cloud 105 is performed by computer hardware and / or software of the cloud orchestration module 141. The computing resources provided by the public cloud 105 are typically implemented by virtual computing environments running on various computers that constitute the host physical machine set 142, which is the totality of physical computers in and / or available to the public cloud 105. The virtual computing environment (VCE) is typically in the form of a virtual machine from a virtual machine set 143 and / or a container from a container set 144. It should be understood that these VCEs can be stored as images and can be transferred between various physical machine hosts as images or after instantiation of the VCE. The cloud orchestration module 141 manages the transmission and storage of images, deploys new instantiations of VCEs, and manages active instantiations of VCE deployments. Gateway 140 is a collection of computer software, hardware, and firmware that allows public cloud 105 to communicate over WAN 102 .

[0063] Some further explanation of virtual computing environments (VCEs) will now be provided. A VCE can be stored as an "image". A new active instance of a VCE can be instantiated from an image. Two common types of VCEs are virtual machines and containers. Containers are VCEs that use operating system-level virtualization. This refers to an operating system feature where the kernel allows the existence of multiple isolated user space instances called containers. From the perspective of the programs running in them, these isolated user space instances generally behave like real computers. Computer programs running on a normal operating system can utilize all of the resources of that computer, such as connected devices, files and folders, network shares, CPU power, and quantifiable hardware capabilities. However, programs running within a container can only use the contents of the container and the devices assigned to the container, a feature known as containerization.

[0064] The private cloud 106 is similar to the public cloud 105, except that the computing resources are only available to a single enterprise. Although the private cloud 106 is depicted as communicating with the WAN 102, in other embodiments, the private cloud can be completely disconnected from the Internet and accessible only through a local / private network. A hybrid cloud is a combination of multiple clouds of different types (e.g., private, community, or public cloud types), typically implemented by different vendors. Each of the multiple clouds remains a separate and discrete entity, but the larger hybrid cloud architecture is tied together by standardized or proprietary technologies that enable orchestration, management, and / or data / application portability between the multiple constituent clouds. In this embodiment, both the public cloud 105 and the private cloud 106 are part of a larger hybrid cloud.

[0065] In some aspects, a system according to various embodiments may include a processor and logic integrated with and / or executable by the processor, the logic being configured to perform one or more of the process steps described herein. The processor may be any configuration as described herein, such as a discrete processor or a processing circuit including many components such as processing hardware, memory, I / O interfaces, etc. Integrated with means that the processor has logic embedded therein as hardware logic, such as an application specific integrated circuit (ASIC), FPGA, etc. By executable by a processor, it is meant that the logic is hardware logic; software logic, such as firmware, part of an operating system, part of an application; etc., or some combination of hardware and software logic, which is accessible by the processor and configured to cause the processor to perform a certain function when executed by the processor. The software logic may be stored on local and / or remote memory of any memory type known in the art. Any processor known in the art, such as a software processor module and / or a hardware processor, such as an ASIC, FPGA, a central processing unit (CPU), an integrated circuit (IC), a graphics processing unit (GPU), etc., may be used.

[0066] Of course, according to various implementations, the logic may be implemented as a method on any device and / or system or as a computer program product.

[0067] As described above, the popularity of computer systems has increased with the advancement of the Internet and wireless networking standards such as Bluetooth and Wi-Fi. In addition, as processing power and functionality have improved, the adoption and development of smart devices (e.g., such as smartphones, televisions, tablets, and other devices in the Internet of Things (IoT)) has increased.

[0068] In addition, electronic source materials have many benefits compared to physical documents. For example, electronic documents are easier to store and access than physical documents. While accessing physical documents involves manually searching each document in a collection until the desired document is found, multiple electronic documents can be automatically compared to one or more keywords. In addition, electronic documents can be uploaded and / or downloaded from any device connected to a network, while tangible documents (e.g., paper) must be physically transferred between locations. Similarly, electronic documents take up much less space than their physical counterparts.

[0069] Given these benefits, an increasing amount of physical materials have been digitized. While this digital transformation improves data storage and data accessibility, it also increases the importance of maintaining network security (e.g., computer security). Again, network security involves protecting computer systems and networks from attacks by malicious actors. Depending on the type of computer system and / or network affected, a network security attack may result in unauthorized disclosure of information, damage to hardware and / or software, corruption of data, etc. While some platforms have been developed to protect computer systems and networks from such attacks, the threats continue to evolve. As a result, computer systems and networks face various types of attacks over time.

[0070] As the importance of computer systems and networks continues to increase, cybersecurity attacks pose an increasingly significant threat. As a result, cybersecurity has become a significant challenge due to the complexity of computer systems and the widespread use of computer networks. Although conventional products have attempted to address security alerts and indicators received from various sources such as security information and event management (SIEM) and endpoint detection and response (EDR), these conventional products fail to address many situations involving computer and network security.

[0071] These conventional products have difficulty identifying the severity of each incident reported. As a result, conventional products are completely unable to prioritize different security situations, or even identify which incidents could potentially lead to operational damage. While some attempts to evaluate empirical data have been made to try to improve performance, this threat information is often old and redundant. Additionally, multiple enrichment sources may contradict each other, making them ineffective for evaluation.

[0072] Therefore, there is a need to develop an intelligent system that can use artificial intelligence to automatically evaluate events and calculate the comprehensive risk of network security based on different indicators (including historical risks). Such a system is preferably dynamic enough to add new and remove redundant risk indicators, as well as apply appropriate weights to each indicator. By implementing this system, the solution herein can ensure a more efficient and effective security response to potentially harmful events. This can significantly minimize the risk of network security threats to computer systems and networks, for example, as will be described in further detail below.

[0073] It can be seen that, in stark contrast to the shortcomings of conventional products, the implementation of this article is able to provide a comprehensive and accurate assessment of potential security threats. For example, ATPS can be used to detect cybersecurity events that occur and assess the threats they pose to the underlying systems. Some solutions can even generate an assessment of the event, which can be used to guide corrective actions performed to overcome the experienced cybersecurity events. In other words, the solution of this article can develop an understanding of events that affect the cybersecurity of the system, and use this understanding to efficiently respond to the situation and restore cybersecurity to the system. The trained machine learning model can be used to develop an understanding of events that contribute to cybersecurity events, for example, as described in further detail below.

[0074] Watch now Figure 2A , according to one approach, a distributed system 200 having an ATPS 202 configured to detect and respond to network security events is shown. As an option, the system 200 and / or ATPS 202 may be implemented in conjunction with features from any other approach listed herein, such as with reference to other figures (such as Figure 1 ) described herein. However, such systems 200, ATPS 202, and other systems presented herein may be used in a variety of applications and / or arrangements that may or may not be specifically described in the illustrative methods or implementations listed herein. Furthermore, the systems 200 and / or ATPS 202 presented herein may be used in any desired environment. Therefore, Figure 2A (and other diagrams) may be considered to include any possible permutation.

[0075] As shown, system 200 includes ATPS 202, which is preferably configured to evaluate attacks affecting (or intended to affect) computer systems and / or computer networks. Thus, ATPS 202 can receive event information from multiple locations where received signals (e.g., commands) and / or performed operations are being evaluated. Thus, ATPS 202 is connected to multiple distributed locations and / or components.

[0076] Looking at ATPS 202, a machine learning module 204 is depicted having a machine learning model training layer 206 and a machine learning model application layer 208. The machine learning model training layer 206 can receive information from various locations and use the received information to train a machine learning model. In addition, the machine learning model application layer 208 can use the machine learning model trained in layer 206 to evaluate events as they occur in real time.

[0077] Looking at the machine learning model training layer 206, the user interface node 210 receives information directly from the user interface 212. The received information can access the Internet, run software applications, other systems, etc. through the user interface 212. Therefore, although not shown, the user interface can be connected to a network that provides access to a website at a specific uniform resource locator (URL) address. Therefore, the information received at the user interface node 210 can be used to train a machine learning model based on the user's actions over time. Therefore, the machine learning model can be able to recognize patterns in user actions and predict how these user actions will affect the performance of the ATPS 202 and / or the entire larger system 200.

[0078] It can be seen that the machine learning model training layer 206 is preferably capable of training machine learning models to evaluate experienced events (e.g., cybersecurity events) and develop an understanding of those experienced events. For example, in some scenarios, a machine learning module can be trained by first collecting information associated with (i) different types of cybersecurity events experienced over time and (ii) actions taken in response to the corresponding cybersecurity events experienced. This information can be stored in a memory, copied to other locations, merged, etc. Upon examining the collected information, (one or more) machine learning models can thereby be able to develop a comprehensive understanding of the risks associated with different types of cybersecurity events. In addition, machine learning can be used to evaluate newly received (e.g., experienced) cybersecurity events and develop values ​​that provide insights into how newly received cybersecurity events compare to historically experienced and evaluated events.

[0079] Other machine learning models may also be trained by the machine learning model training layer 206. For example, one or more machine learning models may be trained to generate a comprehensive risk score for a cybersecurity event, which represents the overall risk that the cybersecurity event poses to the successful operation of the underlying system. For example, a machine learning model may be trained to generate a weighted value for each of the following: a historical risk score, a sigma rule detection score, an anomaly risk score, and an IoC score. Thus, the machine learning model is able to emphasize certain risk scores and weaken other risk scores based on the specific cybersecurity event being experienced or evaluated. Thus, the weighted values ​​may be applied to the corresponding historical risk scores, sigma rule detection scores, anomaly risk scores, and IoC scores. In addition, the machine learning model may be able to combine the weighted historical risk scores, the weighted sigma rule detection scores, the weighted anomaly risk scores, and the weighted IoC scores to form a comprehensive risk score, for example, as will be described in further detail below.

[0080] ATPS 202 also includes an anomaly detection node 214, which can be used to examine information (e.g., data, commands, operations performed, etc.) to determine whether there are any anomalies. With respect to this specification, an "anomaly" can include any value or result that deviates from an expected value or result. Thus, anomaly detection node 214 can include one or more machine learning models that have been trained using information previously received at ATPS 202.

[0081] Similarly, the language processing node 216 may include an ontology driven system that has been trained to perform natural language queries against a relational data store. Additionally, the threat detection node 218 may include a machine learning model that has been trained to identify potential threats (e.g., cybersecurity threats) based on received information associated with the operation of the system. As described above, the machine learning model may be trained using information received over time. Thus, the performance of the ATPS 202 and the system 200 as a whole can further improve over time as the machine learning model becomes more effective at identifying potential issues and generating an accurate understanding of how each issue may affect the underlying system.

[0082] Scoring node 220 may also include one or more machine learning models that have been trained to apply weights to each of the different types of information received by other nodes in training layer 206. The information may be weighted by evaluating the received information and comparing certain portions to each other and / or to historical information associated with previous performance. Thus, scoring node 220 may be able to assess the extent to which a given situation is predicted to affect system performance. This assessment and prediction may be further used to generate an accurate understanding of what risk different situations (such as cybersecurity attacks) pose, for example, as will be described in further detail below with respect to method 300.

[0083] Still reference Figure 2A , the machine learning model training layer 206 is also connected to a cloud server 222 (e.g., a central server) via a network 223. However, the information sent to the cloud server 222 may first be evaluated to determine whether it should be incorporated into other information stored at the cloud server 222. For example, information may have been extracted from a failed operation, an unsatisfactory result, etc. Therefore, in some cases, it is not desirable to incorporate certain information into an existing model and / or data repository. The data inspection module 226 thereby evaluates the data sent from the training layer 206. Data determined by the inspection module 226 as required by the cloud server 222 may thus be sent via the network 223. However, data determined to be undesirable to the cloud server 222 may be returned to the training layer 206, as shown.

[0084] The configuration and / or capabilities of cloud server 222 may vary depending on the scenario. For example, in some embodiments, cloud server 222 may include a large (e.g., robust) processor coupled to a cache, a machine learning module, and a data storage array with relatively high storage capacity. Thus, cloud server 222 may be used to process and store relatively large amounts of data, annotations, and other information related to computer system 200 and / or other systems received over time. This allows cloud server 222 to connect to machine learning model training layer 206 and provide computational throughput that helps continue training the machine learning model.

[0085] The cloud server 222 is also shown connected to the machine learning model application layer 208 via the processor 224. This connection (represented by the dashed line 228) can be used to pull the trained machine learning model and historical (e.g., previous) events from the training module 206 and / or the cloud server 222 to evaluate the current situation. In a preferred embodiment, the machine learning model is used to compare the current situation with other situations that occurred in the past. This comparison allows the machine learning model to determine the relative risk associated with the current situation based on past events that are sufficiently similar to the current situation. For example, network security events can be compared to determine the relative similarity level between network security events based on one or more factors (such as log severity scores, model upgrade probability, rare scores, observable scores, and others).

[0086] It should be noted that cloud server 222 may also receive information over time corresponding to actual usage of the machine learning models trained in training layer 206. This in-use information may be evaluated by the actual machine learning models and used to make predictions and recommend actions aimed at overcoming undesirable situations. For example, cybersecurity events experienced over time may be evaluated and used to further train the machine learning model on how to overcome similar or identical events in the future.

[0087] The machine learning model application layer 208 may also be able to receive (e.g., pull or request) machine learning models that have been generated, trained, and applied over time. Thus, the application layer 208 may work in combination with the training layer 206 to maintain machine learning models that are capable of evaluating current events. These machine learning models may be applied to newly experienced events (e.g., cybersecurity attacks) to evaluate the details and determine real-time analysis of the situation. Thus, the application layer 208 may include at least some of the same or similar nodes as the training layer 206. In other words, at least some of the nodes in the application layer 208 may be developed and improved over time in the training layer 206 before being implemented in the application layer 208.

[0088] Specifically, the application layer 208 is shown to include an anomaly detection node 214, a language processing node 216, a threat detection node 218, and a cumulative risk score node 219, for example, as seen in the training layer 206. In addition, the application layer 208 includes a threat score node 211 and a sigma node 213, each of which can be used to evaluate different details of a particular event being experienced. For example, nodes 211, 213, 214, 216, 218, 219 can be used to evaluate different aspects of a cybersecurity event being experienced. Therefore, updates to the nodes in the application layer 208 can be made over time as performance changes in response to experiencing a particular type of event, thereby affecting the training layer 206.

[0089] In response to using different nodes 211, 213, 214, 216, 218, 219 to evaluate each of the different aspects, the application layer 208 can generate an indication of how the newly experienced event is predicted to affect the system. Therefore, the indication reveals the relative severity of the event compared to other events (e.g., situations) currently being experienced or experienced in the past. Therefore, the embodiments of this article can solve the event in an order corresponding to a given situation. For example, events that pose a greater risk to a computer system and / or network can be selectively solved before other events that do not affect the security of the system and / or network. This allows the current operating process of the system to be made more efficient by providing insights that help better understand the events (e.g., situations) that occur. These events can be easily compared to each other and managed according to the scheme described herein.

[0090] Still reference Figure 2A, the training layer 206 is connected to the controller 230, and the application layer 208 is connected to the inference module 232. The controller 230 is shown as receiving data from the application layer 208, for example, in response to one or more machine learning models being used to evaluate a given event. Therefore, the controller 230 can direct at least some of this received data back to the training layer 206 so that the machine learning model can continue to be trained and improved using results from actual use. In addition, the inference module 232 can be used to generate a relative risk score for each event detected by the ATPS 202, for example, as will be described in further detail below.

[0091] The controller 230 is also connected to a security module 234 having a processor 236. The security module 234 and the processor 236 can be configured to implement a relational database management system that organizes data into one or more data tables. In the data tables, relationships can be established between parts of the data to structure the data. Based on the structured understanding of the data, the security module 234 can identify potential security threats. For example, the security module 234 can be configured to detect cybersecurity events that occur and assess the threats they pose to the underlying ATPS 202. Some solutions can even generate an assessment of the event, which can be used to guide corrective actions that are performed to overcome the cybersecurity event experienced. In other words, the solutions herein can develop an understanding of events that affect the cybersecurity of the system, and use that understanding to efficiently respond to the situation and restore cybersecurity to the system.

[0092] Thus, in response to evaluating the data using processor 236, an original alert may be received from security module 234 via network 238, for example, as will be understood by one skilled in the art after reading this specification. It should also be noted that networks 223 and / or 238 may be of any type, for example, depending on the desired scenario. For example, networks 223 and / or 238 may be a WAN, such as the Internet. However, an illustrative list of other potential network types includes, but is not limited to, a LAN, PSTN, SAN, an internal telephone network, and the like. Thus, any desired information, data, commands, instructions, responses, requests, and the like may be sent between ATPS 202 and (i) cloud server 222, (ii) user interface 212, (iii) security module 234, and / or combinations thereof, regardless of the amount of separation that exists between them.

[0093] Reference now Figure 2B-2F , according to different schemes, a risk scoring module with detailed views of components in different nodes 211, 213, 214, 216, 218, 219 is shown. It can be seen that FIG. 2B to FIG. 2F One or more of the nodes shown in FIG. 20 can be developed (eg, trained) in training layer 206 and / or used in a module in application layer 208 to evaluate the performance of a given Figure 2AATPS 202 identifies a given situation. However, it should be noted that Figure 2B-2F The components in any of the are shown according to certain aspects, which are in no way intended to limit the invention.

[0094] First Look Figure 2B , the language processing node 216 and the threat detection node 218 are combined to form a historical risk scoring module 240, which has therein components configured to generate a risk score for a current situation (e.g., an incident) being experienced. The risk score can be calculated by the historical risk scoring module 240 by evaluating different types of alerts received and comparing them to previously experienced situations. For example, an arbiter 246 receives a security information and event management (SIEM) alert 242 and / or an endpoint detection and response (EDR) alert 244 at the historical risk scoring module 240. The arbiter 246 keeps different types of alerts separate and may also maintain a record of received alerts (e.g., in a lookup table).

[0095] From the adjudicator 246, the received SIEM and EDR alerts are provided to a topic module 248. Module 248 can be used to extract topic information from each alert received, thereby providing insight into how each alert affects the system. In some scenarios, these topics can be stored in memory, while in other scenarios, the extracted topic information can be provided to endpoints 250, 252, for example, as will soon become apparent.

[0096] Module 248 also receives feedback from risk score endpoint 256. In some scenarios, module 248 receives a response from endpoint 256 that includes JavaScript Object Notation (JSON) data (e.g., one or more strings, numbers, objects, arrays, Boolean values, null values) in the body of the response. The response may also include a content-type header, a response status, a status message, etc. Thus, the received feedback may affect the subject information extracted from the received alert, for example, as will be understood by a skilled artisan after reading this specification.

[0097] Alerts are sent from module 248 to endpoints 250, 252. Received alerts are preferably separated so that different types of alerts are sent to different ones of endpoints 250, 252. For example, SIEM alerts are sent to endpoint 252, while EDR alerts are sent to endpoint 250. According to one example, although in no way intended to limit the present invention, endpoint 252 may be an Advanced Threat Treatment System (ADTS) endpoint, while endpoint 250 is an Athena-based endpoint. Thus, endpoints 250, 252 may each run microcode at a specific point in the machine learning process to evaluate a specific type of received alert.

[0098] In response to examining each received alert, predictions, assessments, and other types of analysis are output from endpoints 250, 252. As described above, this information is generated as a result of training machine learning models on past events and how they were processed. The information output from endpoints 250, 252 is provided to a risk scoring engine 254, which includes one or more machine learning models that have been trained to generate relative historical risk scores for received alerts.

[0099] The historical risk score generated for one or more related alerts can represent the likelihood that the alert will ultimately cause the overall system to be negatively impacted and / or how much of a negative impact it will have. Again, this is based on patterns and other relationships identified by a trained machine learning model trained using the historical (e.g., past) performance of the system. Thus, the risk score can be used to prioritize certain alerts that correspond to a much higher risk of being harmful to the system, while choosing to defer addressing alerts that correspond to less severe situations. This allows the system to be efficiently maintained by proactively addressing each issue before it impacts performance.

[0100] In some implementations, the risk scoring engine 254 uses a random forest regressor that considers various features in the received information (e.g., alerts), such as log severity scores, model escalation probabilities, rare scores, observable scores, and similar alert counts. To ensure accuracy, the risk scoring engine 254 also uses historical escalation score values ​​as ground truth. Thus, by calculating a score that represents the risk of an alert from a historical perspective, the risk scoring engine 254 and the historical risk scoring module 240 as a whole are able to prioritize alerts and provide security analysts with a clearer picture of potential threats.

[0101] Endpoint 256 further evaluates the risk score generated by engine 254, thereby returning feedback to module 248. As described above, in some embodiments, module 248 receives a response from endpoint 256, and endpoint 256 includes JSON data in the body of the response. Therefore, endpoint 256 can be configured to extract JSON data from the risk score generated by risk scoring engine 254.

[0102] As can be seen, machine learning has proven to be an effective tool for providing risk scores for SIEM and EDR alerts. For example, by leveraging historical learning and analyst responses, the system can be trained on data collected from previous alerts and actions taken in response to the alerts. This allows the machine learning model (e.g., algorithm) to develop a comprehensive understanding of the risks associated with different types of alerts received.

[0103] Watch now Figure 2C, Sigma node 213 is used to form a Sigma risk scoring module 258, which has a component configured to also generate a risk score for the current situation (eg, event) being experienced. Figure 2B In contrast to the historical risk scoring module 240, the sigma risk scoring module 258 is configured to generate a risk score based on the number of predetermined rules that are violated by the current situation. For example, the processing pipeline 264 can be configured to evaluate the number and / or type of rules that have been violated and generate a relative sigma risk score that quantifies the likelihood that the violated rules will result in a significant system error that affects operational efficiency (e.g., system downtime).

[0104] As a result of examining the different types of alerts received, the violated rules may be identified by the sigma risk scoring module 258. For example, the SIEM alert 242 and / or the EDR alert 244 are also shown as being received at the sigma risk scoring module 258 (also referred to herein as the "sigma rule detection scoring module"). In some scenarios, the same alert 242, 244 may be received at each risk scoring module, while in other scenarios, the different types of alerts may be directed to specific ones of the scoring modules. As described above, the arbiter 246 may be used to keep the different types of alerts separate, and may also maintain a record of the received alerts (e.g., in a lookup table).

[0105] From the adjudicator 246, the received SIEM and EDR alerts are provided to a topic module 260. Again, the module 260 can be used to extract topic information from each alert received, thereby providing insight into how each alert affects the system. In some scenarios, these topics can be stored in memory, while in other scenarios, the extracted topic information can be provided to an endpoint 262, for example, as will become apparent shortly.

[0106] Alerts are sent from module 260 to endpoint 262. Different types of received alerts may be combined so that they are evaluated together by microcode running at endpoint 262. For example, endpoint 262 may run microcode at a particular point in the machine learning process to evaluate received alerts and determine the likelihood that they indicate an error will be experienced.

[0107] From endpoint 262, the evaluated alerts and the corresponding information generated are provided to a processing pipeline 264 for further evaluation. For example, the processing pipeline 264 includes a domain object module 266, which can provide a framework that provides a convenient and unified layer to access data from various data sources. In addition, a rule selection module 268 is used to select rules to be maintained. These rules can be selected from a set of available options, rules predetermined by the current situation being evaluated, user preferences, a repository of potentially applicable sigma rules, etc. With respect to this specification, it should be noted that "sigma rules" are intended to refer to a collection of rules for threat detection and security monitoring.

[0108] In some cases, Sigma rules are open source. In addition, Sigma rules are designed to provide a standardized and structured method for describing log events and creating detection rules. Therefore, these rules can be used to search for patterns and IoCs in log data, making it easier to detect potential security threats. In some scenarios, Sigma rules can be written in YAML format. In addition, Sigma rules can be written to detect a variety of different security threats, including malware, phishing, credential theft, etc. Therefore, the rule selection module 268 can implement any desired number and / or type of Sigma rules depending on the situation.

[0109] Pattern matching module 270 is also used to evaluate the details of received alerts and rule-based information output from rule selection module 268. In some aspects, pattern matching module 270 implements natural language processing (NLP) to evaluate textual information included in alerts, applied rules, user input, etc. This textual information is used to identify patterns, make correlations, develop predictions, etc.

[0110] The information evaluated by the pattern matching module 270 is sent to the risk scoring module 272 to generate a risk score for the current situation. The risk scoring module 272 can thereby evaluate information including: received alerts, details determined by the pattern matching module 270 (e.g., patterns, correlations, predictions, etc.), rule-based information, etc. One or more trained machine learning models can be implemented by the risk scoring module 272 to evaluate the number and / or type of rules that have been violated and other received information, and determine a relative value that quantifies the likelihood that the violated rules will result in significant system errors that affect operational efficiency (e.g., system downtime). Thus, the relative value can be output by the risk scoring module 272 as a sigma risk score. From the risk scoring module 272, the risk score is sent to the reasoning module 274, which further evaluates the risk score and determines whether corrective action should be taken to avoid any potential problems that may be caused by the current situation.

[0111] Thus, the Sigma Risk Scoring Module 258 is able to evaluate various details and generate a Sigma Risk Score that quantifies the likelihood that the rule that is violated in the current situation will result in a significant system error that affects operational efficiency. Again, the microservices operating in the Sigma Risk Scoring Module 258 can use open source rules to describe relevant log events related to command line values, process names, URLs, etc. For example, a pattern matching engine can be used to determine the risk associated with each log event. According to one example, which is by no means intended to be limiting, the Sigma Risk Scoring Module 258 can use an application programming interface (API) that utilizes ANTLR specifically customized for the STIX 2.0 nomenclature. The backend can use the pattern matching engine to determine whether the Sigma rule has been triggered. However, in this example, in order to scan the log events, the input data is converted to the format of the STIX Domain Object 2.0 (SDO). Therefore, the microservice will clean and extract the input data to build and mark the SDO based on a given category.

[0112] Thus, in the event that a Sigma rule is triggered (e.g., fails), the API will provide a response indicating the specific rule that was triggered and the associated policies and techniques. The risk scoring module 272 (e.g., engine) thereby calculates a risk score based on the number of rules that were triggered, the relative severity of the rules that were triggered, the TTP tags associated with the Sigma rules that were triggered, etc. Although not shown, the Sigma risk scoring module 258 also normalizes the risk score and provides explanations about the underlying calculations.

[0113] Watch now Figure 2D , the anomaly detection node 214 is used to form an anomaly risk scoring module 276, which has a component configured to also generate a risk score for the current situation (e.g., event) being experienced. Figure 2B Historical risk scoring module 240 and Figure 2C Compared to the sigma risk scoring module 258 of the present invention, here the anomaly risk scoring module 276 is configured to generate a risk score based on whether the details associated with the current situation deviate from the expected outcome. For example, the anomaly risk scoring module 276 can implement an unsupervised machine learning module 282, which is configured to detect anomalies in the received alert data and generate a numerical score representing the relative amount that a given alert deviates from the majority of the data. It can be seen that the machine learning module 282 can be initially trained using a historical alert data set so that it can make predictions for newly received alerts, for example, as will soon become apparent.

[0114] As shown, SIEM alerts 242 and / or EDR alerts 244 are received at the adjudicator 246 of the anomaly risk scoring module 276. As described above, in some implementations, the same alerts 242, 244 may be received at each risk scoring module. Thus, at least some of the SIEM alerts 242 and / or EDR alerts 244 received at the anomaly risk scoring module 276 may be received at the same risk scoring module as the SIEM alerts 242 and / or EDR alerts 244 received at the anomaly risk scoring module 276. Figure 2B Historical risk scoring module 240 and / or Figure 2C The same alerts are received at the Sigma risk scoring module 258 of FIG. In other aspects, different types of alerts may be directed to specific ones of the scoring modules.

[0115] As described above, the arbiter 246 can be used to keep different types of alerts separate, and can also keep a record of received alerts (e.g., in a lookup table). From the arbiter 246, the received SIEM and EDR alerts are provided to another topic module 278. As described above, the module 278 can be used to extract topic information from each alert received, thereby providing insight into how each alert affects the system. In some scenarios, these topics can be stored in memory, while in other scenarios, the extracted topic information can be provided to the endpoint 289, for example, as will soon become apparent.

[0116] Thus, during the data preparation phase, the referee 246 can clean the alerts and corresponding data. In other words, the referee 246 can be configured to clean, preprocess, and extract features from received alerts. In addition to cleaning newly received alerts during the prediction phase, this process can also be applied to the training data set during the modeling phase. Thus, the alert data output by the referee 246 can be ready for modeling and prediction.

[0117] The referee 246 also sends the received alerts to the memory 280 for storage. Thus, alerts and related information can be accumulated in the memory 280 over time to form a comprehensive understanding of past alerts and how the system is ultimately affected after receiving different alerts. This historical information can also be provided to the machine learning module 282. As described above, the machine learning module 282 can initially be trained using a historical alert data set so that the module 282 is configured to evaluate newly received alerts and make predictions about how the system will be affected thereby.

[0118] For example, three different classifiers 283, 284, 285 are used to evaluate the received information. During the training phase, the historical data received from the memory 280 can be evaluated by the classifiers 283, 284, 285 to determine how it affects the system performance. For example, a different machine learning algorithm can be implemented by each of the classifiers 283, 284, 285. According to the example, the classifiers 283, 284, 285 can respectively implement the isolation forest, the autoencoder, and the elliptical envelope algorithm. Therefore, each of the classifiers 283, 284, 285 can be trained to implement a unique model on the prepared data set. It can be seen that the generated score can be transformed into the same probability interval [0, 1], where 0 (zero) corresponds to the absolute normality of the alarm and 1 (one) corresponds to the absolute abnormality of the alarm.

[0119] The outputs from the classifiers 283, 284, 285 can be used by the decision module 286 to generate an alignment score. The scoring module 287 can also use these alignment scores to calculate a single anomaly score for the current situation. According to some schemes, a single anomaly score can be calculated by simply determining the mean (average) value of the alignment scores. In other schemes, the scoring module 287 can calculate the score by determining the median, maximum, weighted average, etc. The results from the scoring module 287 are output to the reasoning module 288, which can be used to evaluate the results generated. Therefore, the machine learning module 282 can be able to receive alarm information corresponding to a situation and use a pre-calculated scoring model to detect whether a given alarm is "abnormal" or "not abnormal", and assign a numerical score as a measure of the abnormality of the alarm, for example, as will be understood by those skilled in the art after reading this specification.

[0120] Thus, the trained machine learning model in the machine learning model 282 can be implemented at the endpoint 289 to identify anomalies in the received alarm data corresponding to the current situation. Therefore, the endpoint 289 may also be able to assign a corresponding anomaly score to each alarm received and / or the current overall situation. To achieve this, the alarm data can be formatted according to any data preparation stage specification. Thus, the result generated by the endpoint 289 can be a classification of whether each alarm corresponds to "anomaly" or "not anomaly", and an anomaly risk score corresponding thereto. In some scenarios, a higher score indicates a greater degree of anomaly in the alarm, but this is by no means intended to be limiting. On the contrary, in other scenarios, equivalent metrics may be applied when evaluating risk scores. For example, in some scenarios, a lower risk score indicates a greater degree of anomaly.

[0121] In addition, Figure 2E, the threat scoring node 211 is used to form a threat intelligence risk scoring module 290. As shown, the threat intelligence risk scoring module 290 (also referred to herein as an "IoC scoring module") includes a component configured to generate another risk score for quantifying the performance of the system in the current situation. This enrichment can be based on data provided by a threat intelligence service (TIS), which is able to utilize various data sources, for example, including internal security research, external threat feeds, third-party intelligence sources, etc. Based on the sources used, TIS can provide the latest cybersecurity trends related to specific IoCs in the form of intelligence reports. Given the ability to collect the latest threat reports across many systems, the enrichment provided by the TIS risk scoring engine will further process each intelligence report and calculate a score (value). The score can be set between two limits according to the scheme. According to one example, the score can be calculated so that the value is between 0 and 1.

[0122] As shown, SIEM alerts 242 and / or EDR alerts 244 are received at an adjudicator 246 of a threat intelligence risk scoring module 290. As described above, the adjudicator 246 can be used to keep different types of alerts separate, and can also keep a record of received alerts (e.g., in a lookup table). From the adjudicator 246, the received SIEM and EDR alerts are provided to another topic module 291. As described above, the module 291 can be used to extract topic information from each alert received, thereby providing insight into how each alert affects the system. In some scenarios, these topics can be stored in memory, while in other scenarios, the extracted topic information can be provided to the endpoint 292 for evaluation.

[0123] In addition, endpoint 292 may implement one or more of the machine learning models formed in processing module 293. Specifically, processing module 293 includes observation module 294, which is configured to examine operating conditions and identify unexpected situations. For example, observation module 294 can be configured to examine incoming observable detection information and identify IoCs therein. The IoCs identified and extracted by observation module 294 may depend on the data fields passed. Depending on the type of alert received (e.g., EDR or SIEM), certain combinations of IoCs may be required. For example, the IoCs identified and extracted by observation module 294 may include external Internet Protocol (IP) addresses, MD5 hash values, SHA256 hash values, URL addresses, etc.

[0124] In response to identifying an IoC, the IoC may be sent to the TIS module 295 using a threat intelligence-based risk scoring module. For example, the IoC may be sent to the TIS module 295 in the form of an enriched query. The TIS module 295 may investigate each original report received with the IoC to determine the ratio of a series of positive detection reports that have been identified. In addition, due to the breadth of the TIS module 295, the detected reports may be generated by a large number of security technologies including antivirus software and intrusion detection systems. Therefore, in addition to calculating the detected report ratio, the threat intelligence-based risk scoring may also take the latest scan date to determine how up-to-date (or out-of-date) the severity of the threat report is.

[0125] The assessed information is sent from the TIS module 295 to the machine learning module 296 for further assessment. For example, the risk scoring engine 297 in the machine learning module 296 can use the calculated ratio and the latest scan date of a given IoC and apply a time decay equation to determine the relative overall risk of the IoC across multiple threat intelligence sources. Once each IoC has been assessed and a risk score has been determined, the risk score synthesis module 298 combines the risk scores to create a combined risk score for the current situation. In some scenarios, the combined risk score will be the maximum score of all IoCs identified by the TIS module 295. In addition, the embedded risk reasoning module 299 can be used to provide detailed explanations of the risk calculations and components generated by the risk scoring engine 297 and / or the risk score synthesis module 298.

[0126] Final Reference Figure 2F , the cumulative risk scoring node 219 is used to form a cumulative risk scoring module 271. As shown, risk-based information is received at a cumulative risk scoring endpoint 273 of the cumulative risk scoring module 271. Depending on the method, the risk-based information received at the cumulative risk scoring module 271 may include scored SIEM alerts, scored EDR alerts, user-defined weights for different alerts, a list of equivalent enrichment options, a list of enrichment options to be considered when forming a cumulative risk score, etc.

[0127] The cumulative risk score endpoint 273 can thereby evaluate the risk-based information received and determine the understanding of the corresponding situation and whether it is expected to cause performance issues. From the cumulative risk score endpoint 273, the request (e.g., payload) is sent to the interface pipeline 275 for processing. As shown, the interface pipeline 275 includes trained model weights, a weighted average risk score, and a final cumulative risk score. Therefore, the various weights, risk scores, cumulative risk scores, etc. evaluated in the interface pipeline 275 can be generated in response to the payload provided by the cumulative risk score endpoint 273. Therefore, the interface pipeline 275 returns the cumulative risk score to the cumulative risk score endpoint 273 for implementation.

[0128] Thus, the cumulative risk scoring module 271 can receive a set of enrichment service results and combine them into a single cumulative score, thereby reducing computational overhead and allowing the severity of an alert to be quickly determined. In addition, the severity of an alert is expressed relative to other alerts. As described above, this desirably allows more severe (e.g., threatening) alerts to be processed before less severe alerts.

[0129] To achieve this, the cumulative risk scoring module 271 can effectively serve as an inference layer for generating the final cumulative risk score for a newly received alert. The inference layer can first calculate a weighted score over all available enrichments. The model also calculates a cumulative risk score by taking the maximum value of the weighted scores, all deterministic enrichments, and any enrichments for which no learned weights exist.

[0130] In one example, the performance of the cumulative risk scoring module 271 was further evaluated using the point biserial correlation (PBC) statistic. This statistic measures the correlation between a numerical variable (e.g., model prediction) and a categorical variable (e.g., alarm state or target). Through this evaluation, the inventors were able to determine that the final cumulative risk score had a PBC statistic of 0.77, indicating a strong and desirable correlation between the predictions made by the model described herein and the target variable.

[0131] To achieve this, the cumulative risk scoring module 271 can implement information collected by the training layer. The training layer can use algorithms to evaluate incoming information, such as a random forest classifier algorithm, a permutation importance algorithm, and the like. The training layer uses these algorithms to learn appropriate weights for different individual scores. For example, a random forest classifier algorithm can be used to ensure that the individual scores are able to make meaningful predictions about the overall outcome of the alert. Permutation importance algorithms can also be used to calculate individual weights for each individual score. These algorithms evaluate the reduction in model scores when individual feature values ​​are randomly shuffled. This process breaks the relationship between features and targets, so a drop in model scores can indicate the extent to which the model depends on a given feature. As a result, the importance of a feature (i.e., an individual enrichment score) can be used as an indicator of the weight to be assigned to it.

[0132] Reference now Figure 3A , shows a flow chart of a method 300 for providing a comprehensive and accurate assessment of potential threats based on current operating conditions according to one approach. The method 300 may be implemented according to the present invention in Figure 1-2F For example, one or more operations in method 300 may be performed by Figure 2A 202 (e.g., the machine learning model application layer 208). In addition, as will be understood by those skilled in the art upon reading this specification, the method 300 may include more Figure 3A More or fewer operations may be performed as specifically described in .

[0133] Each step of method 300 may be performed by any suitable component of the operating environment using known techniques and / or techniques that will become apparent to those skilled in the art upon reading this disclosure. For example, in various embodiments, method 300 may be performed in part or in whole by a controller (e.g., Figure 2A Controller 230), processor (e.g., Figure 2A The method 300 may be performed by a processor 224 of a processor 224 or some other device having one or more processors therein. A processor (e.g., a processing circuit, a chip, and / or a module) implemented in hardware and / or software and preferably having at least one hardware component may be used in any device to perform one or more steps of the method 300. Illustrative processors include, but are not limited to, a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), etc., combinations thereof, or any other suitable computing device known in the art.

[0134] like Figure 3AAs shown, operation 302 of method 300 includes detecting a first event with an increased risk of causing a system error. As described above, ATPS can be used to detect certain events (e.g., such as network security events) that may cause problems in the system and assess the threats they pose to the underlying system. Therefore, operation 302 may include detecting a current network security event that is prone to cause network security-related problems in the system. With respect to this specification, a "current network security event" may include a real-time (e.g., at least near real-time) event that may potentially affect the confidentiality, integrity, or availability of information assets belonging to an organization. A non-exclusive list of examples includes detecting malware in a computer system, receiving an incorrect login attempt from a user, receiving a request to perform a predetermined type of operation, and the like. It can be seen that the severity of the network security events being experienced and detected may vary depending on the scenario.

[0135] Some schemes may even generate an assessment of the event that may be used to guide corrective actions that are performed to overcome the experienced cybersecurity event. Thus, in response to detecting a first event having an increased risk of causing a system error, method 300 proceeds to operation 304. There, operation 304 includes causing a historical risk score to be generated for the detected event. As described above, the process of generating a historical risk score for a given event includes using a machine learning model. For example, a trained machine learning model may be configured to compare a current cybersecurity event to historical (e.g., previous) events. Thus, operation 304 may include providing a historical risk scoring module (e.g., see Figure 2B The historical risk scoring module 240 sends one or more instructions.

[0136] By comparing the current cybersecurity event to previous events, the machine learning model may be able to identify similarities between them. Furthermore, these similarities may be used to identify the relative risk associated with the current cybersecurity event that caused the system problem. Thus, a historical risk score may be determined based at least in part on the comparison between the current cybersecurity event and historical events. Furthermore, actions taken in response to historical events and the resulting impacts on the system may be used to determine the relative risk of the current cybersecurity event, for example, as will be understood by those skilled in the art after reading this specification.

[0137] In some aspects, comparing a cybersecurity event to a historical (e.g., previous) cybersecurity event includes comparing specific features of the different events. For example, log severity scores, model upgrade probabilities, rarity scores, observability scores, and other features (e.g., values) of the events can be compared to identify any similarities between them.

[0138] In addition, some schemes involve determining a historical risk score by applying time decay to historical cybersecurity events and corresponding responses. Time decay is preferably used to assign higher importance to more recent (e.g., relevant to the current event) historical events and responses, while assigning lower importance to events and responses from further in the past.

[0139] Return to Figure 3A , method 300 proceeds from operation 304 to operation 306. There, operation 306 includes causing a sigma rule detection score to be generated for the detected event. As described above, the process of generating a sigma rule detection score for a given event involves evaluating a plurality of predetermined rules and how the cybersecurity event affects those rules. For example, a plurality of predetermined sigma rules may be accumulated and compared to the operating conditions resulting from the experienced cybersecurity event. Thus, operation 306 may include providing a sigma risk scoring module (e.g., see Figure 2C The Sigma Risk Scoring Module 258 sends one or more instructions.

[0140] The process of generating a Sigma rule detection score for a cybersecurity event involves identifying the number of rules that were triggered (e.g., violated) as a result of the cybersecurity event. In some implementations, the rules that have been triggered can be determined by examining tactics, techniques, and procedures (TTP) tags. These TTP tags can include patterns of behavior, methods, or activities used by a threat actor or group of threat actors.

[0141] Therefore, the sigma rule detection score can be adjusted based on the severity of the rules that have been identified as being triggered by the event. For example, the sigma rule detection score can increase as the number of rules that have been triggered increases. Similarly, the sigma rule detection score can increase as the severity of the triggering rule increases. In addition, the sigma rule detection score can decrease as the number and / or severity of the triggering rules decreases. In some cases, the determined sigma rule detection score can be further normalized. The normalized sigma rule detection score can produce an explanation that summarizes the underlying calculations, for example, as will be understood by those skilled in the art after reading this specification.

[0142] Figure 3A Method 300 is further depicted proceeding from operation 306 to operation 308. There, operation 308 includes causing an anomaly risk score to be generated for the detected event. As described above, the process of generating an anomaly risk score for a given event involves determining whether there are any anomalies in the information associated with the cybersecurity event. For example, operational details associated with the cybersecurity event may be examined and compared to expected (e.g., average) values ​​to determine whether any anomalies have been experienced. Thus, operation 308 may include sending one or more instructions to an anomaly risk scoring module (e.g., see Figure 2D Abnormal risk scoring module 276).

[0143] Again, the information associated with the cybersecurity event is preferably examined to determine whether any deviation from expected performance has occurred. In response to identifying anomalies in the examined information, a numerical value is determined for each anomaly that indicates the amount by which the corresponding anomaly deviates from the majority (e.g., the remaining portion) of the information associated with the cybersecurity event. Thus, the greater the anomaly deviates from expected performance, the greater the corresponding numerical value may be. Similarly, the closer the anomaly is to expected performance, the smaller the numerical value may be. Thus, these numerical values ​​may be used as anomaly risk scores for cybersecurity events, for example, as described above with respect to Figure 2A and Figure 2D As described.

[0144] also, Figure 3A Method 300 proceeds from operation 308 to operation 310, which includes causing an IoC score to be generated for the detected event. As described above, the process of generating an IoC score for a given event involves examining information associated with the cybersecurity event and determining whether any IoCs are included therein. In addition, the IoCs identified and extracted may depend on the data fields received. Depending on the type of alert received (e.g., EDR or SIEM), certain combinations of IoCs may be required. For example, the identified and extracted IoCs may include external Internet Protocol (IP) addresses, MD5 hash values, SHA256 hash values, URL addresses, etc. Next, operation 310 may include providing a threat intelligence risk scoring module (e.g., see Figure 2E The threat intelligence risk scoring module 290) sends one or more instructions.

[0145] Thus, the process of generating an IoC score for a cybersecurity event involves examining information associated with the cybersecurity event. In response to identifying one or more types of IoCs in the information, the identified IoCs may be compared to information associated with historical (e.g., previous) cybersecurity events. It should also be noted that the one or more types of IoCs identified in the information are determined based on the type of cybersecurity event detected.

[0146] Again, by comparing the current event to events that occurred in the past, the method 300 can proactively respond to the cybersecurity event with a confidence level based on the identified similarities to past events. Thus, the IoC score can be based at least in part on the identified overlap of information associated with historical cybersecurity events, for example, as will be understood by those skilled in the art after reading this specification.

[0147] Still reference Figure 3A, operation 312 of method 300 also includes using a machine learning model to evaluate the generated score. In other words, operation 312 includes using one or more trained machine learning models to evaluate historical risk scores, sigma rule detection scores, anomaly risk scores, IoC scores, and / or combinations thereof. In addition, operation 314 includes using the machine learning model to create a composite risk score. As described above, a composite risk score can be determined based on a cybersecurity event, the composite risk score containing historical risk scores, sigma rule detection scores, anomaly risk scores, IoC scores, or any other desired information. Therefore, operations 312 and 314 may include providing a cumulative risk scoring module (e.g., see Figure 2F The cumulative risk scoring module 271 sends one or more instructions.

[0148] See also Figure 3B , according to one approach, shows an exemplary sub-operation of evaluating different risk scores and creating a comprehensive risk score. Figure 3B One or more of the sub-operations in the sub-operation can be used to perform Figure 3A Operation 312 and / or operation 314. However, it should be noted that Figure 3B The sub-operations of are shown according to one approach, which is by no means intended to limit the present invention.

[0149] As shown, sub-operation 320 includes generating a weighted value for each generated score. In other words, sub-operation 320 includes generating weighted values ​​for the historical risk score, sigma rule detection score, anomaly risk score, and IoC score determined in method 300. As described above, different weighted values ​​may be applied to different types of risk scores.

[0150] For example, one or more machine learning models have been trained to apply weights to each type of risk score. In some scenarios, the weights are predetermined (e.g., by a user) for each of the different types of risk scores. Thus, in some scenarios, the process of generating a weighted value for a risk score may simply involve referencing a lookup table. In other scenarios, a request may be sent to a user, a running application, a machine learning model, etc. to generate the weighted values.

[0151] According to some schemes, the weighted value of a given risk score can be determined by identifying the amount by which the given score changes in response to a single feature value being randomly shuffled. In other words, the machine learning model evaluates the amount by which the model score decreases in response to a single feature value being randomly shuffled. This process effectively breaks the relationship between the feature and the target. Thus, the decrease in the model score indicates the amount by which a given model depends on the feature. Therefore, the importance of a feature (e.g., an "individual enrichment score") can be used as an indicator of the appropriate weight that should be assigned to the risk score given the current situation.

[0152] Thus, in some scenarios, risk scores can be weighted by evaluating the received information and comparing certain portions to each other and / or to historical information associated with previous performance. As a result, a prediction can be made about the extent to which a given situation is predicted to affect system performance. The evaluation and prediction can also be used to generate an accurate understanding of what risk different situations (such as cybersecurity attacks) pose to the entire system and / or specific portions thereof.

[0153] Proceeding to sub-operation 322, the weighted values ​​are applied to the corresponding generated scores. In other words, sub-operation 322 includes applying the weighted values ​​to each of the corresponding historical risk scores, sigma rule detection scores, anomaly risk scores, and IoC scores. In addition, sub-operation 324 includes combining the weighted scores to form a composite risk score, and sub-operation 326 includes outputting the composite risk score to the intended target location. Therefore, the composite risk score can be weighted in some scenarios to emphasize certain risk scores and / or reduce the impact of other risk scores, for example, depending on the current situation the system is experiencing. In addition, a machine learning model used to create the composite risk score or any portion thereof can be trained using a random forest classifier and / or a permutation importance algorithm to generate weighted values ​​for each of the historical risk score, sigma rule detection score, anomaly risk score, and IoC score, for example, as will be understood by those skilled in the art after reading this specification.

[0154] Now return to Figure 3A , it follows that method 300 has been able to improve the efficiency of real-time assessment and response to (e.g., overcoming) events such as cybersecurity events. As described above, machine learning models are trained using information corresponding to previously experienced cybersecurity events. In addition, these machine learning models can be used to assess cybersecurity events as they occur.

[0155] Therefore, the implementation of this article can provide an intelligent system that can use artificial intelligence to automatically evaluate events and calculate the comprehensive risk of network security based on different indicators (including historical risks). Therefore, the system of this article is dynamic enough to add new risk indicators and remove redundant risk indicators. The implementation of this article can also apply appropriate weights to each risk score. Therefore, the scheme of this article can ensure a more efficient and effective security response to potentially harmful events. This can significantly minimize the risk of network security threats to computer systems and networks.

[0156] It can be seen that, in stark contrast to the shortcomings of conventional products, the implementation of this article is able to provide a comprehensive and accurate assessment of potential security threats. For example, ATPS can be used to detect unexpected (e.g., network security) events that occur and assess the threats they pose to the underlying system. Some solutions can even generate an assessment of the event, which can be used to guide corrective actions that are performed to overcome the experienced network security events. In other words, the solutions of this article can develop an understanding of events that affect the system's settings (e.g., network security), and use this understanding to efficiently respond to situations and restore the system's operational efficiency. Trained machine learning models can be used to develop an understanding of events that contribute to network security events.

[0157] It should also be noted that although various schemes have been described herein in the context of network security events, the same or similar processes may be applied to other types of events experienced.For example, any of the methods herein may be implemented in the process of performing endpoint security monitoring at a user device.

[0158] According to an example in use (which is by no means intended to limit the invention), the OpenShift deployment architecture may include a model training component and a model serving component. Both the training and serving components are deployed as OpenShift operators, which can be decomposed into a set of multi-container services responsible for the complex instantiation and management of the entire ATPS system. The process involves automating the deployment, configuration, scaling, and monitoring of the different components of the system in a way that allows the different components of the system to work seamlessly together to provide the desired functionality.

[0159] In addition, machine learning models can be served in a scalable manner through a remote procedure call (RPC) interface for remote procedure calls (e.g., such as gRPC). This allows efficient serialization and deserialization of complex data types and enables the possibility of processing a large number of requests in real time. In these schemes, the service operator automatically scales the container group (pod) horizontally to accommodate the request volume based on the observed CPU utilization. A framework can also be selected for the serving model, which preferably simplifies the large-scale deployment and management of multiple machine learning models, for example, such as Kubernetes deployments and / or stateful sets. In addition, it provides tools for managing the entire life cycle of machine learning models.

[0160] After each training process successfully completes, the corresponding microservice can be evaluated against promotion logic (e.g., a set of criteria for determining whether a model is acceptable for production). These criteria include performance and governance metrics to ensure that each promoted model is valid and fits the specific scenario (e.g., application). Users can create and dynamically change settings for each training microservice that are appropriate for their use case. After successful promotion, the model is pushed to cloud storage, where the service operator accesses the model.

[0161] In addition, the operator can deploy a user interface to provide a visual and interactive way for users (e.g., developers) to engage with the operator's backend components. This greatly simplifies complex workflows and reduces the cognitive load on users. In addition, it provides users at different levels with access to specific capabilities of the training process, the ability to visualize the entire system, and a quick and effective way to triage the system as a whole in case of any problems. As a result, developers can quickly trigger training jobs and monitor application logs without instantiating YAML custom resources at the OpenShift level, for example, as will be understood by those skilled in the art after reading this specification.

[0162] Reference now Figure 4 , shows a flow chart of a method 409 according to one solution. The method 409 can be performed according to the present invention. Figure 1-3B Of course, as those skilled in the art will appreciate upon reading this specification, method 409 may include more Figure 4 More or fewer operations may be performed as specifically described in .

[0163] Each step of method 409 may be performed by any suitable component of the operating environment. For example, in various scenarios, method 409 may be performed in part or in whole by a processing circuit (e.g., an IaC access manager) or some other device having one or more processors therein. A processor (e.g., a processing circuit, a chip, and / or a module) implemented in hardware and / or software and preferably having at least one hardware component may be used in any device to perform one or more steps of method 409. Illustrative processors include, but are not limited to, a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), etc., combinations thereof, or any other suitable computing device known in the art.

[0164] Although it should be understood that the process software associated with providing a comprehensive and accurate assessment of potential threats based on the current operating situation can be deployed by manually loading it directly into the client, server and agent computers via loading storage media such as CDs, DVDs, etc., the process software can also be automatically or semi-automatically deployed to the computer system by sending the process software to a central server or a group of central servers. The process software is then downloaded to the client computer that will execute the process software. Alternatively, the process software is sent directly to the client system via email. Then, by executing a set of program instructions that separate the process software into directories, the process software is separated into directories or loaded into directories. Another option is to send the process software directly to a directory on the client computer hard drive. When there is a proxy server, the process will select the proxy server code, determine which computers to place the proxy server code, send the proxy server code, and then install the proxy server code on the agent computer. The process software will be sent to the proxy server and then stored on the proxy server.

[0165] Continuing with reference to method 409, step 400 begins the deployment of the process software. The initial step is to determine if there are any programs that will reside on one or more servers when the process software is executed (401). If this is the case, the server that will contain the executable file is identified (509). The process software for the one or more servers is transferred directly to the storage device of the server via FTP or some other protocol or by copying using a shared file system (510). The process software is then installed on the server (511).

[0166] Next, a determination is made as to whether the process software is to be deployed by having a user access the process software on one or more servers (402). If the user is to access the process software on a server, the server address where the process software will be stored is identified (403).

[0167] A determination is made as to whether to build (500) a proxy server to store the process software. A proxy server is a server that sits between a client application such as a web browser and the real server. It intercepts all requests to the real server to see if it can satisfy the request itself. If not, it forwards the request to the real server. Two main advantages of a proxy server are improved performance and filtering requests. If a proxy server is needed, the proxy server is installed (501). The process software is sent to the server(s) via a protocol such as FTP, or it is copied directly from the source file to the server file via file sharing (502). Another approach involves sending a transaction to the server(s) containing the process software and having the server process the transaction, then receiving the process software and copying it to the server's file system. Once the process software is stored on the server, the user accesses the process software on the server through their client computer and copies the file system to their client computer (503). Another approach is to have the server automatically copy the process software to each client and then run an installer for the process software on each client computer. The user executes a program to install the process software on the client computer (512) and then exits the process (408).

[0168] In step 404, a determination is made as to whether the process software is to be deployed by sending the process software to the users via email. The group of users to whom the process software is to be deployed is identified (405) along with the addresses of the user client computers. The process software is sent to each user's client computer via email (504). The user then receives the email (505) and then detaches the process software from the email to a directory on his or her client computer (506). The user executes a program to install the process software on the client computer (512) and then exits the process (408).

[0169] Finally, it is determined whether the process software will be sent directly to the user's directory on their client computer (406). If so, the user directory is identified (407). The process software is transferred directly to the user's client computer directory (507). This can be done in several ways, such as but not limited to sharing a file system directory and then copying from the sender's file system to the receiving user's file system, or alternatively, using a transfer protocol such as File Transfer Protocol (FTP). The user accesses a directory on their client file system to prepare for the installation of the process software (508). The user executes a program that installs the process software on the client computer (512) and then exits the process (408).

[0170] It will be apparent that the various features of the foregoing systems and / or methods may be combined in any manner, creating multiple combinations from the description presented above.

[0171] It should also be appreciated that implementations of the present invention may be provided as a service deployed on behalf of a client to provide services on demand.

[0172] The description of various embodiments of the present invention has been presented for the purpose of illustration, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the implementation, practical application or technical improvement over technology found in the marketplace, or to enable those of ordinary skill in the art to understand the implementation disclosed herein.

Claims

1. A computer-implemented method comprising, in response to detecting a current network security event: enabling generation of a historical risk score for the current cybersecurity event; Generate a Sigma rule detection score for the current network security event; Generating an abnormal risk score for the current network security event; causing a compromise indicator (IoC) score to be generated for the current network security event; and Use machine learning models to: evaluating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score, and A comprehensive risk score corresponding to the current network security event is created, wherein the comprehensive risk score includes the historical risk score, the Sigma rule detection score, the abnormal risk score, and the IoC score.

2. The computer-implemented method of claim 1 , wherein: Generating the historical risk score for the current network security event includes: comparing the current cybersecurity event with historical cybersecurity events using a second machine learning model; and The historical risk score is determined based at least in part on the comparison and a corresponding response to the historical cybersecurity event.

3. The computer-implemented method of claim 2, wherein: Determining the historical risk score includes: Time decay is applied to the historical cybersecurity events and the corresponding responses.

4. The computer-implemented method of claim 1 , wherein: Generating the sigma rule detection score for the current network security event includes: identifying a number of rules that have been triggered due to the current cybersecurity event; determining a risk score based at least in part on the number of rules that were triggered; and The determined risk scores were normalized.

5. The computer-implemented method of claim 1 , wherein causing the anomaly risk score to be generated for the current cybersecurity event comprises: Checking information associated with the current cybersecurity incident; identifying anomalies in said information; as well as A numerical value is determined for each of the anomalies, the numerical value indicating an amount by which the corresponding anomaly deviates from the majority of information associated with the current network security event.

6. The computer-implemented method of claim 1 , wherein causing the IoC score to be generated for the current cybersecurity event comprises: Checking information associated with the current cybersecurity incident; Identifying one or more types of IoCs in the information; Comparing the identified IoCs with information associated with historical cybersecurity incidents; and determining the IoC score based at least in part on an overlap between the identified IoC and the information associated with the historical cybersecurity events, The one or more types of IoC identified in the information are determined based on the current network security event.

7. The computer-implemented method of claim 1 , wherein: Using the machine learning model to create the composite risk score includes: generating a weighted value for each of: the historical risk score, the Sigma rule detection score, the anomaly risk score, and the IoC score; applying the weighted values ​​to the corresponding historical risk scores, sigma rule detection scores, anomaly risk scores, and IoC scores; and The weighted historical risk score, the weighted Sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score are combined to form the comprehensive risk score.

8. The computer-implemented method of claim 7, wherein: The machine learning model is trained using a random forest classifier and / or a permutation importance algorithm to generate a weighted value for each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score.

9. The computer-implemented method of claim 1 , wherein: The operations are performed by an advanced threat prioritization system having a historical risk scoring module configured to generate the historical risk score, a sigma rule detection scoring module configured to generate the sigma rule detection score, an anomaly risk scoring module configured to generate the anomaly risk score, and an IoC scoring module configured to generate the IoC score.

10. The computer-implemented method of claim 2, wherein: Comparing the current cybersecurity event to the historical cybersecurity event includes comparing features selected from the group consisting of: a log severity score, a model upgrade probability, a rarity score, and an observability score.

11. A computer-implemented method comprising: Train the machine learning module by: collecting information associated with (i) different types of cybersecurity events experienced over time and (ii) actions taken in response to respective cybersecurity events experienced, and examining the collected information to develop a comprehensive understanding of the risks associated with the different types of cybersecurity incidents; as well as Use the trained machine learning model to: Assess newly received cybersecurity incidents, and Generates historical risk scores for corresponding new cybersecurity events.

12. A computer-implemented method comprising: The machine learning model is trained to generate a composite risk score for a cybersecurity incident by training the machine learning model to: generating a weighted value for each of the following: historical risk score, sigma rule detection score, anomaly risk score, and IoC score; Applying weighted values ​​to the corresponding historical risk scores, sigma rule detection scores, anomaly risk scores, and IoC scores; and The weighted historical risk score, the weighted Sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score are combined to form the comprehensive risk score.

13. A computer program product, comprising a computer-readable storage medium having program instructions embodied therewith, the program instructions being readable by a processor, executable by the processor, or readable and executable by the processor, so as to cause the processor to perform the method according to any one of claims 1-12.

14. An advanced threat prioritization system comprising: processor; as well as Logic, the logic is integrated with the processor, can be executed by the processor, or is integrated with the processor and can be executed by the processor, the logic is configured to perform the method according to any one of claims 1-12.

Images