Proactive cybersecurity monitoring methods and systems

Abstract

A cybersecurity monitoring method, executed by a system, includes the following steps: (A) for each piece of group data, determining whether at least one of multiple candidate historical anomaly events among multiple historical anomaly event information is related to the group anomaly event information of the group data; (B) for each piece of group data, when the determination result is negative, waiting for a first time interval and then repeating step (A); (C) for each piece of group data, when the determination result is positive, obtaining at least one target historical anomaly event information related to the group anomaly event information of the group data from the candidate historical anomaly event information; (D) for each piece of group data, adding the at least one target historical anomaly event information as group anomaly event information to the group data to update the group data.

Claims

1. A proactive cybersecurity monitoring method, executed by a system that stores multiple historical abnormal event information and multiple group data. Each historical abnormal event information includes a trigger time and a target resource having at least one of a target IP, a target account, and victim host information. Each group data includes multiple interrelated group abnormal event information. The method includes the following steps: (A) For each group data, determining whether at least one of the multiple candidate historical abnormal event information in the historical abnormal event information is related to the group abnormal event information in the group data, wherein comparing the target resource of the candidate historical abnormal event information with the target resource of at least one group abnormal event information in the group data to determine whether the candidate historical abnormal event information is related to the group data, and the time difference between the trigger time of each candidate historical abnormal event information and a current time is less than a first time interval; (B) For each piece of group data, when it is determined that none of the candidate historical anomaly information is related to the group anomaly information of the group data, determine whether the difference between the current time and the time of the last update of the group data is greater than a second time interval greater than the first time interval. If it is determined that the difference between the current time and the time of the last update of the group data is less than or equal to the second time interval, wait for the first time interval and repeat step (A). When it is determined that the difference between the current time and the time of the last update of the group data is greater than the second time interval, the process ends. (C) For each piece of group data, when it is determined that at least one of the candidate historical anomaly information is related to the group anomaly information of the group data, obtain at least one target historical anomaly information related to the group anomaly information of the group data from the candidate historical anomaly information, wherein... (D) For each piece of target historical anomaly information, the target resource is the same as the target resource of the group anomaly information of the group data; (E) For each piece of group data, add the at least one piece of target historical anomaly information as group anomaly information to the group data to update the group data; (F) For each piece of group data, update the risk score corresponding to the group data according to the group anomaly information of the group data; and (F) For each piece of group data, adjust at least one of the first time interval and the second time interval according to the risk score corresponding to the group data, wherein when the updated risk score is higher than the previous risk score, shorten the first time interval to increase the monitoring frequency, and increase the second time interval to extend the monitoring time.

2. A proactive cybersecurity monitoring system, comprising: a storage unit storing multiple historical abnormal event information and multiple group data, each historical abnormal event information including a trigger time and a target resource, each group data including multiple interrelated group abnormal event information; and a processing unit electrically connected to the storage unit; the processing unit executing the proactive cybersecurity monitoring method as described in claim 1.

Images