Computer-implemented method, computer program and advanced threat prioritization system (selectively prioritizing alert received for advanced cybersecurity threat prioritization system)

Abstract

To solve the problem in which computer systems and networks face various types of events over time.SOLUTION: A computer-implemented method according to one approach includes a step of generating a historical risk score for a current cybersecurity event in response to detection of the current cybersecurity event. A sigma rule detection score is also generated for the current cybersecurity event, in addition to an anomaly risk score that is generated for the current cybersecurity event. An IoC score is further generated for the current cybersecurity event. A machine learning model is used for evaluating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. The machine learning model is also used for creating a consolidated risk score corresponding to the current cybersecurity event, the consolidated risk score incorporating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score.SELECTED DRAWING: Figure 3A

Description

[Technical field]

[0001] The present invention relates to evaluating alerts received for a system, and more particularly to providing a comprehensive and accurate assessment of potential threats based on the current operating conditions of the system. [Background technology]

[0002] The development of the Internet and wireless networking standards (such as Bluetooth® and Wi-Fi®) has led to the proliferation of computer systems. Additionally, improvements in processing power and functionality have led to the adoption and development of smart devices, such as, for example, smartphones, televisions, tablets, and other devices within the Internet of Things (IoT).

[0003] Furthermore, electronic source material has numerous benefits compared to physical documents. For example, electronic documents are easier to store and access compared to physical documents. Whereas accessing a physical document involves manually searching each document in the oeuvre until the desired document is found, multiple electronic documents can be automatically compared against one or more keywords. Also, electronic documents can be uploaded from and / or downloaded to any device connected to a network, whereas tangible documents (e.g., papers) must be physically transported between multiple locations. Similarly, electronic documents occupy much less space than their physical counterparts. Summary of the Invention [Problem to be solved by the invention]

[0004] In view of these benefits, a greater amount of physical materials have been digitized. This digital transformation improves data storage and data accessibility, but also increases the importance of maintaining cybersecurity (e.g., computer security). Cybersecurity involves the protection of computer systems and networks from attacks by malicious actors. Depending on the type of computer system and / or network affected, cybersecurity attacks can result in unauthorized disclosure of information, damage to hardware and / or software, corruption of data, etc. Although several platforms have been established to protect computer systems and networks from such attacks, threats are constantly evolving. This causes computer systems and networks to face different types of events over time. [Means for solving the problem]

[0005] A computer-implemented method according to one approach includes generating a historical risk score for the cyber security event in response to detecting the cyber security event. In addition to the anomaly risk score generated for the cyber security event, a sigma rule detection score is also generated for the cyber security event. An indicator of compromise (IoC) score is further generated for the cyber security event. A machine learning model is used to evaluate the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. The machine learning model is also used to create an integrated risk score corresponding to the cyber security event that incorporates the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score.

[0006] According to another approach, a computer program product includes a computer-readable storage medium having program instructions embodied therein, the program instructions being readable by a processor, executable by a processor, or readable and executable by a processor to cause the processor to perform the above-described method in response to detecting a cyber-security event.

[0007] Another approach is an advanced threat prioritization system that includes a processor and logic integrated with, executable by, or integrated with and executable by the processor, the logic configured to perform the method described above in response to detecting a cyber-security event.

[0008] Another approach to a computer-implemented method includes training a machine learning module. The machine learning model is trained by collecting information associated with (i) different types of cybersecurity events that have occurred over time and (ii) actions taken in response to each of the occurred cybersecurity events. The collected information is further examined to establish a comprehensive understanding of risks associated with the different types of cybersecurity events. The trained machine learning model is then used to evaluate newly received cybersecurity events. As a result, the trained machine learning model can generate a historical risk score for each new cybersecurity event.

[0009] According to yet another approach, a computer-implemented method includes training a machine learning model to generate an integrated risk score for a cybersecurity event. This involves training the machine learning model to generate weighting values ​​for each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. The machine learning model is further trained to apply weighting values ​​to each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. The weighted historical risk score, the weighted sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score are also combined by the machine learning model to form an integrated risk score.

[0010] Other aspects and implementations of the invention will become apparent from the following detailed description, which, when taken in conjunction with the drawings, illustrate by way of example the principles of the invention. [Brief description of the drawings]

[0011] [Figure 1] 1 is a diagram of a computing environment according to one approach.

[0012] [Figure 2A] FIG. 1 is a representative diagram of a distributed system having an Advanced Threat Prioritization System (ATPS) according to one approach.

[0013] [Figure 2B] FIG. 2B is a detailed view of one of the nodes in the ATPS of FIG. 2A according to one approach.

[0014] [Figure 2C] FIG. 2B is a detailed view of one of the nodes in the ATPS of FIG. 2A according to one approach.

[0015] [Figure 2D] FIG. 2B is a detailed view of one of the nodes in the ATPS of FIG. 2A according to one approach.

[0016] [Figure 2E] FIG. 2B is a detailed view of one of the nodes in the ATPS of FIG. 2A according to one approach.

[0017] [Figure 2F] FIG. 2B is a detailed view of one of the nodes in the ATPS of FIG. 2A according to one approach.

[0018] [Figure 3A] 1 is a flow chart of a method according to one approach.

[0019] [Figure 3B] 3B is a flowchart of a sub-process of one of the operations in the method of FIG. 3A according to one approach.

[0020] [Figure 4A] 1 is a flow chart of a method according to one approach. [Figure 4B] 1 is a flow chart of a method according to one approach. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0021] The following description is made for the purpose of illustrating the general principles of this invention and is not intended to limit the inventive concepts claimed herein. Moreover, particular features described herein can be used in combination with other described features, in each of the various possible combinations and permutations.

[0022] Unless otherwise specifically defined in this specification, all terms are to be given their broadest possible interpretation, including the meanings suggested by this specification and the meanings understood by a person of ordinary skill in the art and / or the meanings defined in dictionaries, treatises, etc.

[0023] It should also be noted that, as used in this specification and the appended claims, unless otherwise stated, the singular forms "a," "an," and "the" include plural referents. It will be further understood that, as used herein, the terms "comprises" and / or "comprising" specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0024] The following description discloses several preferred approaches for systems, methods and computer program products for providing a comprehensive and accurate assessment of potential threats based on current operating conditions. Implementations herein can generate assessments of events that can be used to direct corrective actions to be taken to overcome an undesirable (e.g., cybersecurity) event that is occurring. In other words, approaches herein can establish an understanding of events affecting a system and use that understanding to efficiently respond to the situation and restore operating efficiency to the system. For example, as described in more detail below, trained machine learning models can be used to establish an understanding of events that contributed to an undesirable event.

[0025] In one general approach, a computer-implemented method includes generating a historical risk score for a current cybersecurity event in response to detecting the current cybersecurity event. As described above, computer-based attacks pose a more significant threat to computer systems and networks. Also, as cybersecurity attacks are constantly evolving, a system that can identify different types of attacks and determine the order in which they should be addressed is increasingly desirable. Comparing the current cybersecurity event to past cybersecurity events and other events can allow for the identification of patterns and other similarities and provide insight into how the current cybersecurity event can be most effectively addressed.

[0026] The computer-implemented method also includes generating a sigma rule detection score for the current cybersecurity event. While comparing the current cybersecurity event to historical information may provide some insight, additional evaluation may be performed to determine how the current cybersecurity event has impacted the underlying system and / or how the current cybersecurity event should be overcome. For example, it is noted that "sigma rules" are intended to refer to a collection of rules used for threat detection and security monitoring. These rules are designed to provide a standardized format that may be used to search for patterns and indicators of compromise (IoCs) in log data, making potential security threats easier to detect. Additionally, these rules may be written to detect a variety of different security threats, including malware, phishing, credential theft, and the like.

[0027] The computer-implemented method also includes generating an anomaly risk score for the current cybersecurity event. In other words, evaluating the details of the current cybersecurity event may involve determining whether any values ​​are outside of expected ranges. The detected anomalies may provide insight into what contributed to the current cybersecurity event occurring. This information may further provide insight into how the current cybersecurity event may be addressed and overcome.

[0028] The computer-implemented method also includes generating an IoC score for the current cybersecurity event, which may be used to quantify the performance of the system in a current state, which may be based on data provided by a Threat Intelligence Service (TIS), which may leverage a variety of data sources, including internal security research, external threat feeds, third-party intelligence sources, etc.

[0029] The computer-implemented method also includes evaluating each of the generated scores using a machine learning model. In other words, the machine learning model is used to evaluate the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. These machine learning models can be trained to establish an understanding of events that contribute to a cybersecurity event. This understanding also enables the machine learning model to establish a more detailed understanding of how the cybersecurity event may be overcome.

[0030] As such, the computer-implemented method also includes using the machine learning model to create an integrated risk score. The integrated risk score is created based on the current cyber-security event and an integrated risk score incorporating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. The integrated risk score thereby provides an overview that can be used to determine how much the cyber-security event has impacted an underlying system and / or network.

[0031] In some implementations, generating a historical risk score for the current cybersecurity event includes comparing the current cybersecurity event to historical cybersecurity events using another machine learning model. As described above, comparing the current cybersecurity event to cybersecurity events and other events that have occurred in the past may enable identification of patterns and other similarities, which desirably provides insight into how the current cybersecurity event may be most effectively addressed. As a result, the historical risk score may be based at least in part on the comparison and corresponding responses to the historical cybersecurity event. In some implementations, comparing the current cybersecurity event to the historical cybersecurity event includes comparing a log severity score, a model escalation probability, a rare score, and / or an observable score.

[0032] In some implementations, determining the historical risk score includes applying time decay to the historical cybersecurity events and corresponding responses. Time decay is preferably used to assign greater importance to more recent (e.g., related to the current event) historical events and responses while assigning less importance to events and responses from the more distant past. Thus, more recent events may have a greater impact than events that occurred in the more distant past.

[0033] In some implementations, generating a sigma rule detection score for the current cyber security event includes identifying a number of rules that have fired as a result of the current cyber security event, and determining a risk score based at least in part on the number of rules that have fired. Again, these rules are designed to provide a standardized format that can be used to search for patterns and IoCs in the log data, making it easier to detect potential security threats.

[0034] In some implementations, generating a sigma rule detection score for the current cybersecurity event includes normalizing the determined risk score. Normalizing the risk score can aid in quantifying the risk score in comparison to other events. For example, a normalized risk score may be of the same units of measurement as other normalized risk scores, thereby improving the ability to compare risk scores.

[0035] In some implementations, generating an anomaly risk score for the current cyber-security event includes examining information associated with the current cyber-security event and identifying anomalies within the information. Again, the anomalies may point to portions of the information that are indicative of a source of the cyber-security event. These anomalies may then help direct a response to the cyber-security event.

[0036] In some implementations, generating an anomaly risk score for the current cyber-security event further includes determining a numerical value for each of the anomalies, preferably indicative of the amount by which the respective anomaly deviates from a majority of information associated with the current and / or previous cyber-security event, such that the severity by which the anomaly differs from an expectation can be used to determine how much the current cyber-security event will affect the system.

[0037] In some implementations, generating an IoC score for the current cybersecurity event includes examining information associated with the current cybersecurity event and identifying one or more types of IoCs within the information. Identifying the IoCs associated with the current cybersecurity event assists in quantifying the performance of the system in the current state. This may be based on data provided by a TIS, which may leverage a variety of data sources including internal security research, external threat feeds, third-party intelligence sources, etc. Additionally, the identified one or more types of IoCs within the information are determined based on the current cybersecurity event.

[0038] In some implementations, the identified IoCs are compared to information associated with historical cybersecurity events. Thus, an IoC score is determined based at least in part on the overlap between the identified IoCs and past events. Again, by comparing current information to historical records, patterns can be identified and used to conclude how to overcome the current cybersecurity event.

[0039] In some implementations, using the machine learning model to create the integrated risk score includes generating a weighting value for each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score, and the weighting value is applied to each of the respective scores.

[0040] Different weight values ​​may be applied to different types of risk scores. For example, one or more machine learning models trained to apply weights to each type of risk score. According to some approaches, weight values ​​may be determined for a given risk score by identifying the amount by which a given score changes in response to a single feature value being shuffled. In other words, the machine learning model evaluates the amount by which the model score decreases in response to a single feature value being randomly shuffled. This procedure effectively breaks the relationship between the feature and the target. Thus, the decrease in the model score indicates the amount by which a given model depends on the feature. As a result, the importance of the feature may be used as an indicator of the appropriate weight to be assigned to the risk score given the current situation. As a result, in some implementations, the weighted historical risk score, the weighted sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score are combined to form an integrated risk score.

[0041] In some implementations, the advanced threat prioritization system includes a historical risk score module configured to generate a historical risk score, a sigma rule detection score module configured to generate a sigma rule detection score, an anomaly risk score module configured to generate an anomaly risk score, and an IoC score module configured to generate an IoC score. Also, the machine learning model herein may be trained using a random forest classifier and / or a permutation importance algorithm to generate weight values ​​for each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. The training layer may use these algorithms to learn appropriate weights for different individual scores. For example, a random forest classifier algorithm may be used to ensure that the individual scores can make meaningful predictions regarding the overall outcome of the alert. Also, a permutation importance algorithm may be used to calculate individual weights for each of the individual scores.

[0042] In another general approach, a computer program product includes a computer-readable storage medium having program instructions embodied therein, the program instructions being readable by a processor, executable by a processor, or readable and executable by a processor to cause the processor to perform the aforementioned method in response to detecting a cyber-security event.

[0043] In yet another general approach, an advanced threat prioritization system includes a processor and logic integrated with, executable by, or integrated with and executable by the processor, the logic configured to perform the method described above in response to detecting a cyber-security event.

[0044] In another general approach, a computer-implemented method includes training a machine learning module. The machine learning model is trained by collecting information associated with (i) different types of cybersecurity events that have occurred over time and (ii) actions taken in response to each of the cybersecurity events that have occurred. The computer-implemented method also includes examining the collected information to establish a comprehensive understanding of the risks associated with the different types of cybersecurity events. Again, by comparing the current cybersecurity event with cybersecurity events and other events that have occurred in the past, it may be possible to identify patterns and other similarities while training the machine learning model. This desirably provides insight into how the current cybersecurity event may be most effectively addressed.

[0045] The computer-implemented method also includes using the trained machine learning model to evaluate newly received cybersecurity events and generate a historical risk score for each new cybersecurity event. As a result, some situations involve receiving a cybersecurity event that has not yet occurred, and the machine learning model can provide valuable insights, for example, by comparing the new event to events that have occurred in the past to perform correlations. This allows the machine learning model to efficiently evaluate and provide insights on how to respond to events as they occur in real time.

[0046] Yet another approach to the computer-implemented method includes training a machine learning model to generate a combined risk score for cybersecurity events. This involves training the machine learning model to generate weight values ​​for each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. Different weight values ​​may be applied to different types of risk scores. For example, one or more machine learning models trained to apply weights to each type of risk score. According to some approaches, the weight value may be determined for a given risk score by identifying the amount by which the given score changes in response to a single feature value being shuffled. In other words, the machine learning model evaluates the amount by which the model score decreases in response to a single feature value being randomly shuffled. This procedure effectively breaks the relationship between the feature and the target. Thus, the decrease in the model score indicates the amount by which a given model depends on the feature. As a result, the importance of the feature may be used as an indicator of the appropriate weight to be assigned to the risk score given the current situation. Consequently, in some implementations, the weighted historical risk score, the weighted sigma rule detection score, the weighted anomaly risk score and the weighted IoC score are combined to form an integrated risk score.

[0047] Thus, the computer-implemented method also includes training a machine learning model to apply weighting values ​​to each score. The weighted scores are also combined by the machine learning model to form an integrated risk score.

[0048] Various aspects of the disclosure are described by computer system descriptions, flowcharts, block diagrams, and / or block diagrams of machine logic included in a computer program product (CPP) implementation. For any flowchart, depending on the technology involved, operations may be performed in a different order than that shown in a given flowchart. For example, again depending on the technology involved, two operations shown in successive flowchart blocks may be performed in reverse order, as a single integrated step, simultaneously, or in an at least partially overlapping manner in time.

[0049] A computer program product (CPP) is a term used in this disclosure to describe any set of one or more storage media (also referred to as "media") collectively contained in a set of one or more storage devices that collectively contain machine-readable code corresponding to instructions and / or data for performing a computer operation specified in a given CPP claim. A "storage device" is any tangible device that can hold and store instructions for use by a computer processor. The computer-readable storage medium may be, but is not limited to, an electronic storage medium, a magnetic storage medium, an optical storage medium, an electromagnetic storage medium, a semiconductor storage medium, a mechanical storage medium, or any suitable combination of the foregoing. Some known types of storage devices that include these media include diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanically encoded devices (such as punch cards or pits / lands formed on the major surface of a disk), or any suitable combination of the foregoing. A computer-readable storage medium, as the term is used in this disclosure, is not to be construed as storage in the form of a temporary signal per se, such as electric waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide, light pulses passing through a fiber optic cable, electrical signals transmitted through wires, and / or other transmission media. As will be appreciated by those skilled in the art, data is typically moved at some infrequent time during normal operation of the storage device, such as during access, defragmentation, or garbage collection, but this does not make the storage device temporary since the data is not temporary while it is stored.

[0050] The computing environment 100 includes an example of an environment for the execution of at least some of the computer code involved in the execution of the method of the present invention, such as the improved alert response code in block 150 for providing a comprehensive and accurate assessment of a potential threat based on a current operating situation. In addition to block 150, the computing environment 100 includes, for example, a computer 101, a wide area network (WAN) 102, an end user device (EUD) 103, a remote server 104, a public cloud 105, and a private cloud 106. In this implementation, the computer 101 includes a processor set 110 (including processing circuitry 120 and cache 121), a communication fabric 111, a volatile memory 112, a persistent storage 113 (including the operating system 122 and block 150 identified above), a peripheral device set 114 (including a user interface (UI) device set 123, storage 124, and an Internet of Things (IoT) sensor set 125), and a network module 115. The remote server 104 includes a remote database 130. The public cloud 105 includes a gateway 140, a cloud orchestration module 141, a set of host physical machines 142, a set of virtual machines 143, and a set of containers 144.

[0051] Computer 101 may take the form of a desktop computer, a laptop computer, a tablet computer, a smartphone, a smartwatch or other wearable computer, a mainframe computer, a quantum computer, or any other form of computer or mobile device now known or later developed that can execute programs, access a network, or query a database, such as remote database 130. As is well understood in the field of computer technology, and depending on the technology, execution of a computer-implemented method may be distributed among multiple computers and / or among multiple locations. However, in this presentation of computing environment 100, in order to keep this presentation as simple as possible, the detailed discussion focuses on a single computer, specifically computer 101. Although computer 101 is not shown in the cloud in FIG. 1, it may be located in the cloud. However, computer 101 is not required to be in the cloud except to any extent that may be categorically indicated.

[0052] The processor set 110 includes one or more computer processors of any type now known or later developed. The processing circuitry 120 may be distributed across multiple packages, e.g., multiple tailored integrated circuit chips. The processing circuitry 120 may implement multiple processor threads and / or multiple processor cores. The cache 121 is memory located within the processor chip package and is typically used for data or code that should be available for fast access by threads or cores executing on the processor set 110. Cache memory is typically organized into multiple levels depending on relative proximity to the processing circuitry. Alternatively, some or all of the cache for a processor set may be located "off-chip." In some computing environments, the processor set 110 may be designed to operate with qubits and perform quantum computing.

[0053] Computer-readable program instructions are typically loaded onto the computer 101 to cause the processor set 110 of the computer 101 to execute a sequence of operational steps, thereby realizing a computer-implemented method, such that the instructions so executed instantiate the method specified in the flowcharts and / or descriptions of the computer-implemented methods contained herein (collectively, the "inventive methods"). These computer-readable program instructions are stored in various types of computer-readable storage media, such as the cache 121 and other storage media described below. The program instructions and associated data are accessed by the processor set 110 to control and direct the execution of the inventive methods. In the computing environment 100, at least some of the instructions for executing the inventive methods may be stored in the block 150 in the persistent storage 113.

[0054] Communications fabric 111 is the signal-conducting paths that allow various components of computer 101 to communicate with one another. Typically, this fabric is made up of switches and conductive paths, such as those that make up buses, bridges, physical input / output ports, and the like. Other types of signal communication paths, such as fiber optic and / or wireless communication paths, may be used.

[0055] Volatile memory 112 is any type of volatile memory now known or later developed. Examples include dynamic random access memory (RAM) or static RAM. Typically, volatile memory 112 is characterized by random access, although this is not required unless expressly indicated. In computer 101, volatile memory 112 is located in a single package and is internal to computer 101, although alternatively or additionally, volatile memory may be distributed across multiple packages and / or located external to computer 101.

[0056] Persistent storage 113 is any form of non-volatile storage for a computer, now known or later developed. The non-volatility of this storage means that the stored data is maintained regardless of whether power is provided to computer 101 and / or to persistent storage 113 directly. Persistent storage 113 may be read-only memory (ROM), but typically at least a portion of the persistent storage allows data to be written, data to be deleted, and data to be rewritten. Some well-known forms of persistent storage include magnetic disks and solid-state storage devices. Operating system 122 may take several forms, such as various known proprietary operating systems, or open source Portable Operating System Interface type operating systems that employ a kernel. The code contained in block 150 typically includes at least some of the computer code involved in carrying out the method of the present invention.

[0057] The peripheral device set 114 includes a set of peripheral devices of the computer 101. Data communication connections between the peripheral devices and other components of the computer 101 may be implemented in various manners, such as Bluetooth connections, Near-Field Communication (NFC) connections, connections made by cables (such as Universal Serial Bus (USB) type cables), insertion type connections (e.g., secure digital (SD) cards), connections made through local area communication networks, and even connections made through wide area networks such as the Internet. In various implementations, the UI device set 123 may include components such as display screens, speakers, microphones, wearable devices (such as goggles and smart watches), keyboards, mice, printers, touch pads, game controllers, and haptic devices. The storage 124 is external storage, such as an external hard drive, or insertable storage, such as an SD card. The storage 124 may be persistent and / or volatile. In some implementations, the storage 124 may take the form of a quantum computing storage device for storing data in the form of qubits. In implementations where computer 101 is required to have a large amount of storage (e.g., computer 101 stores and manages a large database locally), this storage may be provided by peripheral storage devices designed to store very large amounts of data, such as a storage area network (SAN) shared by multiple geographically distributed computers. IoT sensor set 125 is made up of sensors that may be used in Internet of Things applications. For example, one sensor may be a thermometer and another sensor may be a motion detector.

[0058] The network module 115 is a collection of computer software, hardware and firmware that enables the computer 101 to communicate with other computers over the WAN 102. The network module 115 may include hardware such as a modem or Wi-Fi signal transceiver, software for packetizing and / or depacketizing data for communication network transmission, and / or web browser software for communicating data over the Internet. In some implementations, the network control and network forwarding functions of the network module 115 are performed on the same physical hardware device. In other implementations (e.g., implementations utilizing software-defined networking (SDN)), the control and forwarding functions of the network module 115 are performed on physically separate devices such that the control function manages several different network hardware devices. Computer-readable program instructions for carrying out the methods of the present invention may be downloaded to the computer 101 from an external computer or external storage device, typically through a network adapter card or network interface included in the network module 115.

[0059] WAN 102 is any wide area network (e.g., the Internet) capable of communicating computer data over non-local distances by any technology for communicating computer data now known or later developed. In some implementations, WAN 102 may be replaced and / or supplemented by a local area network (LAN) designed to communicate data between devices located within a local area, such as a Wi-Fi network. WANs and / or LANs typically include computer hardware such as copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, and edge servers.

[0060] End-user device (EUD) 103 is any computer system used and controlled by an end user (e.g., a customer of the enterprise that operates computer 101) and may take any of the forms described above in connection with computer 101. EUD 103 typically receives useful and useful data from the operation of computer 101. For example, in a hypothetical case in which computer 101 is designed to provide recommendations to the end user, the recommendations would typically be communicated from network module 115 of computer 101, over WAN 102, to EUD 103. In this manner, EUD 103 can display or otherwise present the recommendations to the end user. In some implementations, EUD 103 may be a client device, such as a thin client, a heavy client, a mainframe computer, a desktop computer, and the like.

[0061] Remote server 104 is any computer system that provides at least some data and / or functionality to computer 101. Remote server 104 may be controlled and used by the same entity that operates computer 101. Remote server 104 represents a machine that collects and stores useful and useful data for use by other computers, such as computer 101. For example, in the hypothetical case where computer 101 is designed and programmed to provide recommendations based on historical data, this historical data may be provided to computer 101 from remote database 130 of remote server 104.

[0062] A public cloud 105 is any computer system available for use by multiple entities that provides on-demand availability of computer system resources and / or other computer functionality, particularly data storage (cloud storage) and computing power, without direct active management by users. Cloud computing typically leverages sharing of resources to achieve coherence and economies of scale. Direct active management of the computing resources of the public cloud 105 is performed by computer hardware and / or software of a cloud orchestration module 141. The computing resources provided by the public cloud 105 are typically implemented by virtual computing environments that run on various computers that make up the computers of the host physical machine set 142, which is the universe of physical computers available in and / or at the public cloud 105. The virtual computing environments (VCEs) typically take the form of virtual machines from the virtual machine set 143 and / or containers from the container set 144. It is understood that these VCEs may be stored as images and may be transferred among and between various hosts of physical machines, either as images or after instantiation of the VCEs. Cloud orchestration module 141 manages the transfer and storage of images, deploys new instantiations of VCE, and manages active instantiations of VCE deployments. Gateway 140 is a collection of computer software, hardware, and firmware that enables public cloud 105 to communicate over WAN 102.

[0063] Some further description of Virtualized Computing Environments (VCEs) is now provided. A VCE may be stored as an "image." A new active instance of a VCE may be instantiated from the image. Two well-known types of VCEs are virtual machines and containers. A container is a VCE that uses operating system level virtualization. This refers to a feature of an operating system where the kernel allows the existence of multiple isolated user space instances called containers. These isolated user space instances typically behave as real computers from the perspective of the programs running within them. A computer program running on a normal operating system may utilize all of the resources of that computer, such as connected devices, files and folders, network shares, CPU power, and quantifiable hardware capabilities. However, a program running inside a container may only use the contents of the container and of the devices assigned to the container, a feature known as containerization.

[0064] A private cloud 106 is similar to a public cloud 105, except that the computing resources are only available for use by a single enterprise. Although the private cloud 106 is shown in communication with the WAN 102, in other implementations the private cloud may be disconnected from the Internet at large and only accessible through a local / private network. A hybrid cloud is a composite of multiple clouds of different types (e.g., types of private, community or public clouds), often each implemented by a different vendor. Each of the multiple clouds remains a separate and discrete entity, but the larger hybrid cloud architecture is bound together by standardized or proprietary technologies that enable orchestration, management and / or data / application portability between the multiple constituent clouds. In this implementation, both the public cloud 105 and the private cloud 106 are part of a larger hybrid cloud.

[0065] In some aspects, a system according to various implementations may include a processor and logic integrated with and / or executable by the processor, configured to perform one or more of the process steps described herein. The processor may be of any configuration described herein, such as a discrete processor or processing circuit including many components, such as processing hardware, memory, I / O interfaces, etc. By integrated with, it is meant that the processor has logic embedded therein as hardware logic, such as an application specific integrated circuit (ASIC), FPGA, etc. By "executable by a processor" it is meant that the logic is hardware logic, software logic, such as firmware, part of an operating system, part of an application program, etc., or any combination of hardware and software logic that is accessible by the processor and configured to cause the processor to perform some function when executed by the processor. As known in the art, the software logic may be stored in local and / or remote memory of any memory type. Any processor known in the art may be used, such as, for example, a software processor module and / or a hardware processor such as an ASIC, an FPGA, a central processing unit (CPU), an integrated circuit (IC), a graphics processing unit (GPU), etc.

[0066] Of course, this logic may be implemented as a method or as a computer program product in any device and / or system according to a variety of implementations.

[0067] As noted above, the development of the Internet and wireless networking standards (such as Bluetooth and Wi-Fi) has led to the proliferation of computer systems. Additionally, improvements in processing power and functionality have led to the adoption and development of smart devices, such as, for example, smartphones, televisions, tablets, and other devices within the Internet of Things (IoT).

[0068] Furthermore, electronic source material has numerous benefits compared to physical documents. For example, electronic documents are easier to store and access compared to physical documents. Whereas accessing a physical document involves manually searching each document in the oeuvre until the desired document is found, multiple electronic documents can be automatically compared against one or more keywords. Also, electronic documents can be uploaded from and / or downloaded to any device connected to a network, whereas tangible documents (e.g., papers) must be physically transported between multiple locations. Similarly, electronic documents occupy much less space than their physical counterparts.

[0069] In view of these benefits, a greater amount of physical materials have been digitized. This digital transformation improves data storage and data accessibility, but also increases the importance of maintaining cybersecurity (e.g., computer security). Again, cybersecurity involves protecting computer systems and networks from attacks by malicious actors. Depending on the type of computer system and / or network affected, cybersecurity attacks can result in unauthorized disclosure of information, damage to hardware and / or software, corruption of data, etc. Although several platforms have been established to protect computer systems and networks from such attacks, threats are constantly evolving. This causes computer systems and networks to face different types of attacks over time.

[0070] As the criticality of computer systems and networks continues to grow, cybersecurity attacks pose a more significant threat. This makes cybersecurity a significant challenge due to the complexity of computer systems in general and the widespread use of computer networks. Although traditional products attempt to address security alerts and indicators received from various sources, such as security information and event management (SIEM) and endpoint detection and response (EDR), these traditional products are unable to address the multitude of situations involving computer and network security.

[0071] These traditional products have struggled to identify the severity of each reported incident. Thus, traditional products are completely unable to prioritize different security situations or even identify which incidents may potentially cause damage to operations. Although some attempts have been made to evaluate empirical data in an attempt to improve performance, this threat information is often outdated and redundant. Additionally, multiple sources of reinforcement may contradict each other, making them ineffective for evaluation.

[0072] Therefore, there is a need to develop an intelligent system that can utilize artificial intelligence to automatically evaluate events and calculate an integrated risk to cybersecurity from different indicators, including historical risk. Such a system is preferably dynamic enough for adding new risk indicators and removing redundant risk indicators and applying appropriate weights to each indicator. By implementing this system, the approach herein can ensure a more efficient and effective security response to potentially harmful events. This can significantly minimize the risk of cybersecurity threats to computer systems and networks, for example, as described in more detail below.

[0073] As a result, in sharp contrast to the shortcomings of conventional products, implementations herein can provide a comprehensive and accurate assessment of potential security threats. For example, an ATPS can be used to detect an occurring cybersecurity event and assess the threat the cybersecurity event poses to the underlying system. Some approaches can further generate an assessment of the event that can be used to prescribe corrective actions to be taken to overcome the resulting cybersecurity event. In other words, approaches herein can establish an understanding of events that affect the cybersecurity of a system and use this understanding to efficiently respond to the situation and restore cybersecurity to the system. For example, as described in more detail below, trained machine learning models can be used to establish an understanding of events that contributed to a cybersecurity event.

[0074] Turning now to FIG. 2A, a distributed system 200 according to one approach is shown having an ATPS 202 configured to detect and respond to cybersecurity events. Optionally, the system 200 and / or the ATPS 202 may be implemented in conjunction with features from any other approach enumerated herein, such as those described with reference to other figures, e.g., FIG. 1. However, such a system 200, the ATPS 202, and others presented herein may be used in various applications and / or permutations that may or may not be specifically described in the exemplary approaches or implementations enumerated herein. Furthermore, the system 200 and / or the ATPS 202 presented herein may be used in any desired environment. Thus, FIG. 2A (and other figures) may be considered to include any possible permutations.

[0075] As shown, system 200 preferably includes an ATPS 202 configured to evaluate attacks affecting (or intended to affect) a computer system and / or computer network. As a result, ATPS 202 may receive event information from multiple locations evaluating signals (e.g., commands) received and / or actions performed. Thus, ATPS 202 is connected to multiple distributed locations and / or components.

[0076] Turning to ATPS 202, there is shown a machine learning module 204 having a machine learning model training layer 206 and a machine learning model application layer 208. The machine learning model training layer 206 may receive information from various locations and use the received information to train machine learning models, and the machine learning model application layer 208 may use the machine learning models trained in layer 206 to evaluate events in real time as they occur.

[0077] Looking at the machine learning model training layer 206, the user interface node 210 receives information directly from the user interface 212. The received information may provide access to the Internet, running software applications, other systems, etc. through the user interface 212. Consequently, although not shown, the user interface may be connected to a network that provides access to a website at a particular Uniform Resource Locator (URL) address. Consequently, the information received at the user interface node 210 may be used to train a machine learning model based on the user's actions over time. Thus, the machine learning model may be able to identify patterns in user actions and make predictions regarding how those user actions will affect the performance of the ATPS 202 and / or the larger system 200 as a whole.

[0078] As a result, the machine learning model training layer 206 can preferably train a machine learning model to evaluate events (e.g., cybersecurity events) that have occurred and establish an understanding of those occurring events. For example, in some approaches, the machine learning module can be trained by first collecting information associated with (i) different types of cybersecurity events that have occurred over time and (ii) actions taken in response to each of the occurring cybersecurity events. This information can be stored in memory, copied to other locations, aggregated, etc. This allows the machine learning model, upon examination of the collected information, to establish a comprehensive understanding of the risks associated with different types of cybersecurity events. Furthermore, this machine learning can be used to evaluate newly received (e.g., occurred) cybersecurity events and to establish values ​​that provide insight into how the newly received cybersecurity events compare to what has previously occurred and been evaluated.

[0079] Other machine learning models may also be trained by the machine learning model training layer 206. For example, one or more machine learning models may be trained to generate an integrated risk score for a cybersecurity event, which represents the overall risk posed by the cybersecurity event to the normal operation of the underlying system. For example, the machine learning model may be trained to generate weight values ​​for each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. Thus, the machine learning model may emphasize certain risk scores and mute other risk scores according to the particular cybersecurity event that has occurred or is being evaluated. Thus, weight values ​​may be applied to each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. Furthermore, for example, as described in more detail below, the machine learning model may combine the weighted historical risk score, the weighted sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score to form an integrated risk score.

[0080] The ATPS 202 also includes an anomaly detection node 214 that may be used to examine information (e.g., data, commands, operations being performed, etc.) to determine whether any anomalies are present. For purposes of this specification, an "anomaly" may include any value or result that deviates from what is expected. Thus, the anomaly detection node 214 may include one or more machine learning models trained using information previously received at the ATPS 202.

[0081] Similarly, the language processing node 216 may include an ontology-driven system trained to perform natural language queries across a relational data store. And, the threat detection node 218 may include a machine learning model trained to identify potential threats (e.g., cybersecurity threats) based on received information associated with the operation of the system. As described above, the machine learning model may be trained using information received over time. Thus, the performance of the ATPS 202 and the system 200 overall may further improve over time as the machine learning model becomes more effective at identifying potential issues and generating an accurate understanding of how each issue may affect the underlying system.

[0082] The scoring node 220 may also include one or more machine learning models trained to apply weights to each of the different types of information received by other nodes in the training tier 206. This information may be weighted by evaluating the received information and comparing certain portions to each other and / or to historical information associated with previous performance. As a result, the scoring node 220 may be able to evaluate how much a given situation is predicted to affect the performance of the system. For example, as described in more detail below with respect to method 300, this evaluation and prediction may be further used to generate an accurate understanding of what risks different situations (such as cybersecurity attacks) pose.

[0083] With further reference to FIG. 2A, the machine learning model training layer 206 is also connected to a cloud server 222 (e.g., a central server) via a network 223. However, information being sent to the cloud server 222 may first be evaluated to determine whether it should be incorporated into other information stored in the cloud server 222. For example, this information may have been extracted from failed operations, unsatisfactory results, etc. As a result, in some situations, it is not desirable for certain information to be incorporated into an existing model and / or data repository. Thus, a data inspection module 226 evaluates data sent from the training layer 206. Data determined by the inspection module 226 to be desirable for the cloud server 222 may thereby be transmitted over the network 223. However, as shown, data determined to be undesirable for the cloud server 222 may be returned to the training layer 206.

[0084] The configuration and / or functionality of the cloud server 222 may vary depending on the approach. For example, in some implementations, the cloud server 222 may include a large (e.g., robust) processor coupled to a cache, a machine learning module, and a data storage array with a relatively high storage capacity. This allows the cloud server 222 to be used to process and store a relatively large amount of data, notes, and other information received over time in correlation with the computer system 200 and / or other systems. This allows the cloud server 222 to connect to the machine learning model training layer 206 and provide computational throughput to support the continued training of the machine learning models.

[0085] The cloud server 222 is also shown connected to the machine learning model application layer 208 through the processor 224. This connection (represented by dashed line 228) may be used to pull trained machine learning models and historical (e.g., previous) events from the training module 206 and / or the cloud server 222 to assess the current situation. In a preferred approach, the machine learning model is used to compare the current situation to other situations that have occurred in the past. This comparison allows the machine learning model to determine the relative risk associated with the current situation based on past events that are sufficiently similar to the current one. For example, cybersecurity events may be compared to determine the relative level of similarity between them based on one or more factors, such as log severity scores, model escalation probability, rare scores, observable scores, and others.

[0086] It should be noted that the cloud server 222 may also receive information over time corresponding to the actual usage of the machine learning models trained in the training tier 206. This in-use information may be evaluated by the actual machine learning models and used to make predictions and suggest actions intended to overcome undesirable situations. For example, cyber-security events that have occurred over time may be evaluated and used to further train the machine learning models on how to overcome similar or the same events in the future.

[0087] The machine learning model application layer 208 may also receive (e.g., pull or request) machine learning models that have been generated, trained, and applied over time. Thus, the application layer 208 may maintain machine learning models that can work in combination with the training layer 206 to evaluate current events. These machine learning models may be applied to newly occurring events (e.g., cybersecurity attacks) to evaluate details and determine real-time analysis of the situation. Thus, the application layer 208 may include at least some of the same or similar nodes as the training layer 206. In other words, at least some of these nodes in the application layer 208 may be established and improved over time in the training layer 206 before being implemented in the application layer 208.

[0088] Specifically, the application layer 208 is shown as including anomaly detection node 214, language processing node 216, threat detection node 218, and cumulative risk scoring node 219, as found, for example, in the training layer 206. Additionally, the application layer 208 includes a threat scoring node 211 and a sigma node 213, each of which may be used to evaluate different details of a particular event occurring. For example, nodes 211, 213, 214, 216, 218, 219 may be used to evaluate different aspects of a cybersecurity event occurring. Consequently, updates to the nodes in the application layer 208 may occur over time as performance changes in response to experience with particular types of events affect the training layer 206.

[0089] In response to the evaluation of each of the different aspects with the different nodes 211, 213, 214, 216, 218, 219, the application layer 208 can generate an indication of how the newly occurring event is predicted to affect the system. This indication can then reveal the relative severity of the event compared to other events (e.g., situations) that are currently occurring or have occurred in the past. This allows the implementations herein to address events in an order that corresponds to a given situation. For example, events that pose a greater risk to the computer system and / or network can be selectively addressed before other events that do not affect the security of the system and / or network. This can allow the current operating procedures of the system to be more efficient by providing insights that help to better understand the occurring events (e.g., situations). These events can be easily compared against each other and managed according to the approaches described herein.

[0090] 2A, the training layer 206 is connected to a controller 230, while the application layer 208 is connected to an inference module 232. The controller 230 is shown to receive data from the application layer 208, for example, in response to one or more machine learning models being used to evaluate a given event. The controller 230 may then return at least some of this received data to the training layer 206 so that the machine learning models may continue to be trained and improved with results from actual use. Also, for example, the inference module 232 may be used to generate a relative risk score for each of the events detected by the ATPS 202, as described in more detail below.

[0091] The controller 230 is also connected to a security module 234 having a processor 236. The security module 234 and the processor 236 may be configured to implement a relational database management system that organizes data into one or more data tables. In the data tables, relationships may be established between portions of the data to structure the data. Based on the structured understanding of the data, the security module 234 may identify potential security threats. For example, the security module 234 may be configured to detect a cybersecurity event that has occurred and evaluate the threat that the cybersecurity event poses to the underlying ATPS 202. Some approaches may further generate an evaluation of the event that may be used to direct corrective actions to be taken to overcome the cybersecurity event that has occurred. In other words, the approaches herein may establish an understanding of events that affect the cybersecurity of a system and use this understanding to efficiently respond to the situation and restore cybersecurity to the system.

[0092] As a result, for example, a pending alert may be received from security module 234 via network 238 in response to evaluating the data using processor 236, as one of ordinary skill in the art would understand after reading this specification. It should also be noted that network 223 and / or 238 may be of any type, for example, depending on the desired approach. For example, network 223 and / or 238 may be a WAN, such as the Internet. However, an exemplary enumeration of other potential network types includes, but is not limited to, a LAN, a PSTN, a SAN, an internal telephone network, and the like. As a result, any desired information, data, commands, instructions, responses, requests, and the like may be transmitted between ATPS 202 and (i) cloud server 222, (ii) user interface 212, (iii) security module 234, and / or combinations thereof, regardless of the amount of separation that exists between them.

[0093] 2B-2F, a risk scoring module having a detailed view of components in different nodes 211, 213, 214, 216, 218, 219 is shown according to different approaches. Consequently, one or more of the nodes shown in FIG. 2B-2F may be developed (e.g., trained) in the training layer 206 and / or used in modules in the application layer 208 to evaluate a given situation identified by the ATPS 202 of FIG. 2A. However, it should be noted that the components in any of FIG. 2B-2F are shown according to a particular approach, which is in no way intended to limit the present invention.

[0094] 2B, the language processing node 216 and the threat detection node 218 are combined to form a historical risk scoring module 240 having components therein configured to generate a risk score for an occurring current situation (e.g., an event). The risk score may be calculated by the historical risk scoring module 240 by evaluating different types of alerts received and comparing them to previously occurring situations. For example, security information and event management (SIEM) alerts 242 and / or endpoint detection and response (EDR) alerts 244 are received at the historical risk scoring module 240 by a magistrate 246. The magistrate 246 may keep different types of alerts separated and may also keep a record of the alerts received (e.g., in a lookup table).

[0095] From the Magistrate 246, the received SIEM and EDR alerts are provided to a topic module 248. The module 248 can be used to extract topic information from each of the received alerts to provide insight into how each of these alerts may impact the system. For example, as will become apparent shortly, in some approaches, these topics may be stored in memory, while in other approaches, the extracted topic information may be provided to the endpoints 250, 252.

[0096] Module 248 also receives feedback from risk scoring endpoint 256. In some approaches, module 248 receives a response from endpoint 256 that includes JavaScript Object Notation (JSON) data (e.g., one or more strings; numbers; objects; arrays; booleans; null) in the body of the response. The response may also include a content-type header, a response status, a status message, etc. As a result, for example, the received feedback may affect topic information extracted from the received alert, as one of ordinary skill in the art would understand after reading this specification.

[0097] From module 248, these alerts are sent to endpoints 250, 252. The received alerts are preferably segregated such that different types of alerts are sent to different respective endpoints 250, 252. For example, SIEM alerts are sent to endpoint 252, while EDR alerts are sent to endpoint 250. According to one example, and not intended to limit the invention in any way, endpoint 252 may be an Advanced Threat Response System (ADTS) endpoint, while endpoint 250 is an Athena-based endpoint. Thus, endpoints 250, 252 may each be microcode operating at a particular point in a machine learning process to evaluate received alerts of a particular type.

[0098] In response to examination of each received alert, predictions, assessments and other types of analysis are output from the endpoints 250, 252. As described above, this information is generated as a result of training machine learning models on past events and how they were addressed. The information output from the endpoints 250, 252 is provided to a risk scoring engine 254 that includes one or more machine learning models trained to generate relative historical risk scores for the received alerts.

[0099] The historical risk score generated for one or more related alerts may represent the likelihood that these alerts will ultimately have a negative and / or significant impact on the overall system, and is based on patterns and other relationships identified by a trained machine learning model that has been trained using the system's historical (e.g., past) performance. The risk score may then be used to prioritize certain alerts that correspond to a much higher risk of harm to the system, while choosing to withhold action on alerts that correspond to less severe situations. This allows the system to be maintained efficiently by proactively addressing each of the issues before they impact performance.

[0100] In some approaches, the risk scoring engine 254 uses a random forest regressor that considers various features within the received information (e.g., alerts), such as log severity scores, model escalation probabilities, rare scores, observable scores, and similar alert counts. To ensure accuracy, the risk scoring engine 254 also uses historical escalation score values ​​as ground truth. Thus, the risk scoring engine 254 and the historical risk scoring module 240 collectively can prioritize alerts and provide security analysts with a clearer picture of potential threats by calculating a score that represents the risk of the alert from a historical perspective.

[0101] The endpoint 256 further evaluates the risk score generated by the engine 254 and returns feedback to the module 248. As described above, in some approaches, the module 248 receives a response from the endpoint 256 that includes JSON data in the body of the response. Thus, the endpoint 256 can be configured to extract the JSON data from the risk score generated by the risk scoring engine 254.

[0102] Consequently, machine learning has proven to be an effective tool in providing risk scores for SIEM and EDR alerts. For example, the system can be trained on data collected from previous alerts and actions taken in response to those alerts by leveraging historical learning and analyst responses. This allows the machine learning model (e.g., algorithm) to establish a comprehensive understanding of the risks associated with different types of alerts received.

[0103] Now, looking at FIG. 2C, sigma node 213 is used to form sigma 258, which has a component therein that is also configured to generate a risk score for an occurring current state (e.g., an event). Compared to historical risk scoring module 240 of FIG. 2B, here sigma 258 is configured to generate a risk score based on the number of predefined rules that are broken by the current state. For example, processing pipeline 264 can be configured to evaluate the number and / or type of rules that are broken and generate a relative sigma that quantifies the likelihood that these broken rules will lead to a significant system error that impacts operational efficiency (e.g., system downtime).

[0104] The broken rules may be identified by Sigma 258 as a result of examining different types of alerts received. For example, SIEM alerts 242 and / or EDR alerts 244 are also shown as being received at Sigma 258 (also referred to herein as the "Sigma rule detection score module"). In some approaches, the same alerts 242, 244 may be received at each of the risk scoring modules, while in other approaches, different types of alerts may be directed to specific each of the scoring modules. As mentioned above, Magistrate 246 may be used to keep different types of alerts separated and may keep a record of the alerts received (e.g., in a lookup table).

[0105] From Magistrate 246, the received SIEM and EDR alerts are provided to a topic module 260. Again, module 260 can be used to extract topic information from each of the received alerts to provide insight into how each of these alerts may impact the system. For example, as will become apparent shortly, in some approaches, these topics may be stored in memory, while in other approaches, the extracted topic information may be provided to endpoint 262.

[0106] From module 260, these alerts are transmitted to endpoint 262. These different types of received alerts may be combined to be evaluated together by microcode executing at endpoint 262. For example, endpoint 262 may be microcode that operates at a particular point in a machine learning process to evaluate the received alerts and make a determination as to how likely those alerts are to indicate that an error will occur.

[0107] From the endpoints 262, the evaluated alerts and corresponding information generated are provided to a processing pipeline 264 for further evaluation. For example, the processing pipeline 264 includes a domain object module 266 that may provide a framework that provides a convenient and uniform layer for accessing data from a wide range of data sources. Also, a rule selection module 268 is used to select the rules to be maintained. These rules may be selected from a set of available options, predefined rules according to the current situation being evaluated, user preferences, a repository of potentially applicable sigma rules, etc. It should be noted that for purposes of this specification, "sigma rules" is intended to refer to a collection of rules used for threat detection and security monitoring.

[0108] In some examples, the Sigma rules are open source and are designed to provide a standardized and structured way for the description of log events and the creation of detection rules, which can be used to search for patterns and IoCs in the log data, making it easier to detect potential security threats. In some approaches, the Sigma rules can be written in YAML format and can be written to detect a variety of different security threats, including malware, phishing, credential theft, etc. As a result, the rule selection module 268 can implement any desired number and / or type of Sigma rules, depending on the circumstances.

[0109] The pattern matching module 270 is further used to evaluate details of the received alert and the rule-based information output from the rule selection module 268. In some approaches, the pattern matching module 270 implements natural language processing (NLP) to evaluate textual information contained in the alert, the applied rules, user input, etc. This textual information is used to identify patterns, perform correlations, establish predictions, etc.

[0110] The information evaluated by the pattern matching module 270 is sent to a risk scoring module 272 to generate a risk score for the current situation. Thus, the risk scoring module 272 may evaluate information including received alerts, details (e.g., patterns, correlations, predictions, etc.) determined by the pattern matching module 270, rule-based information, etc. One or more trained machine learning models may be implemented by the risk scoring module 272 to evaluate the number and / or type of broken rules along with other received information and determine a relative value that quantifies the likelihood that the broken rules will lead to a significant system error affecting operational efficiency (e.g., system downtime). Thus, this relative value may be output by the risk scoring module 272 as a sigma. From the risk scoring module 272, the risk score is sent to an inference module 274 that further evaluates the risk score to determine whether corrective action should be taken to avoid any potential problems that may be caused by the current situation.

[0111] As a result, Sigma 258 can generate a Sigma that evaluates various details and quantifies the likelihood that currently broken rules will lead to critical system errors that impact operational efficiency. Again, the microservices running within Sigma 258 can use open source rules to describe relevant log events with respect to command line values, process names, URLs, etc. For example, a pattern matching engine can be used to determine the risk associated with each log event. According to one example, which is in no way intended to be limiting, Sigma 258 can use an application programming interface (API) that utilizes ANTLR, specifically adapted to STIX 2.0 nomenclature. This pattern matching engine can be used by the backend to determine whether a Sigma rule has been fired. However, to scan the log events in this example, the input data is converted into the format of STIX DOMAIN objects 2.0 (SDOs). The microservices then clean and extract the input data to construct and tag SDOs based on given categories.

[0112] Consequently, in the situation where a sigma rule fires (e.g., fails), the API provides a response indicating the particular rule that was triggered, along with the associated methodology and technique, which causes the risk scoring module 272 (e.g., engine) to calculate a risk score based on the number of rules that fired, the relative severity of the rules that fired, the TTP tags associated with the fired sigma rules, etc. Although not shown, sigma 258 also normalizes the risk score and provides an explanation for the underlying calculation.

[0113] Now, looking at FIG. 2D, the anomaly detection node 214 is used to form an anomaly risk scoring module 276 having therein a component that is also configured to generate a risk score for a current situation (e.g., an event) occurring. Comparing the historical risk scoring module 240 of FIG. 2B and the sigma 258 of FIG. 2C, here the anomaly risk scoring module 276 is configured to generate a risk score based on whether the details associated with the current situation deviate from an expected outcome. For example, the anomaly risk scoring module 276 may implement an unsupervised machine learning module 282 configured to detect anomalies in the received alert data and generate a numerical score representing the relative amount that a given alert deviates from most of the data. Consequently, for example, as will become apparent shortly, the machine learning module 282 may be initially trained using a historical alert data set so that it may make predictions about newly received alerts.

[0114] As shown, SIEM alerts 242 and / or EDR alerts 244 are received at a magistrate 246 of an anomaly risk scoring module 276. As mentioned above, in some approaches, the same alerts 242, 244 may be received at each of the risk scoring modules. Thus, at least some of the SIEM alerts 242 and / or EDR alerts 244 received at the anomaly risk scoring module 276 may be the same as the alerts received at the historical risk scoring module 240 of FIG. 2B and / or sigma 258 of FIG. 2C. In other approaches, different types of alerts may be directed to specific each of the scoring modules.

[0115] As mentioned above, the Magistrate 246 may be used to keep different types of alerts separated and may keep a record of the alerts received (e.g., in a lookup table). From the Magistrate 246, the received SIEM and EDR alerts are provided to a separate topic module 278. As mentioned above, the module 278 may be used to provide insight into how each of the received alerts may impact the system by extracting topic information from each of the received alerts. For example, as will become apparent shortly, these topics may be stored in memory in some approaches, while in other approaches the extracted topic information may be provided to an endpoint 289.

[0116] Consequently, during the data preparation phase, Magistrate 246 may clean the alerts and corresponding data. In other words, Magistrate 246 may be configured to clean, pre-process, and extract features from the received alerts. In addition to cleaning newly received alerts during the prediction phase, this process may also be applied to the training data set during the modeling phase. Thus, the alert data output by Magistrate 246 may be ready to be used for modeling and prediction.

[0117] Magistrate 246 also transmits received alerts to memory 280 for storage, so that these alerts and related information can be accumulated in memory 280 over time to build a comprehensive understanding of past alerts and how the system was ultimately affected after receipt of different alerts. This historical information can be further provided to machine learning module 282. As described above, machine learning module 282 can be initially trained using a historical alert dataset such that module 282 is configured to evaluate newly received alerts and make predictions regarding how the system will be affected as a result.

[0118] For example, three different classifiers 283, 284, 285 are used to evaluate the received information. During the training phase, the historical data received from the memory 280 can be evaluated by the classifiers 283, 284, 285 to determine how it has affected the system performance. For example, different machine learning algorithms can be implemented by each of the classifiers 283, 284, 285. According to one example, the classifiers 283, 284, 285 can implement the Isolation Forest, AutoEncoder and Elliptic Envelope algorithms, respectively. Thus, each of the classifiers 283, 284, 285 can be trained to implement a specific model on the prepared data set. As a result, the generated scores can be converted to the same probability interval [0,1], where 0 (zero) corresponds to the absolute normality of the alert and 1 (one) corresponds to the absolute abnormality of the alert.

[0119] The outputs from the classifiers 283, 284, 285 may be used by the decision module 286 to generate aligned scores. These aligned scores may further be used by the scoring module 287 to calculate a single anomaly score for the current situation. According to some approaches, the single anomaly score may be calculated by simply determining the median (average) value of the aligned scores. In other approaches, the scoring module 287 may calculate this score by determining the median, maximum, weighted average, etc. The results from the scoring module 287 are output to an inference module 288, which may be used to evaluate the generated results. Thus, for example, as one skilled in the art would understand after reading this specification, the machine learning module 282 may receive alert information corresponding to a situation and use a pre-computed scoring model to detect whether a given alert is "anomalous" or "not anomalous" and assign a numerical score as a measure of the alert anomaly.

[0120] Thus, the trained machine learning model in the machine learning models 282 may be implemented at the endpoint 289 to identify anomalies in the received alert data that correspond to the current situation. Thus, the endpoint 289 may also assign a corresponding anomaly score to each of the received alerts and / or to the current situation as a whole. To accomplish this, the alert data may be formatted according to any data preparation phase specifications. Thus, the resulting result generated by the endpoint 289 may be a classification of each alert as corresponding to either "anomalous" or "not anomalous" and a corresponding anomaly risk score. In some approaches, a higher score indicates a greater degree of anomaly of the alert, but this is in no way intended to be limiting. Rather, in other approaches, comparable metrics may be applied while evaluating the risk score. For example, in some approaches, a lower risk score indicates a greater degree of anomaly.

[0121] 2E, the threat scoring node 211 is used to form a threat intelligence risk scoring module 290. As shown, the threat intelligence risk scoring module 290 (also referred to herein as an "IoC score module") includes a component configured to generate another risk score used to quantify the performance of a system in a current state. This enrichment may be based on data provided by a threat intelligence service (TIS), which may leverage various data sources including internal security research, external threat feeds, third-party intelligence sources, etc. Based on the sources used, the TIS may provide the latest cybersecurity trends regarding a particular IoC in the form of an intelligence report. With the ability to collect the latest threat reports across many systems, the enrichment provided by the TIS risk scoring engine further processes each intelligence report and calculates a score (value). This score may be set between two boundaries depending on the approach. According to one example, the score may be calculated to have a value between 0 and 1.

[0122] As shown, SIEM alerts 242 and / or EDR alerts 244 are received at a magistrate 246 of a threat intelligence risk scoring module 290. As mentioned above, the magistrate 246 may be used to keep different types of alerts separated and may keep a record of the alerts received (e.g., in a lookup table). From the magistrate 246, the received SIEM and EDR alerts are provided to a separate topic module 291. As mentioned above, the module 291 may be used to provide insight into how each of the received alerts may impact the system by extracting topic information from each of the received alerts. These topics may be stored in memory in some approaches, while in other approaches the extracted topic information may be provided to an endpoint 292 for evaluation.

[0123] The endpoint 292 may also implement one or more of the machine learning models formed in the processing module 293. Specifically, the processing module 293 includes an observation module 294 configured to inspect operating conditions and identify undesirable situations. For example, the observation module 294 may be configured to inspect incoming observable detection information and identify IoCs therein. The IoCs identified and extracted by the observation module 294 may depend on the data fields passed through. Depending on the alert type (e.g., EDR or SIEM) being received, a particular combination of IoCs may be desired. For example, the IoCs identified and extracted by the observation module 294 may include external Internet Protocol (IP) addresses, MD5 hash values, SHA256 hash values, URL addresses, etc.

[0124] In response to identifying an IoC, a threat intelligence-based risk scoring module may be used to send the IoC via the TIS module 295. For example, the IoC may be sent to the TIS module 295 in the form of an enriched query. The TIS module 295 may examine each of the raw reports received with the IoC to determine a ratio of identified positive detected reports. Also, due to the broadness of the TIS module 295, the detected reports may be generated by a variety of security technologies, including antivirus software and intrusion detection systems. As a result, in addition to calculating the detected report ratio, the threat intelligence-based risk scoring may also retrieve the most recent scan date to determine how current (or out of date) the severity of the threat report is.

[0125] From the TIS module 295, the evaluated information is sent to the machine learning module 296 for further evaluation. For example, a risk scoring engine 297 in the machine learning module 296 may use both the calculated ratios of a given IoC and the most recent scan date and apply a time decay formula to determine the relative total risk of the IoC across multiple threat intelligence sources. Once each IoC has been evaluated and a risk score determined, a risk score integration module 298 combines the risk scores to create a combined risk score for the current situation. In some approaches, the combined risk score is the maximum score of all IoCs identified by the TIS module 295. Additionally, an embedded risk reasoning module 299 may be used to provide detailed explanations regarding the risk calculations and components generated by the risk scoring engine 297 and / or the risk score integration module 298.

[0126] 2F, cumulative risk scoring node 219 is used to form cumulative risk scoring module 271. As shown, risk-based information is received at cumulative risk scoring endpoint 273 of cumulative risk scoring module 271. Depending on the approach, the risk-based information received at cumulative risk scoring module 271 may include scored SIEM alerts, scored EDR alerts, user defined weights for different alerts, a list of equivalent hardening options, a list of hardening options to consider in forming the cumulative risk score, etc.

[0127] Thus, the cumulative risk scoring endpoint 273 can evaluate the received risk-based information and determine an understanding of the corresponding situation and whether the situation is expected to cause a performance issue. From the cumulative risk scoring endpoint 273, the request (e.g., payload) is sent to the interface pipeline 275 for processing. As shown, the interface pipeline 275 includes the trained model weights, the weighted average risk score, and the final cumulative risk score. As a result, the various weights, risk scores, cumulative risk scores, etc. evaluated in the interface pipeline 275 can generate a cumulative risk score in response to the payload provided by the cumulative risk scoring endpoint 273. Thus, the interface pipeline 275 returns the cumulative risk score to the cumulative risk scoring endpoint 273 for implementation.

[0128] As a result, the cumulative risk scoring module 271 may receive a set of enhanced service results and combine them into a single cumulative score, reducing computational overhead and allowing the severity of an alert to be determined quickly. Furthermore, the severity of an alert is expressed in relation to other alerts. As discussed above, this desirably allows more serious (e.g., threatening) alerts to be processed before less serious alerts.

[0129] To achieve this, the cumulative risk scoring module 271 may effectively function as an inference layer that is used to generate a final cumulative risk score for a newly received alert. This inference layer may first calculate a weighted score over all available reinforcements. The model also calculates a cumulative risk score by taking the maximum over the weighted score, all deterministic reinforcements, and any reinforcements for which there are no learned weights.

[0130] In one example, the performance of the cumulative risk scoring module 271 is further evaluated using the point biserial correlation coefficient (PBC) statistic, which measures the correlation between a numerical variable (e.g., model prediction) and a categorical variable (e.g., alert status or target). Through this evaluation, the inventors were able to determine that the final cumulative risk score had a PBC statistic value of 0.77, indicating a strong and desirable correlation between the predictions made by the model described herein and the target variable.

[0131] To achieve this, the cumulative risk scoring module 271 may implement information gathered by a training layer. The training layer may use algorithms to evaluate the incoming information, such as a random forest classifier algorithm, a permutation importance algorithm, etc. The training layer uses these algorithms to learn the appropriate weights of the different individual scores. For example, a random forest classifier algorithm may be used to ensure that the individual scores can make a meaningful prediction regarding the overall outcome of the alert. Also, a permutation importance algorithm may be used to calculate the individual weights of each of the individual scores. These algorithms evaluate the reduction in model score in the case where a single feature value is randomly shuffled. This procedure breaks the relationship between the feature and the target, and therefore the reduction in model score may indicate how dependent the model is on a given feature. As a result, the importance of the features (i.e., the individual enriched scores) may be used as an indicator of the weights assigned to them.

[0132] Referring now to Figure 3A, a flow chart of a method 300 for providing a comprehensive and accurate assessment of a potential threat based on a current operating situation according to one approach is shown. The method 300 may be performed in accordance with the present invention in any of the environments shown in Figures 1-2F, among other approaches. For example, one or more operations in the method 300 may be performed by a component in the ATPS 202 of Figure 2A, such as, for example, the machine learning model application layer 208. Additionally, as one skilled in the art would understand upon reading this specification, more or less operations may be included in the method 300 than those specifically illustrated in Figure 3A.

[0133] Each of the steps of method 300 may be performed by any suitable component of an operating environment using known techniques and / or techniques that will be readily apparent to one of ordinary skill in the art upon reading this disclosure. For example, in various implementations, method 300 may be performed in part or in whole by a controller (e.g., controller 230 of FIG. 2A), a processor (e.g., processor 224 of FIG. 2A), or the like, or some other device having one or more processors therein. A processor (e.g., a processing circuit, chip, and / or module) implemented in hardware and / or software, preferably having at least one hardware component, may be utilized in any device to perform one or more steps of method 300. Exemplary processors include, but are not limited to, a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or the like, combinations thereof, or any other suitable computing device known in the art.

[0134] As shown in FIG. 3A, operation 302 of method 300 includes detecting a first event having a high risk of causing a system error. As described above, an ATPS may be used to detect certain events (e.g., cybersecurity events, etc.) that may cause problems in a system and evaluate the threat that the event poses to the underlying system. Thus, operation 302 may include detecting a current cybersecurity event that tends to cause a cybersecurity related problem for the system. In the context of this specification, a "current cybersecurity event" may include a real-time (e.g., at least near real-time) event that may potentially affect the confidentiality, integrity, or availability of information assets belonging to an organization. A non-exclusive list of examples includes detecting malware in a computer system, receiving an incorrect login attempt from a user, receiving a request to perform a predetermined type of operation, etc. As a result, the severity of the cybersecurity event occurring and being detected may vary depending on the approach.

[0135] Some approaches may further generate an evaluation of the event that may be used to direct corrective actions to be taken to overcome the cybersecurity event that occurred. Thus, in response to detecting a first event having a high risk of causing a system error, the method 300 proceeds to operation 304. Here, operation 304 includes generating a historical risk score for the detected event. As described above, the process of generating a historical risk score for a given event includes using a machine learning model. For example, the trained machine learning model may be configured to compare a current cybersecurity event to historical (e.g., previous) events. Consequently, operation 304 may include sending one or more instructions to a historical risk scoring module (see, e.g., historical risk scoring module 240 of FIG. 2B).

[0136] By comparing a current cybersecurity event to a previous event, the machine learning model may be able to identify similarities between them, and these similarities may be used to identify a relative risk associated with the current cybersecurity event causing a problem to the system. Thus, a historical risk score may be determined based at least in part on a comparison between the current cybersecurity event and the historical events. Also, for example, as one skilled in the art would understand after reading this specification, actions taken in response to historical events and the resulting impact on the system may be used to determine the relative risk of the current cybersecurity event.

[0137] In some approaches, comparing a cybersecurity event to history (e.g., previous cybersecurity events) involves comparing certain features of the different events, such as the log severity scores, model escalation probabilities, and rare scores of those events. Observable scores and other features (e.g., values) may be compared to identify any similarities between them.

[0138] Some approaches also involve determining a historical risk score by applying time decay to historical cybersecurity events and corresponding responses. Time decay is preferably used to assign greater importance to more recent (e.g., related to the current event) historical events and responses while assigning less importance to events and responses from the more distant past.

[0139] Returning to FIG. 3A, method 300 proceeds from operation 304 to operation 306. Operation 306 includes generating a sigma rule detection score for the detected event. As described above, the process of generating a sigma rule detection score for a given event involves evaluating a number of predefined rules and how the cyber security event affects those rules. For example, a number of predefined sigma rules may be accumulated and compared against operating conditions resulting from the cyber security event occurring. Consequently, operation 306 may include sending one or more instructions to sigma (e.g., see sigma 258 of FIG. 2C).

[0140] The process of generating a sigma rule detection score for a cyber security event involves identifying the number of rules that were fired (e.g., broken) as a result of the cyber security event. In some approaches, the rules that were fired may be determined by examining techniques, techniques, and procedures (TTP) tags. These TTP tags may include behaviors, methods, or patterns of activity employed by a threat actor or group of threat actors.

[0141] As a result, the sigma rule detection score may be adjusted based on the severity of the rules identified as being fired by the event. For example, the sigma rule detection score may increase as the number of fired rules increases. Similarly, the sigma rule detection score may increase as the severity of fired rules increases. Also, the sigma rule detection score may decrease as the number and / or severity of fired rules decreases. The determined sigma rule detection score may further be normalized in some instances. For example, as one skilled in the art would understand after reading this specification, normalizing the sigma rule detection score may generate an explanation outlining the underlying calculations.

[0142] 3A further illustrates method 300 proceeding from operation 306 to operation 308. Operation 308 includes generating an anomaly risk score for the detected event. As described above, the process of generating an anomaly risk score for a given event involves determining whether any anomalies are present in the information associated with the cyber security event. For example, the operation details associated with the cyber security event may be examined and compared against expected (e.g., average) values ​​to determine whether any anomalies have occurred. Accordingly, operation 308 may include sending one or more instructions to an anomaly risk scoring module (e.g., see anomaly risk scoring module 276 of FIG. 2D).

[0143] Again, the information associated with the cyber-security event is preferably examined to determine whether any deviations from intended performance have occurred. In response to identifying anomalies in the examined information, a numerical value is determined for each of the anomalies indicating the amount by which the respective anomaly deviates from a majority (e.g., remainder) of the information associated with the cyber-security event. As a result, the more an anomaly deviates from expected performance, the larger the corresponding numerical value may be. Similarly, the closer an anomaly is to expected performance, the smaller the numerical value may be. These numerical values ​​may then be used as an anomaly risk score for the cyber-security event, e.g., as described above with respect to FIGs. 2A and 2D.

[0144] Further still, the method 300 of FIG. 3A proceeds from operation 308 to operation 310, which includes generating an IoC score for the detected event. As described above, the process of generating an IoC score for a given event involves examining information associated with a cybersecurity event and determining whether any IoCs are contained therein. The identified and extracted IoCs may also depend on the received data fields. Depending on the alert type (e.g., EDR or SIEM) being received, a particular combination of IoCs may be desired. For example, the identified and extracted IoCs may include an external Internet Protocol (IP) address, an MD5 hash value, a SHA256 hash value, a URL address, etc. As a result, operation 310 may include sending one or more instructions to a threat intelligence risk scoring module (see, e.g., threat intelligence risk scoring module 290 of FIG. 2E).

[0145] Consequently, the process of generating an IoC score for a cyber security event involves examining information associated with the cyber security event. In response to identifying one or more types of IoCs in the information, the identified IoCs may be compared to information associated with historical (e.g., previous) cyber security events. It should also be noted that the one or more types of IoCs identified in the information are determined based on the detected type of cyber security event.

[0146] Again, by comparing a current event to events that occurred in the past, method 300 can reliably and proactively respond to a cyber-security event based on the identified similarity to the past events. Thus, for example, as one of ordinary skill in the art would understand after reading this specification, an IoC score may be based at least in part on an identified overlap with information associated with historical cyber-security events.

[0147] With further reference to FIG. 3A, operation 312 of method 300 further includes evaluating the generated scores using a machine learning model. In other words, operation 312 includes evaluating the historical risk scores, sigma rule detection scores, anomaly risk scores, IoC scores, and / or combinations thereof using one or more trained machine learning models. Additionally, operation 314 includes creating an integrated risk score using the machine learning model. As described above, the integrated risk score may be determined based on cybersecurity events, an integrated risk score (incorporating the historical risk scores, sigma rule detection scores, anomaly risk scores, IoC scores), or any other desired information. Accordingly, operations 312 and 314 may include sending one or more instructions to a cumulative risk scoring module (see, for example, cumulative risk scoring module 271 of FIG. 2F).

[0148] Turning now to Figure 3B, exemplary sub-operations of evaluating different risk scores and creating an integrated risk score according to one approach are shown. Consequently, one or more of the sub-operations in Figure 3B may be used to perform operation 312 and / or operation 314 of Figure 3A. However, it should be noted that the sub-operations in Figure 3B are shown according to one approach, which is in no way intended to limit the present invention.

[0149] As shown, suboperation 320 includes generating weight values ​​for each of the generated scores. In other words, suboperation 320 includes generating weight values ​​for the historical risk scores, sigma rule detection scores, anomaly risk scores, and IoC scores determined in method 300. As mentioned above, different weight values ​​may be applied to different types of risk scores.

[0150] For example, one or more machine learning models trained to apply weights to each type of risk score. In some approaches, these weights are predefined (e.g., by a user) for each of the different types of risk scores. Thus, in some approaches, the process of generating weight values ​​for the risk scores may simply involve referencing a lookup table. In other approaches, a request may be sent to a user, a running application, a machine learning model, etc. to generate weight values.

[0151] According to some approaches, weight values ​​can be determined for a given risk score by identifying the amount by which a given score changes in response to a single feature value being randomly shuffled. In other words, the machine learning model evaluates the amount by which the model score decreases in response to a single feature value being randomly shuffled. This procedure effectively breaks the relationship between the feature and the target. Thus, the decrease in the model score indicates the amount by which a given model depends on the feature. As a result, the importance of the feature (e.g., "individual reinforcement score") can be used as an indicator of the appropriate weight to be assigned to the risk score given the current situation.

[0152] As a result, in some approaches, a risk score may be weighted by evaluating the received information and comparing specific portions to each other and / or to historical information associated with previous performance. As a result, a prediction may be made as to how much a given situation is predicted to affect the performance of the system. This evaluation and prediction may be further used to generate an accurate understanding of what risks different situations (such as cybersecurity attacks) pose to the entire system and / or to specific portions thereof.

[0153] Proceeding to suboperation 322, a weighting value is applied to each generated score. In other words, suboperation 322 includes applying a weighting value to each of the historical risk scores, sigma rule detection scores, anomaly risk scores, and IoC scores. Further, suboperation 324 includes combining the weighted scores to form an integrated risk score, while suboperation 326 includes outputting the integrated risk score to the intended target location. Consequently, in some approaches, the integrated risk score may be weighted, for example, to emphasize certain risk scores depending on the current conditions occurring in the system and / or to reduce the influence of other risk scores. Also, for example, as one of ordinary skill in the art would understand after reading this specification, the machine learning model used to create the integrated risk score, or any portion thereof, may be trained using a random forest classifier and / or a permutation importance algorithm to generate weighting values ​​for each of the historical risk scores, sigma rule detection scores, anomaly risk scores, and IoC scores.

[0154] Returning now to FIGURE 3A, method 300 can result in improved efficiency with which events, such as cyber-security events, can be evaluated and responded to (e.g., for remediation) in real time. As described above, machine learning models are trained using information corresponding to previously occurring cyber-security events. These machine learning models can also be used to evaluate cyber-security events as they occur.

[0155] This allows implementations herein to provide an intelligent system that can utilize artificial intelligence to automatically evaluate events and calculate an integrated risk to cybersecurity from different indicators, including historical risk. This allows the system herein to be dynamic enough for the addition of new risk indicators and the removal of redundant risk indicators. Implementations herein can also apply appropriate weights to each risk score. This allows the approach herein to ensure a more efficient and effective security response to potentially harmful events. This can significantly minimize the risk of cybersecurity threats to computer systems and networks.

[0156] As a result, in sharp contrast to the shortcomings of conventional products, implementations herein can provide a comprehensive and accurate assessment of potential security threats. For example, an ATPS can be used to detect an undesirable (e.g., cybersecurity) event occurring and assess the threat the cybersecurity event poses to the underlying system. Some approaches can further generate an assessment of the event that can be used to prescribe corrective actions to be taken to overcome the resulting cybersecurity event. In other words, approaches herein can establish an understanding of the (e.g., cybersecurity) events that affect the configuration of the system and use this understanding to efficiently respond to the situation and restore operational efficiency to the system. Trained machine learning models can be used to establish an understanding of the events that contributed to the cybersecurity event.

[0157] It should also be noted that while various approaches have been described herein in the context of a cybersecurity event, the same or similar processes may be applied to other types of events that occur. For example, any of the approaches herein may be implemented in a process that performs endpoint security monitoring on a user device.

[0158] According to the example used, which is in no way intended to limit the present invention, an OpenShift deployment architecture may include a model training component and a model serving component. Both the training and serving components are deployed as OpenShift operators that may be decomposed into a set of multi-container services that are responsible for the complex instantiation and management of the entire ATPS system. This process involves automating the deployment, configuration, scaling and monitoring of these components, allowing the different components of the system to work seamlessly together to provide the desired functionality.

[0159] Also, machine learning models can be served in a scalable manner via a remote procedure call (RPC) interface (e.g., gRPC, etc.) for remote procedure calls. This allows efficient serialization and deserialization of complex data types, allowing large volumes of requests to be handled in real time. In these approaches, the serving operator automatically scales pods horizontally to accommodate the demand volume based on observed CPU utilization. Also, a framework can be selected for a service model that preferably simplifies the deployment and management of multiple machine learning models at scale, such as Kubernetes deployments and / or stateful sets. Furthermore, this provides tools for managing the entire lifecycle of machine learning models.

[0160] After successfully completing each training process, the corresponding microservice can be evaluated against a Promotion Logic, e.g., a set of criteria to determine whether the model is acceptable for use in production. These criteria include performance and governance metrics to ensure that each promoted model is effective and compliant with a particular scenario (e.g., application). Users can create and dynamically change appropriate configurations for their use cases for each training microservice. Upon successful promotion, models are pushed to cloud storage where serving operators access them.

[0161] Additionally, the operator may deploy a user interface to provide a visual and interactive manner for users (e.g., developers) to engage with the back-end components of the operator. This significantly simplifies complex workflows and reduces the cognitive load on users. Additionally, the operator provides access to specific functions of the training process for users at different tiers, the ability to visualize the entire system, and a quick and effective way to triage the entire system in case of any issues. As a result, for example, as one skilled in the art would understand after reading this specification, developers can quickly trigger training jobs and monitor application logs without the need to instantiate YAML custom resources at the OpenShift level.

[0162]

[0036] Referring now to Figure 4, there is shown a flow chart of a method 409 according to one approach. The method 409 may be performed in accordance with the present invention in any of the environments shown in Figures 1-3B, among other approaches. Of course, as one of ordinary skill in the art would understand upon reading this specification, more or less operations may be included in the method 409 than those specifically illustrated in Figure 4.

[0163] Each of the steps of method 409 may be performed by any suitable component of an operating environment. For example, in various approaches, method 409 may be performed in part or in whole by a processing circuit, such as an IaC access manager, or some other device having one or more processors therein. A processor (e.g., a processing circuit, chip, and / or module) implemented in hardware and / or software, preferably having at least one hardware component, may be utilized in any device to perform one or more steps of method 409. Exemplary processors include, but are not limited to, a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or the like, combinations thereof, or any other suitable computing device known in the art.

[0164] It is understood that the process software associated with providing a comprehensive and accurate assessment of potential threats based on current operating conditions can be deployed by manually loading the process software directly into the client, server and proxy computers, for example via loading a storage medium such as a CD, DVD, etc., but the process software can also be automatically or semi-automatically deployed to computer systems by sending the process software to a central server or a group of central servers. The process software is then downloaded to the client computers that run the process software. Alternatively, the process software is sent directly to the client systems via email. The process software is then isolated or loaded into a directory by executing a set of program instructions that isolates the process software into a directory. Another alternative is to send the process software directly to a directory on the client computer hard drive. If a proxy server is present, the process selects the proxy server code, determines which computer the proxy server code is to be located on, transmits the proxy server code, and then installs the proxy server code on the proxy computer. The process software is transmitted to the proxy server and then stored on the proxy server.

[0165] Continuing with reference to method 409, step 400 begins the deployment of process software. The first step is to determine (401) whether there are any programs that will be present on a server or servers if the process software is executed. If this is the case, the servers that will contain the executable files are identified (509). The process software for the server or servers is transferred (510) directly to the server storage via FTP or some other protocol, or by copying through the use of a shared file system. The process software is then installed (511) on the servers.

[0166] A determination is then made whether the process software will be deployed by having a user access the process software on one or more servers (402). If the user is to access the process software on a server, a server address where the process software will be stored is identified (403).

[0167] A determination is made whether a proxy server will be built to store the process software (500). A proxy server is a server that sits between a client application, such as a web browser, and the real server. The proxy server intercepts all requests to the real server to see if it can fulfill these requests itself. If not, the proxy server forwards the request to the real server. The two main benefits of a proxy server are improved performance and filtering of requests. If a proxy server is needed, the proxy server is installed (501). The process software is sent to the server(s) via a protocol such as FTP, or copied directly from a source file to a server file via file sharing (502). Another approach involves sending a transaction to the server(s) that contains the process software, and having the server process the transaction and then receive and copy the process software to the server's file system. Once the process software is stored on the server, users, via their client computers, access the process software on the server and copy it to their client computer file system (503). Another approach is to have the server automatically copy the process software to each client and then run an installation program for the process software on each client computer. The user runs a program that installs the process software on the client computer (512) and then exits the process (408).

[0168] In step 404, a determination is made whether the process software will be deployed by sending the process software to users via email. A set of users to whom the process software will be deployed is identified (405), along with the addresses of the user client computers. The process software is sent via email (504) to each of the user client computers. The user then receives the email (505) and then extracts (506) the process software from the email to a directory on their client computer. The user then executes (512) a program that installs the process software on the client computer and then exits (408) the process.

[0169] Finally, a determination is made whether the process software is to be sent directly to a user directory on their client computer (406). If so, the user directory is identified (407). The process software is transferred directly to the user's client computer directory (507). This may be done in a number of ways, including but not limited to sharing a file system directory and then copying from the sender's file system to the recipient user's file system, or alternatively using a transfer protocol such as File Transfer Protocol (FTP). The user accesses the directory on their client file system in preparation for installing the process software (508). The user executes a program that installs the process software on the client computer (512) and then exits the process (408).

[0170] The various features of the above described systems and / or methods may be combined in any manner, thereby creating multiple combinations, as will become apparent from the description provided above.

[0171] It will be further appreciated that implementations of the present invention may be provided in the form of a service that is deployed on behalf of a customer to provide the service on demand.

[0172] The description of various implementations of the present invention has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed implementations. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described implementations. The terms used in this specification are selected to best explain the principles of the implementations, practical applications, or technical improvements to the technology found in the market, or to enable those skilled in the art to understand the implementations disclosed in this specification.

Claims

1. In response to detecting a current cybersecurity event, generating a historical risk score for the current cyber-security event; generating a sigma rule detection score for the current cyber security event; generating an anomaly risk score for the current cyber-security event; generating an indicator of compromise (IoC) score for the current cyber-security event; and Using machine learning models, evaluating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score; creating an integrated risk score corresponding to the current cybersecurity event incorporating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score; step A computer-implemented method comprising:

2. Generating the historical risk score for the current cyber-security event comprises: comparing the current cyber-security events to historical cyber-security events using a second machine learning model; and determining the historical risk score based at least in part on the comparison and the corresponding responses to the historical cyber-security events. having 10. The computer-implemented method of claim 1.

3. The step of determining the historical risk score comprises: applying a time decay to the historical cyber-security events and the corresponding responses. Including, The computer-implemented method of claim 2 .

4. generating the sigma rule detection score for the current cyber security event, determining a number of rules that have fired as a result of the current cyber-security event; determining a risk score based at least in part on the number of fired rules; and Normalizing the determined risk score. having 10. The computer-implemented method of claim 1.

5. generating the anomaly risk score for the current cyber-security event, examining information associated with the current cyber-security event; identifying anomalies in the information; and determining a numerical value for each of the anomalies, the numerical value indicating an amount by which each of the anomalies deviates from a majority of the information associated with the current cyber-security event. having 10. The computer-implemented method of claim 1.

6. generating the IoC score for the current cyber security event, examining information associated with the current cyber-security event; identifying one or more types of IoC in the information; comparing the identified IoCs with information associated with historical cyber-security events; and determining the IoC score based at least in part on an overlap between the identified IoCs and the information associated with the historical cyber-security events. having wherein the one or more types of IoC identified in the information are determined based on the current cyber-security event.

10. The computer-implemented method of claim 1.

7. Utilizing the machine learning model to generate the integrated risk score includes: generating a weighting value for each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score; applying said weighting values ​​to each of said historical risk score, said sigma rule detection score, said anomaly risk score and said IoC score; and combining the weighted historical risk score, the weighted sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score to form the integrated risk score. having 10. The computer-implemented method of claim 1.

8. 8. The computer-implemented method of claim 7, wherein the machine learning model is trained using a random forest classifier and / or a permutation importance algorithm to generate weighting values ​​for each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score.

9. 2. The computer-implemented method of claim 1, wherein the operations are performed by an advanced threat prioritization system having a historical risk score module configured to generate the historical risk scores, a sigma rule detection score module configured to generate the sigma rule detection scores, an anomaly risk score module configured to generate the anomaly risk scores, and an IoC score module configured to generate the IoC scores.

10. a processor, in response to detecting a current cyber-security event; generating a historical risk score for the current cybersecurity event; generating a sigma rule detection score for the current cyber security event; generating an anomaly risk score for the current cyber-security event; generating an indicator of compromise (IoC) score for the current cybersecurity event; and Using machine learning models, evaluating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score; creating an integrated risk score corresponding to the current cybersecurity event incorporating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score; procedure A computer program for executing the above.

11. The step of generating the historical risk score for the current cyber-security event comprises: comparing the current cyber-security events to historical cyber-security events using a second machine learning model; and determining the historical risk score based at least in part on the comparison and the corresponding responses to the historical cyber-security events. having 11. A computer program product as claimed in claim 10.

12. The step of determining the historical risk score comprises: applying a time decay to the historical cyber-security events and the corresponding responses; Including, 12. A computer program product as claimed in claim 11.

13. The step of generating the sigma rule detection score for the current cyber security event comprises: determining a number of rules that have fired as a result of the current cyber-security event; determining a risk score based at least in part on the number of fired rules; and normalizing said determined risk score; having 11. A computer program product as claimed in claim 10.

14. The step of generating the anomaly risk score for the current cyber-security event includes: examining information associated with the current cyber-security event; identifying anomalies in said information; and determining a numerical value for each of the anomalies, the numerical value indicating an amount by which each of the anomalies deviates from a majority of the information associated with the current cyber-security event; having 11. A computer program product as claimed in claim 10.

15. The step of generating the IoC score for the current cyber security event comprises: examining information associated with the current cyber-security event; identifying one or more types of IoC in said information; comparing the identified IoCs with information associated with historical cybersecurity events; and determining the IoC score based at least in part on an overlap between the identified IoCs and the information associated with the historical cyber-security events. having wherein the one or more types of IoC identified in the information are determined based on the current cyber-security event.

11. A computer program product as claimed in claim 10.

16. The step of generating the integrated risk score using the machine learning model includes: generating a weighting value for each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score; applying said weighting values ​​to each of said historical risk score, said sigma rule detection score, said anomaly risk score and said IoC score; and combining the weighted historical risk score, the weighted sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score to form the integrated risk score. having 11. A computer program product as claimed in claim 10.

17. 17. The computer program product of claim 16, wherein the machine learning model is trained using a random forest classifier and / or a permutation importance algorithm to generate weighting values ​​for each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score.

18. A processor; and Logic integrated with and executable by the processor, or integrated with and executable by the processor Equipped with The logic, in response to detecting a current cyber-security event, generating a historical risk score for the current cybersecurity event; generating a sigma rule detection score for the current cyber security event; generating an anomaly risk score for the current cyber-security event; generating an indicator of compromise (IoC) score for the current cybersecurity event; and Using machine learning models, evaluating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score; creating an integrated risk score corresponding to the current cybersecurity event incorporating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score; procedure is configured to run Advanced Threat Prioritization System.

19. The step of generating the historical risk score for the current cyber-security event comprises: comparing the current cyber-security events to historical cyber-security events using a second machine learning model; and determining the historical risk score based at least in part on the comparison and the corresponding responses to the historical cyber-security events. having wherein comparing the current cyber security event to the historical cyber security events includes comparing features selected from the group consisting of a log severity score, a model escalation probability, a rare score, and an observable score.

20. The advanced threat prioritization system of claim 18.

20. The step of generating the sigma rule detection score for the current cyber security event comprises: determining a number of rules that have fired as a result of the current cyber-security event; determining a risk score based at least in part on the number of fired rules; and normalizing said determined risk score; having 20. The advanced threat prioritization system of claim 18.

21. The step of generating the anomaly risk score for the current cyber-security event includes: examining information associated with the current cyber-security event; identifying anomalies in said information; and determining a numerical value for each of the anomalies, the numerical value indicating an amount by which each of the anomalies deviates from a majority of the information associated with the current cyber-security event; having 20. The advanced threat prioritization system of claim 18.

22. The step of generating the IoC score for the current cyber security event comprises: examining information associated with the current cyber-security event; identifying one or more types of IoC in said information; comparing the identified IoCs with information associated with historical cybersecurity events; and determining the IoC score based at least in part on an overlap between the identified IoCs and the information associated with the historical cyber-security events. having wherein the one or more types of IoC identified in the information are determined based on the current cyber-security event.

20. The advanced threat prioritization system of claim 18.

23. The step of generating the integrated risk score using the machine learning model includes: generating a weighting value for each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score; applying said weighting values ​​to each of said historical risk score, said sigma rule detection score, said anomaly risk score and said IoC score; and combining the weighted historical risk score, the weighted sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score to form the integrated risk score. having 20. The advanced threat prioritization system of claim 18.

24. (i) collecting information associated with different types of cybersecurity events that have occurred over time and (ii) actions taken in response to each such cybersecurity event that has occurred; and Examining the collected information to establish a comprehensive understanding of risks associated with the different types of cyber-security events. training a machine learning model by The trained machine learning model, A procedure for evaluating newly received cybersecurity events; and generating a historical risk score for each new said cybersecurity event; The stage where A computer-implemented method comprising:

25. generating weighting values ​​for each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score; applying said weighting values ​​to each of said historical risk score, said sigma rule detection score, said anomaly risk score and said IoC score; and combining the weighted historical risk score, the weighted sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score to form an integrated risk score. training the machine learning model to generate the integrated risk score for a cyber-security event by training the machine learning model to perform A computer-implemented method comprising:

Images