Data enrichment method and system

Abstract

A data enrichment method, the method constituted of: receiving incident information associated with an incident in a target of interest; based at least in part on the received incident information, analyzing data associated with the target of interest to identify: an effect of the incident within the target of interest, and existing one or more mitigations associated with the incident; and outputting information regarding the incident, the output information comprising the identified effect and identified one or more mitigations, wherein the incident information comprises information regarding detected anomalous behavior in the target of interest or information regarding a detected vulnerability in the target of interest, and wherein the analyzed data is based on a plurality of sources.

Description

DATA ENRICHMENT METHOD AND SYSTEMTECHNICAL FIELD

[0001] The present disclosure relates substantially to the field of cyber security, and more particularly to data enrichment.BACKGROUND

[0002] A security operations center (SOC) is responsible for protecting an organization against cyber threats. SOC analysts typically perform round-the-clock monitoring of an organization’s network and investigate any potential security incidents. If a cyberattack is detected, the SOC analysts may be responsible for taking any steps necessary to remediate it. SOCIn some examples, the SOC is operated by an external provider, which offers remote monitoring and management services to organizations. One example of such an SOC is in the field of automotive cyber security, which is typically called a vehicle SOC (SOC).SUMMARY

[0003] Accordingly, it is a principal object of the present invention to overcome at least some of the disadvantages of prior art cyber security systems and methods. This is provided in some examples by a data enrichment method, the method comprising receiving incident information associated with an incident in a target of interest. In some examples, based at least in part on the received incident information, the method comprises analyzing data associated with the target of interest to identify: an effect of the incident within the target of interest; and / or existing one or more mitigations associated with the incident. In some examples, the method further comprises outputting information regarding the incident, the output information comprising the identified effect and identified one or more mitigations. In some examples, the incident information comprises information regarding detected anomalous behavior in the target of interest or information regarding a detected vulnerability in the target of interest. In some examples, the analyzed data is based on a plurality of sources.

[0004] Additional features and advantages of the invention will become apparent from the following drawings and description.

[0005] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. In case of conflict, the patent specification, including definitions, governs. As used herein, the articles "a" and "an" mean "at least one" or "one or more" unless the context clearly dictates otherwise. As utilized herein, “and / or” means any one or more of the items in the list joined by “and / or”. As an example, “x and / or y” means any element of the three-element set {(x), (y), (x, y) } . In other words, “x and / or y” means “x, y or both of x and y”. As some examples, “x, y, and / or z” means any element of the seven-element set {(x), (y), (z), (x, y), (x, z), (y, z), (x, y, z)}.

[0006] Further, unless expressly stated to the contrary, “or” refers to an inclusive or and not to an exclusive or. For example, a condition A or B is satisfied by anyone of the following: A is true (or present) and B is false (or not present), A is false (or not present) and B is true (or present), and both A and B are true (or present).

[0007] In addition, use of the “a” or “an” are employed to describe elements and components of embodiments of the instant inventive concepts. This is done merely for convenience and to give a general sense of the inventive concepts, and “a” and “an” are intended to include one or at least one and the singular also includes the plural unless it is obvious that it is meant otherwise.

[0008] As used herein, the term "about", when referring to a measurable value such as an amount, a temporal duration, and the like, is meant to encompass variations of + / -10%, more preferably + / -5%, even more preferably + / -1%, and still more preferably + / -0.1% from the specified value, as such variations are appropriate to perform the disclosed devices and / or methods.

[0009] The term "fine-tuning", as used herein, means a method where weights of a pretrained model are trained on new data, as known to those skilled in the art. In some examples, as known to those skilled in the art, fine-tuning comprises inputting data into the LLM and the LLM is prompted to fine-tune a predetermined sub-set of weights thereof based on a lossfunction. In some examples, the output of the LLM is input into a second LLM which generates an input for the loss-function, as known to those skilled in the art. It is noted that this is merely one method for performing fine-tuning, and is not meant to be limiting in any way.

[0010] The following embodiments and aspects thereof are described and illustrated in conjunction with systems, tools and methods which are meant to be exemplary and illustrative, but not limiting in scope. In various embodiments, one or more of the above-described problems have been reduced or eliminated, while other embodiments are directed to other advantages or improvements.BRIEF DESCRIPTION OF DRAWINGS

[0011] For a better understanding of the invention and to show how the same may be carried into effect, reference will now be made, purely by way of example, to the accompanying drawings in which like numerals designate corresponding sections or elements throughout.

[0012] With specific reference now to the drawings in detail, it is stressed that the particulars shown are by way of example and for purposes of illustrative discussion of the preferred embodiments of the present invention only and are presented in the cause of providing what is believed to be the most useful and readily understood description of the principles and conceptual aspects of the invention. In this regard, no attempt is made to show structural details of the invention in more detail than is necessary for a fundamental understanding of the invention, the description taken with the drawings making apparent to those skilled in the art how several forms of the invention may be embodied in practice.

[0013] In the drawings:

[0014] FIG. 1A illustrates a high-level block diagram of a Data enrichment system, in accordance with some examples of the disclosure;

[0015] FIG. IB illustrates a high-level block diagram of a connection of the Data enrichment system of FIG. 1A with a data source, in accordance with some examples of the disclosure;

[0016] FIG. 1C illustrates a high-level block diagram of a statistical model, in accordance with some examples of the disclosure

[0017] FIG. ID illustrates a high-level block diagram of a more detailed example of the Data enrichment system of FIGs. 1A - IB;

[0018] FIG. IE illustrates a high-level block diagram of a connection of the Data enrichment system of FIG. 1A with an SOC, in accordance with some examples of the disclosure;

[0019] FIG. 2A illustrates a high-level flow chart of a first data enrichment method, in accordance with some examples of the disclosure;

[0020] FIG. 2B illustrates a high-level flow chart of a second data enrichment method, in accordance with some examples of the disclosure; and

[0021] FIG. 3 illustrates a high-level flow chart of a method of performing security analysis, in accordance with some examples of the disclosure.DETAILED DESCRIPTION OF CERTAIN EXAMPLES

[0022] In the following description, various aspects of the disclosure will be described. For the purpose of explanation, specific configurations and details are set forth in order to provide a thorough understanding of the different aspects of the disclosure. However, it will also be apparent to one skilled in the art that the disclosure may be practiced without specific details being presented herein. Furthermore, well-known features may be omitted or simplified in order not to obscure the disclosure. In the figures, like reference numerals refer to like parts throughout. In order to avoid undue clutter from having too many reference numbers and lead lines on a particular drawing, some components will be introduced via one or more drawings and not explicitly identified in every subsequent drawing that contains that component.

[0023] FIG. 1A illustrates a high-level block diagram of a data enrichment system 10. In some examples, data enrichment system 10 comprises: a data interface 20; a processor 30; and a memory 40. In some examples, each of data interface 20, processor 30 and memory 40 are elements within a cloud server.

[0024] In some examples, data interface 20 comprises software and / or hardware configured to communicate with an external network. In some examples, as illustrated in FIG. IB, data interface 20 is in communication with a data source 45. In some examples, data source 45 can be a network; a predetermined sender within a cloud server containing data enrichment system 10, such as an original equipment manufacturer (OEM); or a predetermined sender within a network containing data enrichment system 10. Although data interface 20 isillustrated as being in communication with only a single data source 45 this is not meant to be limiting in any way, and data interface 20 may be in communication with any number of data sources 45.

[0025] In some examples, as will be described below, data interface 20 receives log information, and optionally log digests from data source 45.

[0026] In some examples, memory 40 has stored therein a plurality of instructions which when read by processor 30 cause processor 30 to perform one or more steps, as will be described below. Although data enrichment system 10 is described herein in relation to examples wherein a single processor 30 is provided, this is not meant to be limiting in any way and the operations of processor 30 can be implemented by a plurality of processors 30 without exceeding the scope of the disclosure.

[0027] In some examples, a section 50 of memory 40 has stored therein a plurality of statistical models. In some examples, each statistical model is associated with a respective target of interest within the target of interest. In some examples, each target of interest comprises: one or more signals; and / or or one or more components.

[0028] In some examples, each statistical model contained within section 50 of memory 40 is generated based at least in part on network traffic received from a target of interest. In some examples, each statistical model contains statistical values associated with the respective target of interest. In some examples, each statistical model comprises a Bayesian network. In some examples, each statistical model comprises a Markov Random Field model. In some examples, the statistical model represents the statistical behavior of a set of signals within the target of interest. In some examples, the accuracy of the statistical model is based on a risk value associated with the respective target of interest. For example, for higher risk signals / components, the respective statistical models are more accurate.

[0029] In some examples, section 50 of memory 50 comprises a plurality of statistical models 100. FIG. 1C illustrates a high-level block diagram of an example of a statistical model 53. In some examples, as illustrated in FIG. 1C, each statistical model 53 comprises a plurality of statistical sub-models 54. The term "statistical sub-model", as used herein, means a statistical model representing the statistical behavior of a respective sub-set of the set of signals associated with the respective statistical model 53. In some examples, for each statistical model53, the model comprises the statistical relationships between signals of different sub-models 100.

[0030] In some examples, a section 51 of memory 40 comprises configuration information associated with the plurality of targets of interest. In some examples, the configuration information comprises one, or a combination, of: bug reports of libraries or assets associated with the targets of interest; software bills of material (SBOMs) of the target of interest; a specification sheet of the target of interest; a network database (e.g., an ARXML database, DBC database, or other network databases) comprising information regarding communication properties of a network; runtime configuration information of software components; or additional configuration information.

[0031] In some examples, a section 52 of memory 40 comprises security threat data associated with the target of interest. In some examples, the security threat data comprises attack trees, or attack paths, of a threat analysis and risk assessment (TARA). The term "attack tree", or "attack path", as defined herein, is a branching, hierarchical data structure that represents a set of potential approaches to achieving an event in which system security is penetrated or compromised in a specified way. An "attack step", as defined herein, is any node of the attack tree or attack path. It is noted that although the disclosure references TARA, this is not meant to be limiting in any way, and any other risk assessment methodology can be used, such as risk management framework (RMF), Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE), or other methodologies.

[0032] In some examples, the security threat data comprises data received from cyber threat intelligence. In some examples, processor 30 retrieves cyber threat intelligence via data interface device 20. In some examples, the security threat data comprises data received from a plurality of sources. In some examples, the security threat

[0033] In some examples, memory 40 comprises a respective cyber-model for each target of interest. The term "cyber- model", as used herein, means a model of the target of interest, or of an asset within the target of interest. In some examples, the cyber-model comprises: a description of components within the target of interest; a description of connections of the target of interest to other systems; and risk analysis data of the target of interest, such as attack paths associated with different threats. In some examples, the cyber-model further comprises:information regarding configuration data of the asset / system; specifications of the asset / system; and / or the operational state of the asset / system.

[0034] In some examples, a section 57 of memory 40 comprises an attack path database. In some examples, attack path database 57 comprises a plurality of attack paths, each with a respective plurality of attack steps. The term "attack path" as used herein, means a sequence of attack steps. The term "attack step", as used herein is any description of an attack, on any resource or asset.

[0035] In some examples, each attack path has a respective risk level associated therewith. In some examples, the term "risk level", as used herein, is defined as a predetermined function of the respective feasibility value and the respective impact value. In some examples, the impact value is a numerical indication of the impact that a particular threat will have on the respective asset (or on the item itself) if the respective threat is realized. In some examples, impact values are assigned numerical values, as known to those skilled in the art.

[0036] In some examples, the feasibility value of an attack path, is a predetermined function of the feasibility values of each of the attack steps therewithin. Thus, in some examples, the feasibility value of each attack step affects the feasibility value of the overall attack path. For example, if one of the attack steps has a low feasibility value, this can reduce the feasibility value of the respective attack path.

[0037] In some examples, attack path database 57 further comprises data regarding a plurality of mitigations, each associated with a respective attack step. In some examples, the mitigations comprise a plurality of security controls. The term "security control", as used herein, means methods that are used to reduce the feasibility of the attack step. For example, in regards to an attack step defined as “Send malicious message”, which may have a feasibility rating High, implementing a security control of “implement firewall to prevent unauthorized messages” reduces the feasibility of the attack step to Medium.

[0038] FIG. ID illustrates a more detailed example of data enrichment system 10, further comprising a model generation device 60 that generates the plurality of statistical models. In some examples, model generation device 60 is implemented as a respective plurality of instructions stored in memory 40, that when run by processor 30 cause processor 30 to perform the steps of model generation device 60.

[0039] In some examples, data enrichment system 10 comprises a statistical analysis device 65. In some examples, statistical analysis device 65 is implemented as a respective plurality of instructions stored in memory 40, that when run by processor 30 cause processor 30 to perform the steps of statistical analysis device 65.

[0040] In some examples, data enrichment system 10 further comprises a log digest device 70. In some examples, log digest generation device 70 is implemented as a respective plurality of instructions stored in memory 40, that when run by processor 30 cause processor 30 to perform the steps of log digest device 70. In some examples, a separate log digest device 70 is not provided, and log digests are received at data interface 20 from an external source. In some examples, log digest device 70 summarizes the received log information in accordance with predetermined summarization rules.

[0041] In some examples, data enrichment system 10 further comprises an anomaly analysis device 80. In some examples, anomaly analysis device 80 is implemented as a respective plurality of instructions stored in memory 40, that when run by processor 30 cause processor 30 to perform the steps of anomaly analysis device 80.

[0042] In some examples, data enrichment system 10 further comprises a data retrieval device 90. In some examples, data retrieval device 90 comprises a search engine. In some examples, data retrieval device 90 is implemented as a respective plurality of instructions stored in memory 40, that when run by processor 30 cause processor 30 to perform the steps of data retrieval device 90.

[0043] In some examples, data retrieval device 90 comprises a connection to one or more data sources 95. In some examples, data retrieval device 90 comprises one or more of: a connection to the internet; a connection to a database, or databases; or a connection to a repository, or repositories. The databases and / or repositories can be stored within memory 40, within a separate memory, and / or within a different network, and data retrieval device 90 comprises an appropriate connection for any of these options. In some examples, data retrieval device 90 is further in communication with an external system, process and / or network.

[0044] In some examples, model generation device 60 receives network traffic data, contained within network packets, and learns the statistical model based on the received traffic data. In some examples, the network traffic data is received by data interface 20. In one example, where the statistical model comprises a distribution with a respective average anddistribution, the model is learned by calculating a respective distribution function (such as a normal distribution function). In another example, where the statistical model comprises an autoregressive (AR) model, the coefficients of the model are learned by applying an optimization algorithm to the data, such as a maximum likelihood estimation.

[0045] In some examples, the network traffic data is received from data source 45. In some examples, the network traffic data is received from an OEM. In some examples, the network traffic data is received directly from the system producing the traffic.

[0046] In some examples, one or more of the statistical models are not generated by model generation device 60. Rather, in such examples, the one or more statistical models are received from data source 45. For example, the one or more statistical models can be received from an OEM.

[0047] In some examples, statistical analysis device 65 similarly receives network traffic data, contained within network packets, and identifies statistical relationships between various signals within the network traffic data. As used herein, the term "statistical relationship between various signals" means a statistical relationship between the transmission of one signal and the transmission of another signal within the network. In some examples, a statistical relationship between two signals is identified by identifying the average time between transmission of a first signal and transmission of a second signal. In some examples, statistical analysis device 65 determines a correlation function between the transmission times of two signals to determined a statistical relationship therebetween.

[0048] In some examples, data enrichment system 10 further comprises a language analysis device 85. In some examples, language analysis device 85 is implemented as a large language model (LLM) 85, and will be described as such unless otherwise stated. In some examples, as will be described below, language analysis device 85 can be implemented as a natural language processor. One illustrative example of LLM 85, without any limitation, is from the LLaMa-2 large language model family, commercially available from Meta Al.

[0049] In some examples, LLM 85 is fine-tuned on predefined data. Although the below is described in relation to fine-tuning of a trained LLM 85, this is not meant to be limiting in any way. In some examples, the below described steps of fine-tuning LLM 85 are performed in the process of training of LLM 85, with the appropriate changes, as known to those skilled in the art.

[0050] In some examples, a list of libraries associated with the asset are input to LLM 85, as will be described below, such that the data output by LLM 85 is relevant to these libraries. The term "associated with the asset", as used herein in relation to libraries means libraries that are accessed by the asset and / or accessed libraries that the asset uses data affected by the accessed library. For example, a first process accesses a library and utilizing the accessed library gets certain data, and stores the data in a queue. A second process, which is part of the asset, retrieves the data from the queue. Thus, in such an example, the library is associated with the asset since the asset retrieves data that is associated with the library.

[0051] In some examples, when prompting LLM 85 to output data based on the list of libraries, the list of libraries is input to LLM 85 as a soft prompt. The term "soft prompt", as used herein, means learnable tensors concatenated with the input embeddings.

[0052] In some examples, a specification sheet of the asset is input to LLM 85 , as will be described below, such that the data output by LLM 85 is relevant to the specification sheet. In some examples, when prompting LLM 85 to output data based on the specification sheet, the data in the specification sheet is input to LLM 85 as a soft prompt. In some examples, TARA data, such as TARA information, of the asset, is input to LLM 85 such that the data output by LLM 85 is relevant to the TARA data, as will be described below. In some examples, when prompting LLM 85 to output data based on the TARA data, the TARA data, or predetermined parameters thereof, is input to LLM 85 as a soft prompt.

[0053] In some examples, a cyber-model is input to LLM 85 such that the data output by LLM 85 is relevant to the cyber-model. In some examples, when prompting LLM 85 to output data based on the cyber-model, the cyber-model, or predetermined portions thereof, is input to LLM 85 as a soft prompt.

[0054] In some examples, as illustrated in FIG. ID, data enrichment system 10 is further in communication with a response unit 98. In some examples, response unit 98 is a security operations center (SOC). In some examples, response unit 98 is an incident response team. In some examples, communication with response unit 98 is performed via data interface 20.

[0055] FIG. 2A illustrates a high-level flow chart of a data enrichment method, in accordance with some examples. The method of FIG. 2A is being described herein in relation to data enrichment system 10, however this is not meant to be limiting in any way, and themethod can be implemented using any suitable system. It is noted that any of the steps of the flow chart of FIG. 2A may be optional, without exceeding the scope of the disclosure.

[0056] The term "enrichment", as used herein, is meant to have the same meaning as the term "improvement", and is not meant to be limiting in any way.

[0057] In stage 900, information is received at data interface 20. In some examples, the received information comprises incident information. In some examples, the received incident information comprises information associated with anomalous behavior occurring in the target of interest or information regarding a detected vulnerability in the target of interest. In some examples, the anomalous behavior is identified by an external source. The term "anomalous behavior", as used herein, means behavior of that is outside of the norm. For example, this can include unexpected signal values, optionally determined based on an outcome of a comparison with a statistical model, as will be described below. In some examples, the detected vulnerability information is received from a database of vulnerabilities, such as the CVE database.

[0058] In some examples, the received information comprises log information associated with a target of interest. In some examples, the target of interest is at least a portion of a vehicle, charging station or any of various industrial devices.

[0059] In some examples, the log information contains data regarding recorded network traffic and / or events within the target of interest. In some examples, the log information contains data regarding a plurality of targets of interest within the target of interest, such as a plurality of ECUs within a vehicle. In some examples, the data comprises signal values, derived quantities of signal values, and events of each target of interest. For example, the data may contain speed values of the vehicle at predetermined time intervals. An example of an event can be the driver of the vehicle having pressed a particular button.

[0060] In some examples, in stage 910, based at least in part on the received incident information, data associated with the target of interest is analyzed to identify: an effect of the incident within the target of interest, and existing one or more mitigations, such as a security control, associated with the incident.

[0061] In some examples, the data associated with the target of interest being analyzes is based on a plurality of sources.

[0062] In some examples, the plurality of sources comprises two or more of: technical artifacts of the target of interest; product architecture associated with the target of interest; a risk assessment analysis; a software bill of material (SBOM); comprises a specification sheet associated with the target of interest; a bug report; data received from electronic control units (ECUs), or other components, within the target of interest; data received from sensors within the target of interest; threat intelligence, such as information retrieved from online databases and other information sources regarding threats.

[0063] In some examples, the effect of the incident comprises: a risk level of the attack path; and an indication of which of a plurality of portions of the target of interest can be affected by the incident.

[0064] In some examples, an attack step is identified within the plurality of attack paths associated with the target of interest, and the indication of which portion of the target of interest can be affected is based at least in part on the attack path containing the identified attack step. In some examples, each attack path is associated with a respective portion of the target of interest.

[0065] In some examples, an attack step is identified within the plurality of attack paths associated with the target of interest, wherein the effect of the incident comprises an indication of which of a plurality of portions of the target of interest can be affected by the incident, and wherein the indication of which portion of the target of interest can be affected is based at least in part on the attack path containing the identified attack step.

[0066] In some examples, an attack step is identified within the plurality of attack paths associated with the target of interest, wherein the output information comprises the attack path containing the identified attack step.

[0067] In some examples, identifying the attack step comprises: based at least in part on the received incident information and a cyber-model of the target of interest, identifying a respective component within the target of interest; and identifying an attack step associated with the identified component.

[0068] In some examples, a signal is received and anomalous behavior is identified in the signal. In some examples, information regarding the source and destination of the signal is usedto identify the respective components (i.e., the source and destination), and the attack paths, or attack step / s, associated with the respective components are identified.

[0069] In some examples, where vulnerability information is received, such as a CVE, the vulnerability information may comprises information regarding a respective software package. In such an example, the software package is identified within the SBOM and the component associated with that software package is thus identified. In some examples, the attack paths, or attack step / s, associated with the identified component are identified.

[0070] In some examples, in stage 920, information is output regarding the incident, the output information comprising the identified effect and identified one or more mitigations.

[0071] FIG. 2B illustrates a high-level flow chart of a data enrichment method, in accordance with some examples. The method of FIG. 2B is being described herein in relation to data enrichment system 10, however this is not meant to be limiting in any way, and the method can be implemented using any suitable system. It is noted that any of the steps of the flow chart of FIG. 2B may be optional, without exceeding the scope of the disclosure.

[0072] In stage 1000, information is received at data interface 20. In some examples, the received information comprises incident information. In some examples, the received incident information comprises information associated with anomalous behavior occurring in the target of interest or information regarding a detected vulnerability in the target of interest. In some examples, the anomalous behavior is identified by an external source. The term "anomalous behavior", as used herein, means behavior of that is outside of the norm. For example, this can include unexpected signal values, optionally determined based on an outcome of a comparison with a statistical model, as will be described below. In some examples, the detected vulnerability information is received from a database of vulnerabilities, such as the CVE database.

[0073] In some examples, the received information comprises log information associated with a target of interest. In some examples, the target of interest is at least a portion of a vehicle, charging station or any of various industrial devices.

[0074] In some examples, the log information contains data regarding recorded network traffic and / or events within the target of interest. In some examples, the log information contains data regarding a plurality of targets of interest within the target of interest, such as aplurality of ECUs within a vehicle. In some examples, the data comprises signal values, derived quantities of signal values, and events of each target of interest. For example, the data may contain speed values of the vehicle at predetermined time intervals. An example of an event can be the driver of the vehicle having pressed a particular button.

[0075] In some examples, processor 30 extracts at least a predetermined portion of the data within the receiving information. In some examples, the portion of the data extracted is the data associated with a respective target of interest. In some examples, processor 30 extracts the entirety of the data within the receiving information.

[0076] In some examples, the received log information comprises a digest of the log information. In some examples, the received log information comprises both: at least a portion of the data contained within the log information; and a digest of the log information. In some examples, the digest of the log information is received from log digest device 70. In some examples, the digest of the log information is received from data source 45. In some examples, the digest of the log information is provided from the same supplier of the log information themselves.

[0077] In some examples, the log information is received from an OEM along with an indication of the presence of a suspected anomaly, threat, attack, or other security related issue.

[0078] In some examples, log information is received at predetermined intervals. In some examples, log information is received at less than 10 second time intervals.

[0079] In some examples, the information may be provided along with configuration information regarding the target of interest. In some examples, the received configuration information can include one or more of the following, without limitation:A. Configuration settings relevant for the operating system, for example: i. The scheduling policy used, e.g., preemptive round robin, preemptive Shortest- Remaining-Time-First, non-preemptive; and / or ii. The stack sizes for the several OS tasks to be scheduled.B. Configuration settings relevant for application software components, for example: i. Communication ports that might be connected to other software components; and / or ii. The triggering of API function e.g., trigger a cyclic function ever 100 milli seconds.C. Configuration settings relevant for the network topology, for example: i. The communication nodes taking part in a system; and / or ii. The baud rate of a CAN bus.D. Configuration settings relevant for data being communicated, for example: i. The start bit and length of a signal contained in a Protocol Data Unit (PDU); and / or ii. The physical SI unit associated to a signals value.E. Configuration settings relevant for hypervisors, for example: i. The CPU(s) allocated for a virtual environment; and / or ii. The amount of volatile memory (RAM) allocated for a virtual environment.F. Configuration settings relevant for virtualization solutions, for example: i. Security policies to be applied to a virtualized environment, e.g., whether to allow network access for the guest system; and / or ii. Options for interaction between virtual environments, e.g., allow copy and paste between two virtualized desktop systems.G. Runtime loadable configuration information, for example: i. A web servers configuration file specifying the location of the web pages sources or the listening port of the server; and / or ii. The last view settings used for a graphical application, e.g., the Windows calculator (Standard, Scientific, Programmer).H. Startup configuration information, for example: i. Command line options to be passed to an application on startup, e.g., the option “-v” to start an application in verbose mode producing additional user readable outputs about its activities performed; and / or ii. Scheduler configuration to start an application automatically, e.g., a corn job performing a file system backup at midnight.I. Runtime environment configuration information, for example: i. Setting of environment variables to pass information to the application, e.g., the location of a license file to be used; and / orii. Configuration settings for a sandbox solution specifying which parts of the file system an application may access.J. Security relevant configuration options, for example: i. Crypto primitives used by the target of interest; ii. Authentication mechanisms used for network packets, for example, AUTOSAR SecOC; iii. Usage of certificates, for example, in diagnosis; iv. Protocols used for network security, for example, encryption of network traffic using TLS; v. Secure storage options, for example, HSM as a storage for private keys.

[0080] In some examples, event information comprises an ID of the signal exhibiting anomalous behavior, and the values of the signal over a certain time period. In some examples, event information comprises a path of the signal through the system. In some examples, the event information comprises a request to determine how likely it is that the anomalous behavior is indicative of a malicious attack.

[0081] In some examples, in stage 1010, anomaly analysis device 80 analyzes data associated with the respective target of interest to identify the presence, or absence, of a non- malicious cause of the identified anomalous behavior. In some examples, the analysis is performed in relation to the cyber-model of the target of interest stored in memory 40.

[0082] In some examples, data retrieval device 90 retrieves the data associated with the respective target of interest from memory 40, data source 45 and / or data sources 95. In some examples, data retrieval device 90 generates a plurality of keywords, and a search engine of data retrieval device 90 retrieves the data associated with the respective target of interest based at least on the generated keywords. In some examples, the keywords are extracted from the received information, such as the signal ID and / or the systems / components associated with respective signal.

[0083] In some examples, as described above, a list of libraries associated with the target of interest is input into LLM 85, such that the generated keywords are associated with the list of libraries. In one non-limiting example, LLM 85 can be prompted to generate keywords from the received information by requesting a list of keywords, optionally associated with the list oflibraries. For example, if the received information contains information regarding vulnerabilities associated with a plurality of libraries, LLM 85 may generate only keywords relating to the vulnerabilities associated with libraries that are in the list of libraries associated with the asset. In some examples, processor 30 inputs the list of libraries into LLM 85

[0084] In some examples, as described above, a specification sheet of the asset is input into LLM 85, such that the generated keywords are associated with the specification sheet. In some examples, as described above, TARA data (e.g., TARA) associated with the asset is input into LLM 85, such that the generated keywords are associated with the TARA data. In some examples, as described above, a cyber-model of the asset, or system containing the asset, is input into LLM 85, such that the generated keywords are associated with the cyber-model.

[0085] In some examples, LLM 85 generates keywords by: extracting words from a textual description of the received information; and providing terms associated with the received information. For example, LLM 85 can be fine-tuned to provide keywords related to the context of the received information. This can include known terms, or attack steps, that are related to the terms contained within the received information. For example, if the received information comprises a description of a vulnerability to a first type of attack aimed at a first functionality, LLM 85 can provide keywords related to other types of attack aimed at the first functionality. Additionally, LLM 85 can provide keywords related to the first type of attack, but that is aimed at different functionalities that are in communication with the first functionality.

[0086] Although the above has been described in relation to examples where the keywords are generated by LLM 85, or a separate LLM, this is not meant to be limiting in any way, and processor 30 can initiate any suitable algorithm for generating keywords from the received information. As described above in relation to LLM 85, such an algorithm can generate keywords that are associated with a list of libraries, specification sheet and / or TARA data associated with the asset.

[0087] In some examples, a plurality of keywords are generated by LLM 85, or a respective algorithm of processor 30, and processor 30 further filters the generated keywords based at least in part on the list of libraries, specification sheet, TARA data and / or cyber model.

[0088] As described above, in some examples the retrieved data comprises a bug report associated with the target of interest. In some examples, anomaly analysis device 80 analyzes the respective bug report to determine whether an explanation exists for the anomalousbehavior. For example, if the anomaly was indicated for a respective parameter, and there is bug report indicating that a bug was identified that is associated with the respective parameter, anomaly analysis device 80 can determine that there may be a non-malicious reason for the identified anomalous behavior.

[0089] In some examples, a bug report can be analyzed by anomaly analysis device 80 by analyzing a textual description contained within the bug report. In some examples, anomaly analysis device 80 analyzes the textual description using natural language processing, naive text-parsing, a large language model, etc. In some examples, memory 40 has stored therein a list of textual descriptions of parameters associated with various bugs, with each description being associated with a respective parameter. Anomaly analysis device 80 then compares the textual description of the received bug report with the stored list of textual descriptions, to identify the parameter, or parameters affected by the bug.

[0090] In some examples, anomaly analysis device 80 then compares values associated with the parameter within the received log information, or within additional information received with the log information, with the associated value of the parameter within the bug report. For example, if there is a bug report indicating that at temperatures exceeding a predetermined threshold a certain component may malfunction, anomaly analysis device 80 compares the measured temperature values contained within the log information with the predetermined threshold. If the comparison indicates that the measured temperature does exceed the predetermined threshold, anomaly analysis device 80 concludes that there may be a non-malicious reason for anomalous behavior identified in the respective component. It is noted that the term "value associated with a parameter" is meant to include, without limitation, any of the following: the value of the parameter; and the value, or values, of other quantities derived from the parameter values, such as a Fourier transformed window, a first differences estimator, or other applied operators / functions.

[0091] In another example, anomaly analysis device 80 extracts metadata from the bug report associated with the component / system, such as year of production, location of production, nature of problem, etc.; and then compares that to the component / system for which the anomaly was found. For example, if the bug report indicates that a component with a production year before a predetermined year has certain issues that can explain the anomalous behavior, anomaly analysis device 80 concludes that there may be a non-malicious reason for anomalous behavior identified in the respective component, as described above.

[0092] In some examples, a score associated with the anomalous behavior is adjusted based on a reliability value of the bug report indicating how reliable the bug report is. In some examples, the score is increased with a lower reliability value of the bug report since the bug report gives less of an explanation for the anomalous behavior due to the low reliability.

[0093] In some examples, the retrieved bug report is retrieved together with its reliability value. In some examples, anomaly analysis device 80 determines a reliability value for the bug report. In some examples, the reliability value is determined based on the source of the bug report. In some examples, memory 40 has stored therein a plurality of reliability values, each associated with a respective source for a bug report. For example, if the bug report is retrieved from a database of an OEM the reliability value may be higher than a bug report that is retrieved from the internet.

[0094] In some examples, data retrieval device 90 retrieves information regarding the age of the component that has sent the signal, optionally from a respective specification sheet or SBOM, as described above. In some examples, the information regarding the age of the component comprises the age of the component and survival function values that are indicative of the change in quality of the component over its lifetime. In some examples, the survival function are provided in a look up table. In some examples, the survival function values are provided as an outcome of a respective survival function that indicates the probability of survival of the component. It is noted that the survival function values associated with the component can be extracted from a survival function of the component and / or a survival function of a system / sub-system containing the component.

[0095] The above has been described in relation to survival function values associated with an age of the component, however this is not meant to be limiting in any way. In some examples, respective survival function values are retrieved by data retrieval device 90 in relation to various physical attributes associated with the component. For example, a survival function may be provided for the temperature of the component indicating the probability of survival of the component, or system / sub-system containing the component, for respective temperature values.

[0096] In some examples, survival function values can also be associated with other factors, such as general information regarding components. For example, a certain component,such as a sensor, may be known to have a high probability of failure, therefore its survival function value may be low, regardless of its age or other physical attributes.

[0097] In some examples, anomaly analysis device 80 analyzes the survival function values to determine whether the incident, may be explained by the age, or other physical attributes, of the component. In some examples, if the survival function value t has passed a respective predetermined threshold, anomaly analysis device 80 outputs an indication that the anomalous behavior may be due to the age or current state of the component. In some examples, anomaly analysis device 80 sets the score of the incident, based at least in part on the survival function values of the component. In some examples, the score is set as a predetermined function of the current survival function value, or values, of the component. In some examples, the survival function value, or values, are weighted with a respective weight as one variable of the scoring function.

[0098] In some examples, anomaly analysis device 80 determines whether statistical models that are used to identify anomalous behavior (as described below) may be inappropriate for the respective target of interest, or component. For example, if the associated data comprises an indication that the statistical models were generated based on traffic data from systems that are 1 - 2 years old, and the age of the target of interest is outside of that range, anomaly analysis device 80 may determine that any anomalous behavior detected based on the statistical models may be caused by a non-malicious reason, the reason being that the anomaly was detected by an incorrect statistical model. In some examples, a score associated with the anomalous behavior is updated based on the determination.

[0099] In some examples, anomaly analysis device 80 identifies, within an associated SBOM or specification sheet, a component that is associated with the identified anomalous behavior, such as the component that sent the traffic comprising the anomaly. In some examples, anomaly analysis device 80 controls data retrieval device 90 to retrieve data from one or more data sources 95 regarding the identified component. In some examples, the retrieved data can include bug reports, expiration dates, previous reports of instability, etc. In the event that there an issue is identified with the respective component (such as a bug or other structural matter), anomaly analysis device 80 can determine that there may be a non-malicious reason for the identified anomalous behavior.

[0100] In some examples, anomaly analysis device 80 analyzes stored configuration information to determine whether an explanation exists for the anomalous behavior.

[0101] For example, anomaly analysis device 80 can retrieve from a network database transfer properties of a certain message. In one illustrative example, the message is configured with a transmission period of 100 ms and an additional trigger on change for one of the contained signals in the message. In accordance with the respective statistical model, the message typically arrives with the expected period of 100 ms. However, when a signal configured to trigger transmission on change, for example a signal relevant to control a warn lap, changes its value, the message is sent on change in addition to the 100 ms period. Thus, in a case where the respective message was sent after less than 100 ms, anomaly analysis device 80 may identify that the respective signal was changed, and therefore there is a non-malicious explanation for the early sending of the message. Anomaly analysis device 80 can output an indication of the explanation.

[0102] On the other hand, if there are no additional triggers configured for sending the respective message, anomaly analysis device 80 may output an indication that no non- malicious explanation was identified.

[0103] In some examples, anomaly analysis device 80 can identify within a specification sheet whether a particular value is valid. For example, if a target of interest is an electrical vehicle being charged by a charging station, and information is received regarding an event, where the event is an alert about an unencrypted credit card number. Anomaly analysis device 80 can analyze the respective specification sheet to determine whether there is a valid scenario where unencrypted credit card information would appear (e.g., during testing), and check in the event information whether this is the case. If so, anomaly analysis device determines that there is a non-malicious explanation for the event.

[0104] In some examples, anomaly analysis device 80 analyzes security threat data stored in memory 40 to identify the presence, or absence, of a known security threat associated with the identified anomalous behavior. In some examples, the security threat data comprises an indication of the respective anomalous values, or of the target of interest associated with the anomalous behavior. In some examples, the security threat data comprises attack trees, or attack paths, that comprises such values. In some examples, in the event that anomaly analysisdevice 80 identifies security threat data associated with the anomalous behavior, anomaly analysis device 80 outputs an indication of the identified security threat.

[0105] In some examples, anomaly analysis device 80 searches each of the attack trees, or attack paths, to identify whether a signal associated with the anomaly is present in the attack tree / attack path. For example, the attack trees, or attack paths, can be searched to identify whether they contain an ID of the signal exhibiting anomalous values. In some examples, if a signal associated with the anomaly is present in the attack tree / attack path, anomaly analysis device 80 outputs an indication that there is a possible security threat that was identified within the stored attack trees / attack paths, as described above.

[0106] In some examples, anomaly analysis device 80 identifies whether system 10 received indications of events that are present in the levels of the attack tree / attack path that precede the anomaly. For example, anomaly analysis device 80 can identify whether a received ID of an event is present within such levels of the attack tree / attack path. In some examples, if anomaly analysis device 80 identifies that no events have occurred which are present within such levels of the attack tree / attack path, anomaly analysis device 80 outputs an indication that no such events have been identified. Alternatively, or additionally, anomaly analysis device 80 does not output the indication that the possible security threat is identified since no attack path / attack tree was identified as being completed.

[0107] In some examples, a score associated with the event, or anomalous behavior, is increased based on the identification of an event that is present within such levels, and the score is decreased based on the lack of an identification of an event present within such levels.

[0108] In some examples, where the security threat data comprises threat intelligence data, anomaly analysis device 80 identifies whether there is a threat (e.g., a virus or other vulnerability) associated with the component that sent the traffic containing the anomaly. In some examples, the vulnerability is identified from the Common Vulnerabilities and Exposures (CVE) system.

[0109] In some examples, where LLM 85 is configured to summarize threat intelligence data, LLM 85 generates a summary of the identified threat intelligence data. In some examples, anomaly analysis device 80 inputs a request to LLM 85 to generate the summary. In some examples, LLM 85 ranks the identified threat intelligence data and / or the summary of the threat intelligence data. In some examples, anomaly analysis device 80 inputs a request to LLM 85to perform the ranking. In some examples, LLM 85 is fine-tuned for ranking threat intelligence data. In some examples, rank values are assigned to each portion of the threat intelligence data indicating the rank thereof. In some examples, the rank values are assigned by LLM 85 or anomaly analysis device 80.

[0110] In some examples, LLM 85 determines the relevance of the threat intelligence data, and / or the summary of the threat intelligence data. In some examples, the determined relevance is the relevance to the anomalous behavior and / or event data. For example, LLM 85 can determine how relevant the threat intelligence data is to any of, without limitation: the component; the system / sub-system containing the component; the signals exhibiting the anomalous behavior; or the type of anomalous behavior or event. In some examples, LLM 85 is fine-tuned for determining the relevance of the threat intelligence data. In some examples, relevance values are assigned to each portion of the threat intelligence data indicating the relevance thereof. In some examples, the relevance values are assigned by LLM 85 or anomaly analysis device 80.

[0111] In some examples, where language analysis device 85 is implemented as a natural language processor, the ranking and / or relevance can be determined based on predetermined criteria, such as: the general credibility and / or reliability of the source of the threat intelligence data; the credibility and / or reliability of the source of the threat intelligence data in relation to the respective component, system, sub-system, type of anomalous behavior and / or event; and / or the number of generated keywords that appear within the threat intelligence data.

[0112] In some examples, where anomaly analysis device 80 identifies a threat, anomaly analysis device 80 outputs an indication that the incident, is indicative of a possible security threat. In some examples, information regarding the threat identified within the threat intelligence data is further output. In some examples, the output information comprises: the generated summary of threat intelligence data; the determined ranking is further output.

[0113] Thus, as described above, in some examples, an indication is output indicating whether there is a non-malicious explanation for the event / anomalous behavior. In some examples, an indication is output indicating whether there is a malicious explanation for the event / anomalous behavior. In some examples, a score is generated for the event / anomalous behavior, the score indicating how likely it is that the event / anomalous behavior is indicative of a malicious attack.

[0114] In some examples, as described above, anomaly analysis device 80 determines a score for the event / anomalous behavior. In some examples, as described above, the score is determined based at least in part on a predetermined function comprising a plurality of variables. In some examples, anomaly analysis device 80 utilizes the score as a respective weight for a caching algorithm, such as a weighted least recently used (LRU) cache algorithm, to determine a ranking for the events / identified anomalous behaviors. In some examples, as described above, information regarding the events / anomalous behaviors are output based on their rank.

[0115] In some examples, anomaly analysis device 80 further filters the data regarding the event / anomalous behavior based at least in part on the indications regarding the non-malicious and / or malicious explanations. In some examples, anomaly analysis device 80 outputs to response unit 98 the data regarding the event / anomalous behavior only if there is no non- malicious explanation identified. In some examples, anomaly analysis device 80 outputs to response unit 98 the data regarding the event / anomalous behavior only if there is a malicious explanation identified. In some examples, where a score is determined, anomaly analysis device 80 output to response unit 98 the data regarding the event / anomalous behavior only if the score passes a respective threshold.

[0116] In some examples, where a risk value is assigned to the respective signal and / or component, the filtering is based at least in part on the assigned risk value. For example, if there is a high risk value, less data will be filtered.

[0117] In some examples, the data is filtered based at least in part on a received user input. In some examples, the user input can select how the data is filtered. For example, a user may select one of a plurality of different options for filtering data. In some examples, for each component, signal and / or system, the user may select one of a plurality of different options for filtering data, as will be further described below.

[0118] In some examples, in stage 1020, anomaly analysis device 80 generates an adjustment request for adjusting the log information and / or network traffic data being sent to data enrichment system 10. In some examples, a configuration file for a data logger, an intrusion detection system (IDS) and / or an intrusion prevention system (IPS) is generated indicating what adjustments are requested, and the adjustment request comprises the generated configuration file.

[0119] In some examples, the adjustment request comprises a request for additional log information and / or network traffic data associated with the identified anomalous behavior. In some examples, the adjustment request indicates the component associated with the identified anomalous behavior, and requests additional log information and / or network traffic data associated with that component. In some examples, the adjustment request indicates the sender of the message, or messages, exhibiting the anomalous behavior.

[0120] In some examples, the adjustment request comprises a request to add and / or remove one or more signals from the received log information and / or network traffic data. For example, if anomalous behavior is identified in associated with a respective signal, an adjustment request may include a request to provide additional log information and / or network traffic data comprising that signal. In another example, alternatively or additionally, if anomalous behavior has not been identified in relation to a particular signal for at least a predetermined time period, an adjustment request may include a request to remove the signal from future log information and / or network traffic data.

[0121] In some examples, the adjustment request comprises an indication of the risk value of signals to be sent. Particularly, in some examples, each signal within the target of interest has associated therewith a respective risk value. The risk value indicates how much the respective signal is vulnerable to an attack. In some examples, the adjustment request comprises a request to send log information and / or network traffic data associated with signals having a risk value above a predetermined threshold.

[0122] For example, if anomalous behavior was detected in respect to a particular signal, and no non-malicious explanation was identified, anomaly analysis device 80 may request log information and / or network traffic data associated with signals having a lower risk value than previously requested. Conversely, if anomalous behavior was not detected for a predetermined time period, and / or non-malicious explanations were identified for detected anomalous behavior, anomaly analysis device 80 may request log information and / or network traffic data associated with signals having a higher risk value than previously requested.

[0123] In some examples, the adjustment request is sent to data source 45, optionally via data interface 20.

[0124] In some examples, the adjustment request is generated based at least in part on predetermined statistical relationship between two or more signals. In some examples, memory 40 has stored therein information regarding statistical relationships between different signals.

[0125] For example, if anomalous behavior was detected in respect to a particular signal, and no non-malicious explanation was identified, anomaly analysis device 80 may request log information and / or network traffic data associated with signals having a predetermined statistical relationship with the particular signal.

[0126] In some examples, an adjustment request is generated based at least in part on a user input received from response unit 98.

[0127] In stage 1030, at least a portion of network traffic is received from the target of interest at data interface 20. It is noted that stages 1000 and 1030 can be performed together or at different times. In some examples, stage 1030 is performed periodically, and stage 1000 is performed continuously.

[0128] In stage 1040, one or more of the statistical models stored in memory 30 are updated based at least in part of the received network traffic of stage 1010. In some examples, model generation device 60 inputs the received network traffic data into the respective statistical models and updates the models based on the newly received data. In some examples, updating of the statistical models is performed periodically.

[0129] In some examples, where the received information of stage 1000 comprises signal associated values, in stage 1050 statistical analysis device 65 compares the received information of stage 1000 regarding the log information to a respective statistical model stored in memory 40. In some examples, statistical analysis device 65 estimates a goodness-of-fit of the values of the signal associated values to the respective statistical model.

[0130] As described above in relation to the term "value associated with a parameter", the term "signal associated value" is meant to include, without limitation, any of the following: the value of the signal; and the value, or values, of other quantities derived from the signal values, such as a Fourier transformed window, a first differences estimator, or other applied operators / functions. It is further noted that received signal associated values are not meant to be limited to a single signal at a particular time, and is particularly meant to include a plurality of signals over a predetermined time period.

[0131] In some examples, in stage 1060, based at least in part on an outcome of the comparison of stage 1050, statistical analysis device 65 identifies anomalous behavior within the system. In some examples, anomalous behavior is identified by identifying signal associated values within the received information that are not expected by the respective statistical model.

[0132] In some examples, in stage 1070, information regarding the identified anomalous behavior is output by statistical analysis device 65 and / or anomaly analysis device 80, as described above. In some examples, the information is output to response unit 98. In some examples, the received information of stage 1000 associated with the identified anomalous behavior is output. In some examples, the information comprises an indication describing the anomalous behavior.

[0133] In some examples, as described above, the output information comprises a score of how likely it is that the anomalous behavior is associated with a malicious attack and / or how likely it is that the anomalous behavior is not associated with a malicious attack. In some examples, as described above, the output information comprises an indication whether there is a non-malicious explanation and / or a malicious explanation for the anomalous behavior.

[0134] FIG. 3 illustrates a high-level flow chart of a method of performing security analysis. In stage 1100, data is sent to response unit 98. In some examples, as described above in relation to stages 1000 - 1070, the data can comprise log information indicating anomalous behavior and optionally indications of whether the anomalous behavior has a non-malicious explanation, a malicious explanation or no explanation.

[0135] In some examples, the data further includes information received alongside the information received in stage 1000. For example, if the log information is supplied by an OEM, along with an indication of a suspected anomaly, threat, attack, or other security related issue, that indication is also output. In some examples, where the indication comprises a risk level associated with the suspected anomaly, the risk level is also output.

[0136] In stage 1110, security analysis of the data of stage 1000 is performed in response unit 98. In some examples, as known to those skilled in the art, security analysis in response unit 98 is performed by trained personnel and / or various machine learning models.

[0137] In stage 1120, input is received from response unit 98 at data interface 20. In some examples, the received input comprises an outcome of the security analysis indicating whether identified anomalous behavior is due to malicious activity. In some examples, the received input comprises an indication of whether or not the issue causing the anomalous behavior (whether malicious or non-malicious) was mitigated.

[0138] For example, if the anomalous behavior was caused by an attack, and a security vulnerability allowing the attack was mitigated, the received input comprises such an indication. In a similar example, if the anomalous behavior was caused by a bug, and the bug was fixed, the received input comprises such an indication.

[0139] In stage 1130, future analysis of information received in stage 1000 is based at least in part on the received input of stage 1120. For example, a request for additional information, as described above in relation to stage 1020 may be updated based on the received input. In one illustrative example, if the received input from response unit 98 comprises an indication that an attack has been detected, additional information associated with the detected anomalous behavior is requested, as described above.

[0140] In some examples, if the received input from response unit 98 comprises an indication that a particular identified anomalous behavior is not due to malicious reasons, anomaly analysis device 80 determines that similar anomalous behavior identified in future information may have a non-malicious explanation. In some examples, such information is then not sent to response unit 98. Alternatively, the information is sent with an indication that similar anomalous behavior was previously identified by response unit 98 to be non-malicious. In some examples, as described above, future filtering of data to be sent to response unit 98 is based at least in part on the received input of stage 1120.

[0141] In some examples, one or more of the statistical models described above can be adjusted based at least in part on the received input from response unit 98. For example, if an analyst decides that the identification of the anomalous behavior is due to a software or hardware update in the respective component, or system, model generation device 60 can update one or more respective models associated with the software or hardware update. In some examples, a statistical model 53 can be updated by removing one or more statistical sub-models 54 and / or adding one or more statistical sub-models 54. In some examples, the input received from response unit 98 further comprises instructions for updating the respective model. In someexamples, based at least in part on such an indication of a software or hardware update, model generation device 60 relearns the model based on the received network traffic data of stage 1030.

[0142] In some examples, based at least in part on such an indication of a software or hardware update, model generation device 60 can replace one or more statistical sub-models 54 with new statistical sub-models 54 associated with the software or hardware update. In some examples, when a statistical sub-model 54 is removed from the respective statistical model 53, model generation device 60 removes the statistical relationships between signals in the remaining statistical sub-models 54 and the removed statistical sub-models 54. In some examples, when a statistical sub-model 54 is added to the respective statistical model 53, model generation device 60 learns the statistical relationship between signals in the added statistical sub-model 54 and the other statistical sub-models 54.

[0143] In some examples, one or more statistical models can similarly be updated based on an input from response unit 98 indicating that respective model used is not appropriate for a specific version of the target of interest. For example, an analyst may decide that a sub-model of a particular type of vehicle produces certain signal values that are different than other submodels of that vehicle. In such a case, model generation device 60 can create separate statistical models for this newly defined group. Similarly, anomaly analysis device 80 can create a new cyber model for this version of the target of interest. In some examples, the new cyber model is created by copying the original cyber model and making adjustments based on the received input from response unit 98.Some Examples of the Disclosed Technology

[0144] Some examples of above-described implementations are enumerated below. It should be noted that one feature of an example in isolation or more than one feature of the example taken in combination and, optionally, in combination with one or more features of one or more examples below are examples also falling within the disclosure of this application.

[0145] Example 1. A data enrichment method, the method comprising: receiving incident information associated with an incident in a target of interest; based at least in part on the received incident information, analyzing data associated with the target of interest to identify: an effect of the incident within the target of interest, and existing one or more mitigations associated with the incident; and outputting information regarding the incident, the outputinformation comprising the identified effect and identified one or more mitigations, wherein the incident information comprises information regarding detected anomalous behavior in the target of interest or information regarding a detected vulnerability in the target of interest, and wherein the analyzed data is based on a plurality of sources.

[0146] Example 2. The method of any example herein, particularly example 1, wherein the plurality of sources comprises technical artifacts of the target of interest and product architecture associated with the target of interest.

[0147] Example 3. The method of any example herein, particularly example 1 or 2, wherein the plurality of sources comprises a risk assessment analysis.

[0148] Example 4. The method of any example herein, particularly any one of examples 1 - 3, wherein the plurality of sources comprises a software bill of material (SBOM).

[0149] Example 5. The method of any example herein, particularly example 4, further comprising identifying a component within the SBOM associated with the incident, wherein the data associated with the target of interest comprises information regarding the identified component.

[0150] Example 6. The method of any example herein, particularly any one of examples 1 - 5, wherein the plurality of sources comprises a specification sheet associated with the target of interest.

[0151] Example 7. The method of any example herein, particularly any one of examples 1 - 6, wherein the plurality of sources comprises a bug report.

[0152] Example 8. The method of any example herein, particularly any one of examples 1 - 7, wherein the plurality of sources comprises data received from electronic control units (ECUs) within the target of interest.

[0153] Example 9. The method of any example herein, particularly example 8, wherein the plurality of sources comprises data received from one or more sensors associated with the ECUs.

[0154] Example 10. The method of any example herein, particularly any one of examples 1 - 9, wherein the plurality of sources comprises threat intelligence.

[0155] Example 11. The method of any example herein, particularly any one of examples 1 - 10, wherein the effect of the incident comprises: a risk impact; and an indication of which of a plurality of portions of the target of interest can be affected by the incident.

[0156] Example 12. The method of any example herein, particularly example 11, further comprising identifying an attack step within a plurality of attack paths associated with the target of interest, wherein the indication of which portion of the target of interest can be affected is based at least in part on the attack path containing the identified attack step.

[0157] Example 13. The method of any example herein, particularly any one of examples 1 - 10, further comprising identifying an attack step within a plurality of attack paths associated with the target of interest, wherein the effect of the incident comprises an indication of which of a plurality of portions of the target of interest can be affected by the incident, and wherein the indication of which portion of the target of interest can be affected is based at least in part on the attack path containing the identified attack step.

[0158] Example 14. The method of any example herein, particularly any one of examples 1 - 10, further comprising identifying an attack step within a plurality of attack paths associated with the target of interest, wherein the output information comprises the attack path containing the identified attack step.

[0159] Example 15. The method of any example herein, particularly any one of examples 12 - 14, wherein identifying the attack step comprises: based at least in part on the received incident information and a cyber-model of the target of interest, identifying a respective component within the target of interest; and identifying an attack step associated with the identified component.

[0160] Example 16. The method of any example herein, particularly any one of examples 1 - 15, further comprising based at least in part on the received information, analyzing the incident information associated with the target of interest to identify the presence, or absence, of a non-malicious cause of the anomalous behavior, wherein the output information comprises an indication of the identified presence, or absence, of the non-malicious cause.

[0161] Example 17. The method of any example herein, particularly example 16, further comprising analyzing security threat data to identify the presence, or absence, of a known security threat associated with the identified incident, wherein the output information regardingthe identified incident comprises an indication of the identified presence, or absence, of the known security threat.

[0162] Example 18. The method of any example herein, particularly any one of examples 1 - 17, wherein the output information is output to an event or incident manager.

[0163] Example 19. The method of any example herein, particularly example 18, wherein the output information is output to a security operations center (SOC) or an incident response team.

[0164] Example 20. The method of any example herein, particularly example 18 or 19, further comprising receiving data from the event or incident manager, wherein the data analysis is based at least in part on the data received from the event or incident manager.

[0165] Example 21. The method of any example herein, particularly any one of examples 1 - 20, further comprising receiving log information associated with the target of interest; comparing the received log information regarding the one or more log information to a respective one of a plurality of statistical models; based at least in part on an outcome of the comparison to the statistical model, identifying the anomalous behavior.

[0166] Example 22. The method of any example herein, particularly example 21, further comprising: receiving a portion of network traffic from the target of interest; and updating one or more of the plurality of statistical models based at least in part on the received network traffic.

[0167] Example 23. The method of any example herein, particularly example 21 or 23, wherein the received log information comprises values of one or more signals.

[0168] Example 24. The method of any example herein, particularly any one of examples 21 - 23, wherein the received log information comprises a digest.

[0169] 25. The method of any example herein, particularly any one of examples 21 - 24, further comprising, based at least in part on the identified anomalous behavior, outputting an adjustment request for adjusting the received log information.

[0170] Example 26. The method of any example herein, particularly example 25, wherein the adjustment request is based at least in part on the identified anomalous behavior.

[0171] Example 27. The method of any example herein, particularly example 25, wherein the adjustment request is based at least in part on a statistical relationship between a first signal and a second signal, the first signal associated with the identified anomalous behavior.

[0172] Example 28. The method of any example herein, particularly any one of examples 21 - 27, wherein each of the plurality of statistical models comprises a respective plurality of statistical sub-models.

[0173] Example 29. The method of any example herein, particularly example 28, further comprising, for a respective one of the plurality of statistical models, removing one of the respective plurality of statistical sub-models.

[0174] Example 30. The method of any example herein, particularly example 28 or 29, further comprising, for a respective one of the plurality of statistical models, adding a respective statistical sub-model to the respective statistical model.

[0175] Example 31. A data enrichment system, comprising one or more processors, and a memory, wherein the memory has stored therein a plurality of instructions, that when run by the one or more processors cause the one or more processors to perform a plurality of steps, the plurality of steps comprising: receiving incident information associated with an incident in a target of interest; based at least in part on the received incident information, analyzing data associated with the target of interest to identify: an effect of the incident within the target of interest, and existing one or more mitigations associated with the incident; and outputting information regarding the incident, the output information comprising the identified effect and identified one or more mitigations, wherein the incident information comprises information regarding detected anomalous behavior in the target of interest or information regarding a detected vulnerability in the target of interest, and wherein the analyzed data is based on a plurality of sources.

Claims

CLAIMS1. A data enrichment method, the method comprising: receiving incident information associated with an incident in a target of interest; based at least in part on the received incident information, analyzing data associated with the target of interest to identify: an effect of the incident within the target of interest, and existing one or more mitigations associated with the incident; and outputting information regarding the incident, the output information comprising the identified effect and identified one or more mitigations, wherein the incident information comprises information regarding detected anomalous behavior in the target of interest or information regarding a detected vulnerability in the target of interest, and wherein the analyzed data is based on a plurality of sources.

2. The method of claim 1, wherein the plurality of sources comprises technical artifacts of the target of interest and product architecture associated with the target of interest.

3. The method of claim 1 or 2, wherein the plurality of sources comprises a risk assessment analysis.

4. The method of any one of claims 1 - 3, wherein the plurality of sources comprises a software bill of material (SBOM).

5. The method of claim 4, further comprising identifying a component within the SBOM associated with the incident, wherein the data associated with the target of interest comprises information regarding the identified component.

6. The method of any one of claims 1 - 5, wherein the plurality of sources comprises a specification sheet associated with the target of interest.

7. The method of any one of claims 1 - 6, wherein the plurality of sources comprises a bug report.

8. The method of any one of claims 1 — 7, wherein the plurality of sources comprises data received from electronic control units (ECUs) within the target of interest.

9. The method of claim 8, wherein the plurality of sources comprises data received from one or more sensors associated with the ECUs.

10. The method of any one of claims 1 - 9, wherein the plurality of sources comprises threat intelligence.

11. The method of any one of claims 1 - 10, wherein the effect of the incident comprises: a risk impact; and an indication of which of a plurality of portions of the target of interest can be affected by the incident.

12. The method of claim 11, further comprising identifying an attack step within a plurality of attack paths associated with the target of interest, wherein the indication of which portion of the target of interest can be affected is based at least in part on the attack path containing the identified attack step.

13. The method of any one of claims 1 - 10, further comprising identifying an attack step within a plurality of attack paths associated with the target of interest, wherein the effect of the incident comprises an indication of which of a plurality of portions of the target of interest can be affected by the incident, and wherein the indication of which portion of the target of interest can be affected is based at least in part on the attack path containing the identified attack step.

14. The method of any one of claims 1 - 10, further comprising identifying an attack step within a plurality of attack paths associated with the target of interest, wherein the output information comprises the attack path containing the identified attack step.

15. The method of any one of claims 12 - 14, wherein identifying the attack step comprises: based at least in part on the received incident information and a cyber-model of the target of interest, identifying a respective component within the target of interest; andidentifying an attack step associated with the identified component.

16. The method of any one of claims 1 - 15, further comprising based at least in part on the received information, analyzing the incident information associated with the target of interest to identify the presence, or absence, of a non-malicious cause of the anomalous behavior, wherein the output information comprises an indication of the identified presence, or absence, of the non-malicious cause.

17. The method of claim 16, further comprising analyzing security threat data to identify the presence, or absence, of a known security threat associated with the identified incident, wherein the output information regarding the identified incident comprises an indication of the identified presence, or absence, of the known security threat.

18. The method of any one of claims 1 - 17, wherein the output information is output to an event or incident manager.

19. The method of claim 18, wherein the output information is output to a security operations center (SOC) or an incident response team.

20. The method of claim 18 or 19, further comprising receiving data from the event or incident manager, wherein the data analysis is based at least in part on the data received from the event or incident manager.

21. The method of any one of claims 1 - 20, further comprising receiving log information associated with the target of interest; comparing the received log information regarding the one or more log information to a respective one of a plurality of statistical models; based at least in part on an outcome of the comparison to the statistical model, identifying the anomalous behavior.

22. The method of claim 21, further comprising: receiving a portion of network traffic from the target of interest; andupdating one or more of the plurality of statistical models based at least in part on the received network traffic.

23. The method of claim 21 or 23, wherein the received log information comprises values of one or more signals.

24. The method of any one of claims 21 - 23, wherein the received log information comprises a digest.

25. The method of any one of claims 21 - 24, further comprising, based at least in part on the identified anomalous behavior, outputting an adjustment request for adjusting the received log information.

26. The method of claim 25, wherein the adjustment request is based at least in part on the identified anomalous behavior.

27. The method of claim 25, wherein the adjustment request is based at least in part on a statistical relationship between a first signal and a second signal, the first signal associated with the identified anomalous behavior.

28. The method of any one of claims 21 - 27, wherein each of the plurality of statistical models comprises a respective plurality of statistical sub-models.

29. The method of claim 28, further comprising, for a respective one of the plurality of statistical models, removing one of the respective plurality of statistical sub-models.

30. The method of claim 28 or 29, further comprising, for a respective one of the plurality of statistical models, adding a respective statistical sub-model to the respective statistical model.

31. A data enrichment system, comprising one or more processors, and a memory, wherein the memory has stored therein a plurality of instructions, that when run by the one or more processors cause the one or more processors to perform a plurality of steps, the plurality of steps comprising: receiving incident information associated with an incident in a target of interest;based at least in part on the received incident information, analyzing data associated with the target of interest to identify: an effect of the incident within the target of interest, and existing one or more mitigations associated with the incident; and outputting information regarding the incident, the output information comprising the identified effect and identified one or more mitigations, wherein the incident information comprises information regarding detected anomalous behavior in the target of interest or information regarding a detected vulnerability in the target of interest, and wherein the analyzed data is based on a plurality of sources.

Images