Security Threat Research

Abstract

In a particular embodiment, a method performed by a computer includes receiving an analysis request based on a suspicious activity alert. The method includes, in response to receiving the analysis request, extracting key details from process data related to the suspicious activity alert based on the suspicious activity alert. The method includes identifying telemetry data for a predetermined period before and after the suspicious activity alert. The method includes obtaining contextual and organizational data related to the process data. The method includes generating a prompt based on at least the telemetry data, the contextual data, and the organizational data. The method includes receiving an analysis report, the analysis report identifying potential threats and risk mitigation steps based on the prompt. [Representative Diagram] Figure 1

Description

TECHNICAL FIELD

[0001] (Cross-Reference to Related Applications) This application claims the benefit of priority under 35 U.S.C. § 119 based on U.S. Provisional Patent Application No. 63 / 582,928, filed on September 15, 2023 and entitled "Security Threat Investigation", the disclosure of which is hereby incorporated herein by reference in its entirety for all purposes.

[0002] The present disclosure relates generally to cybersecurity, and more specifically to security threat investigation.

BACKGROUND ART

[0003] Many organizations manage a large number of end-user devices under their jurisdiction. The cybersecurity teams of these organizations are faced with a vast volume of behavior-based security alerts that require manual, time-consuming investigations due to a lack of context. There are countless edge cases that can trigger alerts, many of which can ultimately result in false positives. Some organizations lack the skilled security analysts necessary to quickly investigate and respond to various threats (e.g., macOS-specific threats). In general, cybersecurity professionals are rare and difficult to recruit. Current cybersecurity tools are generally reactive and binary. For example, such cybersecurity tools detect threats but do not provide insights related to alert investigation. As a result, analysts are often forced to consider potential hypotheses and verification steps on their own. Accordingly, there exists a need to accelerate cybersecurity investigations to determine whether a security alert is a true threat or a false positive, and to provide timely and appropriate responses to these true threats in order to reduce the risk and impact of security incidents across the organization.

[0004] Matters described in the background information section should not be considered prior art simply because they are mentioned or associated in that section. The background information section may contain information that describes one or more aspects of the subject art. [Overview of the project]

[0005] According to certain aspects of this disclosure, a computer-based method for security threat investigation is provided. The method includes receiving an analysis request based on a suspicious activity alert. In response to receiving the analysis request, the method includes extracting key details from process data related to the suspicious activity alert based on the suspicious activity alert. The method includes identifying telemetry data for a predetermined period before and after the suspicious activity alert. The method includes obtaining contextual and organizational data related to the process data. The method includes generating prompts based on at least the telemetry data, the contextual data, and the organizational data. The method includes receiving an analysis report, the analysis report identifying potential threats and risk mitigation steps based on the prompts.

[0006] According to other aspects of this disclosure, a system is provided. The system includes a memory containing instructions and a processor configured to execute the instructions, wherein when the instructions are executed, the processor receives an analysis request based on a suspicious activity alert. When the instructions are executed, the processor is configured to, in response to receiving the analysis request, extract key details from process data related to the suspicious activity alert based on the suspicious activity alert. When the instructions are executed, the processor is configured to identify telemetry data for a predetermined period before and after the suspicious activity alert. When the instructions are executed, the processor is configured to retrieve context data and organizational data related to the process data. When the instructions are executed, the processor is configured to generate a prompt based on at least the telemetry data, the context data, and the organizational data. When the instructions are executed, the processor is configured to receive an analysis report, which identifies potential threats and risk mitigation steps based on the prompt.

[0007] In other aspects of the present disclosure, a non-temporary machine-readable storage medium is provided which contains machine-readable instructions for a processor to perform a method. The method includes receiving an analysis request based on a suspicious activity alert. In response to receiving the analysis request, the method includes extracting key details from process data related to the suspicious activity alert based on the suspicious activity alert. The method includes identifying telemetry data for a predetermined period before and after the suspicious activity alert. The method includes obtaining contextual and organizational data related to the process data. The method includes generating a prompt based on at least the telemetry data, the contextual data, and the organizational data. The method includes receiving an analysis report which, based on the prompt, identifies potential threats and risk mitigation steps.

[0008] Those skilled in the art will understand that, as various configurations of the subject art are shown and described as examples in the following detailed description, other configurations of the subject art will be readily apparent. As realized, the subject art can take on other different configurations, and its details can be modified in various other ways without departing from the scope of the subject art. Note that various embodiments described herein may refer to medical, retail, educational, or corporate settings, but these are illustrative and should not be construed as limiting. The teachings of this disclosure can be applied to any mobile device environment, including but not limited to residential, medical, retail, educational, corporate, and other appropriate environments. Accordingly, the drawings and detailed description should be construed as illustrative and not restrictive. [Brief explanation of the drawing]

[0009] The accompanying drawings, included to provide further understanding and incorporated into this specification as part thereof, serve to illustrate the disclosed embodiments and to illustrate the principles of the disclosed embodiments together with the description. In the drawings:

[0010] [Figure 1] Figure 1 shows an example architecture for security threat investigation.

[0011] [Figure 2] Figure 2 is a block diagram illustrating, in some aspects of the present disclosure, an exemplary computing device, a first managed device, a second managed device, a mobile device management service, a threat analysis service, an object store, an AI service, a threat feed service, a push notification service, and an endpoint security service in the architecture of Figure 1.

[0012] [Figure 3] Figure 3 shows an example process for security threat investigation using the exemplary device shown in Figure 2.

[0013] [Figure 4] Figure 4 shows a flow diagram of an example architecture for security threat investigation shown in Figure 1.

[0014] [Figure 5] Figures 5A to 5C show illustrative diagrams related to the exemplary process in Figure 3.

[0015] [Figure 6] Figure 6 is a block diagram showing an example computer system capable of implementing the computing device, first managed device, second managed device, mobile device management service, threat analysis service, object store, AI service, threat feed service, push notification service, and endpoint security service shown in Figure 2.

[0016] In one or more embodiments, not all components depicted in each drawing are required, and one or more embodiments may include additional components not shown in the drawings. Variations in the arrangement and types of components can be made without departing from the scope of the subject disclosure. Additional components, different components, or fewer components may be used within the scope of the subject disclosure. [Modes for carrying out the invention]

[0017] The detailed description below is intended to illustrate various embodiments and is not intended to represent only one possible embodiment of the subject art. As those skilled in the art will recognize, the embodiments described can be modified in various different ways without departing from the scope of this disclosure. Accordingly, the drawings and description should be construed as illustrative and not restrictive.

[0018] Traditional cybersecurity tools detect threats but do not provide insights for investigating alerts. The disclosed technology offers a solution to this traditional approach. For example, the disclosed technology accelerates investigation and response by interactively generating hypotheses and investigation steps tailored to each macOS security alert. Furthermore, the disclosed technology leverages state-of-the-art natural language AI to uniquely generate prompts that mimic human-level reasoning in alert analysis and guidance for the next steps. In this way, the productivity of cybersecurity teams is improved and reliance on scarce cybersecurity experts is reduced. By accelerating response, the disclosed technology reduces the risk and impact of cybersecurity incidents within organizations.

[0019] Figure 1 shows an example of architecture 100 for security threat investigation. For example, architecture 100 includes at least one computing device 10, at least one managed device 12 including a first managed device 12a and a second managed device 12b through to the nth managed device 12n, a mobile device management service 14, a threat analysis service 16, an object store 18, an AI service 20, a threat feed service 22, a push notification service 24, and an endpoint security service 102, all connected via a network 26. In a particular embodiment, the mobile device management service 14 may be connected to the push notification service 24 via another network.

[0020] The mobile device management service 14 may be any device having a suitable processor, memory, and communication capabilities for communicating with at least one computing device 10, at least one managed device 12, the threat analysis service 16, and the push notification service 24. For load balancing purposes, the mobile device management service 14 may include multiple servers. The threat analysis service 16 may be any device having a suitable processor, memory, and communication capabilities for communicating with at least one computing device 10, the mobile device management service 14, the object store 18, the AI ​​service 20, and the threat feed service 22. The AI ​​service 20 may be any device having a suitable processor, memory, and communication capabilities for communicating with at least one computing device 10, the threat analysis service 16, and the threat feed service 22. The threat feed service 22 may be any device having a suitable processor, memory, and communication capabilities for communicating with at least one computing device 10, the threat analysis service 16, and the AI ​​service 20. The push notification service 24 may be any device having a suitable processor, memory, and communication capabilities for communicating with the mobile device management service 14 and at least one managed device 12. The endpoint security service 102 may be any device having a suitable processor, memory, and communication capabilities for communicating with at least one computing device 10, a threat analysis service 16, and an object store 18.

[0021] The object store 18 may be any device having a suitable processor, memory, and communication capabilities for communicating with at least one computing device 10 and the threat analysis service 16. The object store 18 may be, but is not limited to, any suitable object-based storage device for managing data as objects.

[0022] The at least one computing device 10, with which the mobile device management service 14 and the threat analysis service 16 communicate via the network 26, may be, for example, a tablet computer, a mobile phone, a mobile computer, a laptop computer, a portable media player, an eBook reader, or any other device having appropriate capabilities of a processor, a memory, and a communication function. Similarly, the at least one managed device 12 (such as a first managed device 12a and a second managed device 12b), with which the mobile device management service 14 communicates via the push notification service 24 over the network 26, may also be a tablet computer, a mobile phone, a mobile computer, a laptop computer, a portable media player, an eBook reader, or any other device having appropriate capabilities of a processor, a memory, and a communication function. In some embodiments, the mobile device management service 14, the threat analysis service, the object store 18, the AI service 20, the threat feed service 22, and the push notification service 24 may be Infrastructure as a Service (IaaS) cloud computing servers, and are capable of supporting Platform as a Service (PaaS) and Software as a Service (SaaS).

[0023] Note that although FIG. 1 illustrates one computing device 10 and two managed devices among the first managed device 12a and the second managed device 12b up to the n-th managed device 12n, the present disclosure is not limited to any particular configuration or number of devices. In certain embodiments, there may be different numbers of manager devices and / or managed devices.

[0024] The network 26 can include, for example, any one or more of a personal area network (PAN), a local area network (LAN), a campus area network (CAN), a metropolitan area network (MAN), a wide area network (WAN), a broadband network (BBN), the Internet, and the like. Further, the following network 26 may include any one or more of network topologies including, but not limited to, a bus network, a star network, a ring network, a mesh network, a star-bus network, a tree-type or hierarchical network, and the like.

[0025] Figure 2 is a block diagram illustrating an example of at least one computing device 10, a first managed device 12a, a second managed device 12b, a mobile device management service 14, a threat analysis service 16, an object store 18, an AI service 20, a threat feed service 22, and a push notification service 24 in the architecture of Figure 1, in accordance with certain aspects of the present disclosure. For illustrative purposes, the first managed device 12a and the second managed device 12b are described, but it should be understood that any number of at least one managed device 12 may be used.

[0026] At least one computing device 10, a first managed device 12a, a second managed device 12b, a mobile device management service 14, a threat analysis service 16, an object store 18, an AI service 20, a threat feed service 22, a push notification service 24, and an endpoint security service 102 are each connected to the network 26 via communication modules 28, 30, 32, 34, 36, 38, 40, 42, 44, and 45, respectively. The communication modules 28, 30, 32, 34, 36, 38, 40, 42, 44, and 45 are configured to interface with the network 26 and send and receive information such as data, requests, responses, and commands to and from other devices on the network 26. The communication modules 28, 30, 32, 34, 36, 38, 40, 42, 44, and 45 may be, for example, modems or Ethernet cards.

[0027] The mobile device management service 14 includes a processor 46, a communication module 34, and memory 48. The processor 46 of the mobile device management service 14 is configured to execute instructions, such as instructions physically coded into the processor 46, instructions received from software in memory 48, or a combination of both.

[0028] The mobile device management service 14 may correspond to hardware and / or software that implements mobile device management functionality. For example, the mobile device management service 14 may manage at least one managed device 12, such as a first managed device 12a and a second managed device 12b. Thus, the mobile device management service 14 may store (or access) inventory and grouping data related to at least one managed device 12. The inventory and grouping data may include registrant data that identifies all mobile devices managed by the mobile device management service 14, as well as data related to at least one managed device 12, including the first managed device 12a, the second managed device 12b, and the nth managed device 12n (e.g., configured task window settings), and grouping information for managed devices within the same designated group.

[0029] The first managed device 12a includes a processor 50, a communication module 30, and memory 52. ​​The processor 50 of the first managed device 12a is configured to execute instructions, such as instructions physically coded into the processor 50, instructions received from software in memory 52, or a combination of both.

[0030] The second managed device 12b includes a processor 54, a communication module 32, and memory 56. The processor 54 of the second managed device 12b is configured to execute instructions, such as instructions physically coded into the processor 54, instructions received from software in memory 56, or a combination of both.

[0031] The push notification service 24 includes a processor 58, a communication module 44, and memory 60. The processor 58 of the push notification service 24 is configured to execute instructions, such as instructions physically coded into the processor 58, instructions received from software in memory 60, or a combination of both.

[0032] The object store 18 includes a processor 62, a communication module 38, and memory 64. The processor 62 of the object store 18 is configured to execute instructions, such as instructions physically coded into the processor 62, instructions received from software in memory 64, or a combination of both.

[0033] The AI ​​service 20 includes a processor 66, a communication module 40, and memory 68. The processor 66 of the AI ​​service 20 is configured to execute instructions, such as instructions physically coded into the processor 66, instructions received from software in memory 68, or a combination of both.

[0034] The threat feed service 22 includes a processor 70, a communication module 42, and memory 72. The processor 70 of the threat feed service 22 is configured to execute instructions, such as instructions physically coded into the processor 70, instructions received from software in memory 72, or a combination of both.

[0035] At least one computing device 10 includes a processor 74, a communication module 28, and memory 76. The processor 74 of at least one computing device 10 is configured to execute instructions, such as instructions physically coded into the processor 74, instructions received from software in memory 76, or a combination of both.

[0036] The threat analysis service 16 includes a processor 78, a communication module 36, and memory 80. The processor 78 of the threat analysis service 16 is configured to execute instructions, such as instructions physically coded into the processor 78, instructions received from software in memory 80, or a combination of both. The processor 78 of the threat analysis service 16 is configured to receive analysis requests based on suspicious activity alerts identified on at least one computing device 10. In response to receiving the analysis request, the processor 78 of the threat analysis service 16 is configured to extract process data related to the suspicious activity alert based on the suspicious activity alert. The processor 78 of the threat analysis service 16 is configured to identify telemetry data for a predetermined period before and after the suspicious activity alert. The processor 78 of the threat analysis service 16 is configured to obtain context data and organizational data related to the process data. The processor 78 of the threat analysis service 16 is configured to generate prompts based on at least the telemetry data, the context data, and the organizational data. The processor 78 of the threat analysis service 16 is configured to receive an analysis report, which identifies potential threats and risk mitigation steps based on the prompt.

[0037] The endpoint security service 102 includes a processor 104, a communication module 45, and memory 106. The processor 104 of the endpoint security service 102 is configured to execute instructions, such as instructions physically coded into the processor 104, instructions received from software in memory 106, or a combination of both. The processor 104 of the endpoint security service 102 is configured to detect suspicious activity and send a suspicious activity alert 84 to at least one computing device 10 for display via a graphical user interface (GUI) 108.

[0038] It should be noted that while various embodiments described herein may refer to medical and educational settings, these are merely illustrative examples and should not be construed as limitations. The teachings of this disclosure can be applied to other mobile device environments, including but not limited to residential, corporate, retail, government, organizational, and other well-known environments.

[0039] Figure 3 shows an exemplary process 300 using a computing device 10, a threat analysis service 16, an object store 18, and, in certain embodiments, an AI service 20 and a threat feed service 22. Figure 3 is explained with reference to Figure 2, but it should be understood that the process steps in Figure 3 may be performed by other systems.

[0040] Process 300 begins when the processor 78 of the threat analysis service 16 receives an analysis request 82 from at least one computing device 10 based on a suspicious activity alert 84, and proceeds to step 310. The suspicious activity alert 84 is received by at least one computing device 10. As shown in step 312, in response to receiving the analysis request 82, the processor 78 of the threat analysis service 16 extracts process data 86 related to the suspicious activity alert 84 based on the suspicious activity alert 84. As shown in step 314, the processor 78 of the threat analysis service 16 identifies telemetry data 88 for a predetermined period before and after the suspicious activity alert 84.

[0041] As shown in step 316, the processor 78 of the threat analysis service 16 obtains context data 90 and organizational data 92 related to process data 86. The processor 78 of the threat analysis service 16 generates a prompt 94 based on at least the telemetry data 88, context data 90, and organizational data 92, as shown in step 318. As shown in step 320, the processor 78 of the threat analysis service 16 receives an analysis report 96, which identifies potential threats 98 and risk mitigation steps 100 based on the prompt 94.

[0042] Figure 4 shows an exemplary flow of the architecture for security threat investigation shown in Figure 1.

[0043] Next, an illustrative explanation will be given with reference to the exemplary process 300 in Figure 3, the exemplary flow of the architecture for security threat investigation in Figure 4, and the exemplary diagrams in Figures 5A to 5C related to the exemplary process in Figure 3.

[0044] When the endpoint security service 102 detects suspicious activity, a suspicious activity alert 84 is triggered and sent to at least one computing device 10 for display via the GUI 108, as shown in Figure 5A. A button 110 displayed via the GUI 108 can be activated by an analyst using at least one computing device 10 to initiate an analysis request 82 related to the suspicious activity alert 84 and send it to the threat analysis service 16. In certain embodiments, the endpoint security service 102 sends process data 86 (e.g., alert data) and telemetry data 88 to the object store 18.

[0045] In response to receiving an analysis request 82, the threat analysis service 16 retrieves process data 86 and telemetry data 88 from the object store 18. Once the process data 86 and telemetry data 88 are retrieved, and in response to receiving the analysis request 82, the threat analysis service 16 extracts key details from the process data 86 relating to the suspicious activity alert 84, including but not limited to process IDs, code signing information, users, command-line arguments for each process associated with the suspicious activity alert 84, and other relevant details. Furthermore, the threat analysis service 16 identifies relevant endpoint telemetry from the telemetry data 88 received from the object store 18. For example, the threat analysis service 16 can identify telemetry data 88 for a predetermined period before and after the detection of the suspicious activity alert 84 by focusing on relevant factors, including but not limited to the relevant processes, users, network activity, and other relevant elements. In a particular embodiment, the threat analysis service 16 analyzes the process data 86 and telemetry data 88.

[0046] The threat analysis service 16 also searches intelligence databases such as the threat feed service 22 to obtain information related to process data 86 (e.g., context data 90), including but not limited to security research, malware tactics, techniques, and procedures (TTPs), other context related to the processes and actions involved, and other appropriate context data. Furthermore, the threat analysis service 16 obtains organizational data 92 related to process data 86, to which it already has access through the organization's database, including but not limited to industry, VPN (Virtual Private Network) usage, administrator privileges, security team proficiency, and other appropriate organizational data.

[0047] The threat analysis service 16 uses process data 86 and telemetry data 88 received from the object store 18, as well as context data 90 and organizational data 92, to create or generate a prompt 94. The prompt 94 is carefully constructed to ask a model (e.g., AI service 20) to analyze the event that triggered the suspicious activity alert 84 from the attacker's perspective and generate a hypothesis or analysis (e.g., analysis report 96) describing the most likely scenario, including when a harmless explanation is more plausible. In addition, at least a portion of the process data 86 and telemetry data 88 received from the object store 18, as well as the context data 90 and organizational data 92, is processed to derive meaningful context and guidance for generating the prompt 94. The prompt 94 consists of a system message 112, shown in Figure 5B, and a user message 114, shown in Figure 5C. In a particular embodiment, the system message 112 is static and identical for all detection events that trigger the suspicious activity alert 84. In contrast, user messages 114 are dynamically generated based on specific detection events that trigger suspicious activity alerts 84, and can be generated using process data 86 and telemetry data 88 received from object store 18, as well as context data 90 and organizational data 92.

[0048] System messages 112 include, but are not limited to, basic job descriptions for preparing the behavior and response methods of a model (e.g., AI service 20), directional instructions including special emphasis on the format of a response or analysis (e.g., analysis report 96) and the context in which it is used, explicit instructions regarding the layout and headings including questions to consider in order to prepare the model (e.g., AI service 20) to analyze the data provided in user messages 114 and to facilitate and simulate critical thinking, repetition and specific instructions regarding the format to ensure certain consistency in the response or analysis (e.g., analysis report 96), and other appropriate instructions or directional instructions.

[0049] User message 114 may include, but is not limited to, information about the suspicious activity alert 84 itself (e.g., its relevance as part of a series of malicious events and other additional context), instructions and preparations for what to look for in process data 86 and telemetry data 88, a concise entry describing known macOS processes for use by a malicious actor, their behavior, patterns, and usage history, context data 90, organizational data 92, process data 86 received from object store 18, telemetry data 88 received from object store 18, final instructions emphasizing inference capabilities, and other appropriate instructions or directional instructions.

[0050] In response to receiving prompt 94, the AI ​​service 20 generates a detailed hypothesis (e.g., analysis report 96). In a particular embodiment, the analysis report 96 is displayed on at least one computing device 10 via the GUI 108, adjacent to event information 116 related to the event or threat that triggered the suspicious activity alert 84, as shown in Figure 5A. In a particular embodiment, the analysis report 96 includes, but is not limited to, an overview section, an inference section, a verification step section, a section identifying potential threats 98, a section listing risk mitigation steps 100, and other relevant information.

[0051] In a particular embodiment, after the analyst has interpreted the analysis report 96, the analyst can use at least one computing device 10, for example via the mobile device management service 14, to remediate security threats on the first managed device 12a.

[0052] Figure 6 is a block diagram showing an exemplary computer system 600 that can implement at least one computing device 10, a first managed device 12a, a second managed device 12b, a mobile device management service 14, a threat analysis service 16, an object store 18, an AI service 20, a threat feed service 22, a push notification service 24, and an endpoint security service 102 as shown in Figure 2. In certain embodiments, the computer system 600 may be implemented using hardware or a combination of software and hardware, as a dedicated server, integrated into another entity, or distributed across multiple entities.

[0053] The computer system 600 (for example, at least one computing device 10, a first managed device 12a, a second managed device 12b, a mobile device management service 14, a threat analysis service 16, an object store 18, an AI service 20, a threat feed service 22, a push notification service 24, and an endpoint security service 102) includes a bus 608 or other communication mechanism for communicating information and processors 602 (for example, processors 46, 50, 54, 58, 62, 66, 70, 74, 78, 104) coupled with the bus 608 for processing information. According to one embodiment, the computer system 600 may be an IaaS cloud computing server capable of supporting PaaS and SaaS services.

[0054] In addition to hardware, the computer system 600 may include code that generates an execution environment for the target computer program. For example, such code may constitute processor firmware, a protocol stack, a database management system, an operating system, or one or more combinations thereof, and may be stored in the built-in memory 604 (e.g., memories 48, 52, 56, 60, 64, 68, 72, 76, 80, 106). Such memory may include random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), eraseable PROM (EPROM), registers, hard disks, removable disks, CD-ROMs, DVDs, or other suitable storage devices, which are connected to the bus 608 to store information and instructions executed by the processor 602. The processor 602 and memory 604 may be complemented by or incorporated into application-specific logic circuits.

[0055] The instruction may be stored in memory 604 and may also be implemented as one or more computer program products. For example, the instruction may be configured as a module of one or more computer program instructions encoded on a computer-readable medium and used to execute or control the operation of a computer system 600.

[0056] The computer programs discussed herein do not necessarily correspond to files in a file system. A program may be stored in part of a file containing other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program, or in multiple collaborative files (e.g., a file containing one or more modules, subprograms, or parts of code). Computer programs can be deployed to run on a single computer, on multiple computers located at the same site, or on multiple computers distributed across multiple sites interconnected by a communication network, such as in a cloud computing environment. The processes and logic flows described herein can be realized by one or more programmable processors executing one or more computer programs, manipulating input data, and generating outputs to perform their functions.

[0057] The computer system 600 further includes a data storage device 606, such as a magnetic disk or optical disk, coupled to a bus 608 for storing information and instructions. The computer system 600 can be coupled to various devices via an input / output module 610. The input / output module 610 can be any input / output module. Examples of input / output modules 610 include data ports such as USB ports. Furthermore, the input / output module 610 may be provided in a manner that communicates with the processor 602 so that the computer system 600 can communicate with other devices over short distances. The input / output module 610 can provide, for example, wired communication in some implementations and wireless communication in others, and multiple interfaces may also be used. The input / output module 610 is configured to connect to a communication module 612. Examples of communication modules 612 (e.g., communication modules 28, 30, 32, 34, 36, 38, 40, 42, 44, 45) include network interface cards such as Ethernet cards and modems.

[0058] In certain embodiments, the input / output module 610 is configured to connect to multiple devices, such as an input device 614 and / or an output device 616. Examples of input devices 614 include a keyboard and pointing device (e.g., a mouse or trackball) that a user can use to provide input to the computer system 600. Other types of input devices 614, such as tactile input devices, visual input devices, voice input devices, or brain-computer interface devices, can also be used for user interaction.

[0059] According to one aspect of this disclosure, at least one computing device 10, a first managed device 12a, a second managed device 12b, a mobile device management service 14, a threat analysis service 16, an object store 18, an AI service 20, a threat feed service 22, a push notification service 24, and an endpoint security service 102 can be implemented using a computer system 600 in response to a processor 602 executing one or more sequences of one or more instructions contained in memory 604. Such instructions may be read into memory 604 from another machine-readable medium, such as a data storage device 606. By executing a sequence of instructions contained in main memory 604, the processor 602 performs the process steps described herein. One or more processors in a multi-processing configuration may also be used to execute a sequence of instructions contained in memory 604. The processor 602 can remotely access and process computer program products, for example, by downloading executable instructions and / or data structures from a remote server via a communication module 612 (e.g., as in a cloud computing environment). In an alternative embodiment, hardwired circuitry may be used instead of or in combination with software instructions to implement various aspects of the Disclosure. Therefore, aspects of the Disclosure are not limited to any particular combination of hardware circuitry and software.

[0060] Various aspects of the subject matter described herein can be implemented in a computing system that includes a backend component (e.g., a data server), a middleware component (e.g., an application server), or a frontend component (e.g., a client computer having a graphical user interface or web browser that allows a user to interact with an implementation of the subject matter described herein), or a combination of one or more such backend, middleware, or frontend components. For example, some aspects of the subject matter described herein can be run in a cloud computing environment. Thus, in certain embodiments, users of the systems and methods disclosed herein can perform at least some steps by accessing a cloud server via a network connection. Furthermore, data files, schematics, performance specifications, etc., arising from this disclosure can be stored in a database server within the cloud computing environment or downloaded from the cloud computing environment to a private storage device.

[0061] As used herein, the terms “machine-readable storage medium” or “computer-readable medium” refer to any medium or medium involved in providing instructions or data to the processor 602 for execution. The term “storage medium” as used herein refers to any non-temporary medium that stores data and / or instructions causing a machine to operate in a particular manner. Such mediums can take many forms, including but not limited to non-volatile media, volatile media, and transmission media.

[0062] As used herein, the terms “computer-readable storage medium” and “computer-readable medium” are limited entirely to tangible physical objects that store information in a format readable by a computer. These terms exclude radio signals, wired download signals, and any other transient signals. A storage medium is not a transmission medium, but may be used in conjunction with a transmission medium. A transmission medium is involved in the transfer of information between storage mediums. For example, transmission media include coaxial cables, copper wires, and optical fibers, including the wiring that makes up bus 608. Transmission media can also take the form of sound waves or light waves, such as those generated during radio and infrared data communications. Furthermore, as used herein, the terms “computer,” “server,” “processor,” and “memory” all refer to electronic or other technical devices. These terms exclude persons or groups of persons. In this specification, the terms “display” or “display” mean to display on an electronic device.

[0063] In one embodiment, a method may be an operation, a command, or a function (and vice versa). In one embodiment, a clause or claim may be amended to include one or more clauses, one or more words, one or more sentences, one or more phrases, one or more paragraphs, and / or some or all of the words (e.g., command, operation, function, or component) contained in any of the one or more claims.

[0064] To demonstrate hardware-software compatibility, various exemplary blocks, modules, components, methods, operations, instructions, and algorithms have generally been described in terms of their functionality. Whether such functionality is implemented as hardware, software, or a combination of hardware and software depends on the design constraints imposed on the specific application and the overall system. A skilled engineer may implement the described functionality in various ways for each specific application.

[0065] Where used herein, the phrase “at least one” preceding a list of items modifies the entire list, rather than each member (e.g., each item), using the terms “and” or “or” to separate the items. The phrase “at least one” does not require the selection of at least one item; rather, it allows the meaning to include at least one of any one of the items, and / or at least one of any combination of items, and / or at least one of each item. For example, the phrases “at least one of A, B, and C” or “at least one of A, B, or C” refer to A only, B only, or C only; any combination of A, B, and C; and at least one of each of A, B, and C, respectively.

[0066] The word “exemplary” is used herein to mean “serving as an example, case, or illustration.” Embodiments described herein as “exemplary” should not necessarily be construed as being preferable or advantageous to other embodiments. Phrases such as “aspect,” “the aspect,” “another aspect,” “some aspects,” “one or more aspects,” “implementation,” “the implementation,” “another implementation,” “some implementation,” “one or more implementations,” “embodiment,” “the embodiment,” “another embodiment,” “some embodiment,” “one or more embodiments,” “configuration,” “the configuration,” “another configuration,” “some configuration,” “one or more configurations,” “subject art,” “this disclosure,” “the current disclosure,” and other variations are for convenience only and do not imply that the disclosures associated with such phrases are essential to the subject art or that such disclosures apply to all configurations of the subject art. Disclosures associated with such phrases may apply to all configurations or one or more configurations. Disclosures associated with such phrases may provide one or more examples. Phrases such as “aspect” or “some aspects” may refer to one or more aspects (and vice versa), and this applies to the other phrases mentioned above as well.

[0067] References to singular elements, unless otherwise specified, should mean "one or more" and not "one and only one." The term "several" refers to one or more. Underlined and / or italicized headings and subheadings are for convenience only and are not intended to limit the subject art, nor are they referenced in connection with the interpretation of the description of the subject art. Relational terms such as "first" and "second" may be used to distinguish one entity or action from another without necessarily requiring or implying the existence of an actual relationship or order between such entities or actions. All structural and functional equivalents to elements of the various constructs of the subject art described throughout this disclosure, known or to those skilled in the art, are expressly incorporated herein by reference and intended to be encompassed by the subject art. Furthermore, nothing disclosed herein, whether or not such disclosure is expressly stated in the above description, is intended to be made available to the public. No claim element should be construed under the provisions of paragraph 6 of 35 U.S.C. §112 unless it is expressly described using the phrase “means for” or, in the case of a method claim, the element is described using the phrase “step for.”

[0068] This specification includes many specific details, which should not be construed as limitations on the scope that can be claimed, but rather as descriptions of specific embodiments of the subject matter. Certain features described herein in the context of separate embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable subcombination in multiple embodiments. Furthermore, features are described above as functioning in a particular combination, and may be initially claimed as such, but one or more features from a claimed combination may be removed from the combination, and the claimed combination may be a subcombination or a variation of a subcombination.

[0069] While the subject matter of this specification has been described in terms of specific embodiments, other embodiments can also be implemented and are within the scope of the following claims. For example, although operations are depicted in a specific order in the drawings, this should not be understood as requiring that such operations be performed in the specific order or sequence shown, or that all depicted operations be performed, in order to achieve the desired result. The operations described in the claims can still achieve the desired result even if they are performed in a different order. As an example, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequence shown to achieve the desired result. In certain circumstances, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system components in the embodiments described above should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated into a single software product or packaged into multiple software products.

[0070] The title, background art, brief description of the drawings, abstract, and drawings of this specification are incorporated into this disclosure and provided as exemplary examples of the disclosure, not as restrictive descriptions. They are submitted with the understanding that they are not to be used to limit the scope or meaning of the claims. Furthermore, in the detailed description, it can be seen that the description provides exemplary examples and that various features are grouped together in various embodiments for the purpose of streamlining the disclosure. The method of disclosure should not be construed as reflecting an intention that the claimed subject matter requires more features than expressly stated in each claim. Rather, as the claims reflect, the inventive subject matter lies in fewer features than all the features of a single disclosed configuration or operation. Each claim stands alone as an independently claimed subject matter and is incorporated into the detailed description of this specification.

[0071] The claims are not intended to be limited to the embodiments described herein, but are given the full scope consistent with the language of the claims and are intended to encompass all legal equivalents. Nevertheless, no claim is intended, nor should it be construed, to encompass subject matter that does not meet the requirements of applicable patent law.

Claims

1. A computer-based method for security threat investigation, Receiving analysis requests based on suspicious activity alerts, In response to receiving the aforementioned analysis request, based on the aforementioned suspicious activity alert, key details are extracted from the process data related to the suspicious activity alert, Identifying telemetry data for a predetermined period before and after the suspicious activity alert, To obtain contextual data and organizational data related to the aforementioned process data, To generate prompts based at least on the telemetry data, the context data, and the organizational data, A computer-based method comprising receiving an analysis report, wherein the analysis report identifies potential threats and risk mitigation steps based on the prompt.

2. A method by which the computer according to claim 1 generates the prompt, based on the derived context and guidance of at least the telemetry data, the context data, and the organizational data.

3. The method performed by a computer according to claim 1, wherein the key details include one of the process ID, code signing information, user, and command-line arguments of each process related to the suspicious activity alert.

4. A computer-based method according to claim 1, wherein identifying the telemetry data includes focusing on relevant factors, including one of the relevant processes, users, and network activities.

5. The method performed by a computer according to claim 1, further comprising searching a threat feed service to obtain relevant information relating to the process data.

6. The method performed by a computer according to claim 5, wherein the aforementioned related information includes one of security research and malware tactics, techniques, and procedures.

7. The method performed by a computer according to claim 1, wherein the prompt includes a system message and a user message, the system message being static and the user message being dynamically generated based on a detection event that triggers the suspicious activity alert.

8. It is a system, Memory containing instructions, A processor configured to execute the instruction, wherein when the instruction is executed, the processor We receive an analysis request based on a suspicious activity alert. In response to receiving the aforementioned analysis request, based on the suspicious activity alert, key details are extracted from the process data related to the suspicious activity alert. Identify telemetry data for a predetermined period before and after the suspicious activity alert, Context data and organizational data related to the aforementioned process data are obtained, A prompt is generated based at least on the telemetry data, the context data, and the organizational data. A system configured to receive an analysis report, the analysis report identifying potential threats and risk mitigation steps based on the prompt.

9. The system according to claim 8, wherein the prompt is based on the derived context and guidance of at least the telemetry data, the context data, and the organizational data.

10. The system according to claim 8, wherein the key details include one of the process ID, code signing information, user, and command-line arguments of each process related to the suspicious activity alert.

11. The system according to claim 8, wherein identifying the telemetry data includes focusing on relevant factors, including one of the relevant processes, users, and network activities.

12. The system according to claim 8, wherein the processor is further configured to execute the instruction to search a threat feed service to obtain relevant information relating to the process data.

13. The system according to claim 12, wherein the aforementioned related information includes security research and one of malware tactics, techniques, and procedures.

14. The system according to claim 8, wherein the prompt includes a system message and a user message, the system message being static, and the user message being dynamically generated based on a detection event that triggers the suspicious activity alert.

15. A non-temporary machine-readable storage medium containing machine-readable instructions for causing a processor to perform a method, wherein the method is Receiving analysis requests based on suspicious activity alerts, In response to receiving the aforementioned analysis request, based on the aforementioned suspicious activity alert, key details are extracted from the process data related to the suspicious activity alert, Identifying telemetry data for a predetermined period before and after the suspicious activity alert, To obtain contextual data and organizational data related to the aforementioned process data, To generate prompts based at least on the telemetry data, the context data, and the organizational data, The process includes receiving an analysis report, the analysis report being a non-temporary, machine-readable storage medium that identifies potential threats and risk mitigation steps based on the prompt.

16. The non-temporary machine-readable storage medium according to claim 15, wherein the generation of the prompt is based on the derived context and guidance of at least the telemetry data, the context data, and the organizational data.

17. The non-temporary machine-readable storage medium according to claim 15, wherein the main details include one of the process ID, code signing information, user, and command-line arguments of each process related to the suspicious activity alert.

18. The non-temporary machine-readable storage medium according to claim 15, wherein identifying the telemetry data includes focusing on relevant factors, including one of the relevant processes, users, and network activities.

19. The non-temporary machine-readable storage medium according to claim 15, further comprising searching a threat feed service to obtain relevant information relating to the process data.

20. The non-temporary machine-readable storage medium according to claim 15, wherein the prompt includes a system message and a user message, the system message being static, and the user message being dynamically generated based on a detection event that triggers the suspicious activity alert.

Images