95 results about "Incident response" patented technology

Systems and methods for generating and customizing remediation scripts. Generative AI models can analyze existing scripts and tailor scripts according to specific incidents and environmental parameters, thereby creating a faster, more consistent, and error-free incident response process compared to existing solutions.

A predictive incident management system, consisting of: a sensor input module configured to receive heterogeneous telemetry data streams from mechanical, thermal, electrical and cyber sources; a temporal correlation control unit operationally coupled to the sensor input module, wherein the temporal correlation control unit is configured to normalize received data into a uniform time series envelope that includes identifiers, microsecond-precision timestamps, metric names, values, and context markers, and is further configured to compute sliding window-cross-sensor correlation matrices, event motifs, and lead-lag dependencies across multiple time granularities; a scalable rule processor that is communicatively linked to the control unit for temporal correlation, wherein the rule engine includes an in-memory runtime environment for processing complex events and a domain-specific declarative language, and is configured to apply rules that reference primitive sensor metrics, derived correlation features, and motive-based early warning vectors to classify, escalate, or resolve predicted incidents; A historical repository that is communicatively connected to both the temporal correlation control unit and the rule engine. The repository is configured to store tagged event histories, correlation motif dictionaries, rule versions, and rule origin metadata to ensure the verifiability and explainability of predictions; and An incident response interface is operationally connected to the rule engine. The incident response interface is configured to trigger automated workflows, including the generation of tickets for IT service management, chat ops notifications, the execution of orchestration playbooks, and direct machine control via industrial protocols. the system is configured to perform predictive analyses based on temporal correlations between sensors and to execute context-aware, rule-based incident management in real time.

A system (100) for securing cloud-based large language models through cyber threat defense and compliance monitoring, comprising: (a) an access control and authentication module configured to authenticate users and applications using role-based access control (RBAC) and multi-factor authentication (MFA); (b) a data protection and encryption module configured to encrypt data in transit and at rest and to anonymize sensitive input / output data using cryptographic techniques; (c) a threat detection and behavior monitoring module employing machine learning algorithms to identify anomalies and detect potential cyber threats in real time;(d) a regulatory compliance monitoring module configured to continuously assess system operations against applicable regulatory frameworks and generate alerts in the event of deviations from the regulations; (e) an incident response and mitigation module configured to automatically execute predefined response actions upon detection of threats or regulatory violations; (f) a logging, auditing, and forensic analysis module configured to securely log system activities, interactions, and threat events with cryptographic integrity protection; and (g) a governance and policy management module configured to define, update, and enforce organizational AI usage and compliance policies via the cloud-based LLM infrastructure.

A computing services environment may include a database system, a vector store, a generative language model interface, and / or an incident response system. The database system may be configured to detect a database system incident affecting database system availability or performance and to generate a database incident report characterizing the database system incident. The generative language model interface may be configured to determine a textual description of the database system incident and identify one or more records of the plurality of records by completing an incident evaluation prompt via a generative language model. An incident response engine may be configured to determine an instruction to resolve the database incident based on the textual description and the one or more records, wherein the database system is configured to execute the instruction to update one or more configuration parameters.

Embodiments manage context repositories in computing environments to enhance automated security analysis. Embodiments obtain context records containing supplemental information associated with security events and integrates them into prompts for large language models (LLMs) to generate severity scores for event classification. Embodiments apply criteria to invalidate outdated or unreliable context records based on age, source reliability, and usage frequency, then modifies prompts and repositories accordingly. Enhanced prompts incorporate context record summaries and entity relationship mappings to improve subsequent event analysis. Embodiments dynamically evaluates context records through quality filters, consolidates duplicates, and maintains audit trails with provenance tracking. User interfaces are dynamically transformed based on telemetry metrics and user feedback to optimize analyst workflows. Embodiments enable organizations to maintain curated, high-quality context repositories that continuously improve AI-assisted security analysis while reducing false positives and enhancing incident response effectiveness.

Systems and methods are disclosed for real-time anomaly prediction using near real-time data. The invention addresses delays in telemetry data collection from infrastructure components, by collecting metrics and logging this data in real-time. Extracted logged data undergoes initial analysis to identify patterns and anomalies, followed by cleaning to remove noise and errors. Feature engineering enhances the data, creating or modifying features to improve machine learning model performance. The system calculates weighted means of previous data values and computes first and second-order differences to capture immediate changes and trends. These calculations adjust the extrapolated value to accurately reflect current conditions. The adjusted data is integrated into the dataset and validated. The validated data trains and tests a machine learning model, which is then finalized and deployed for real-time anomaly detection. This system ensures accurate and timely anomaly prediction, enabling automated incident response to maintain the reliability and performance of infrastructure components.

The invention discloses a chaos annealing ant colony-based adversarial blocking timeliness emergency material transportation toughness intelligent decision-making method, and relates to the technical field of intelligent emergency scheduling and optimization. The method comprises the steps of 1, extracting scene data and converting the scene data into model parameters; step 2, constructing a mathematical model for survivability optimization; 3, initializing algorithm parameters and generating an initial path; 4, dynamically adjusting the temperature and the pheromone volatilization rate; 5, generating an adversarial blocking perception path and implementing detour repair; 6, updating pheromone distribution based on an annealing criterion; and step 7, locking the critical path and outputting an optimal transportation scheme. According to the method, timely delivery of materials can be guaranteed in a complex road network blocking and emergency demand scene, the timeliness and toughness of an emergency transportation system are improved through a chaos annealing mechanism and an adversarial blocking simulation technology, the method can be widely applied to the fields of natural disaster rescue, public health event response and the like, and a scientific basis is provided for emergency decision making.

AI-powered data breach detection and prevention system that includes: a threat monitoring module for continuous analysis of network traffic, system logs and user activities; an AI-powered anomaly detection module that uses machine learning to detect threats, including zero-day attacks and insider threats; a behavioral analysis module that tracks user authentication, access patterns, and privilege escalations; an automated incident response module that isolates threats, blocks unauthorized access, and alerts security teams; a threat intelligence module that integrates global cybersecurity databases for proactive risk mitigation; a multi-layered security system with endpoint protection, encryption and role-based access control; a privacy-preserving mechanism that uses homomorphic encryption and federated learning to protect sensitive data; a compliance and audit module that ensures compliance with cybersecurity regulations.

A dynamic, infrastructure-aware incident response and automated problem resolution system (100) for cloud environments, comprising: (a) an infrastructure and topology mapping module configured to continuously scan, discover, and map virtualized and containerized cloud resources and their interdependencies in real time; (b) an incident detection and correlation module configured to ingest telemetry data from distributed monitoring sources and apply rule-based and machine learning models to detect, correlate and classify system incidents; (c) a context analysis and impact assessment module configured to analyse the scope, severity and business impact of incidents based on real-time infrastructure context and service dependency diagrams; (d) a policy-driven decision engine configured to dynamically select response actions based on predefined rules, compliance policies, service level agreements and historical incident data; e) an Automated Remediation Orchestrator configured to execute predefined or dynamic remediation playbooks through integrations with cloud orchestration and configuration tools; and (f) a feedback loop and learning module configured to collect post-incident data, evaluate the effectiveness of remedial actions, and continuously refine the detection and response logic using machine learning algorithms.

Smart job generation for incident response includes receiving a natural language request to generate a job definition. The natural language request includes a natural language description of a job executable by a computing device. The natural language description of the job is decomposed into one or more tasks. Each task of the one or more tasks is a natural language description of a portion of the job. The job definition is generated. The job definition includes one or more instructions. At least one instruction of the one or more instructions corresponds to a task of the one or more tasks, such that performance of the at least one instruction accomplishes the task. The job definition is executed, by the computing device, to perform the job in response to an incident.

A computer-implemented method (CIM), according to one embodiment, includes, tuning a plurality of Large Language Models (LLMs) to debate one another to determine solutions for incidents, and causing data associated with a first incident to be input into the LLMs. The method further includes incorporating solutions output by the LLMs into a recommendation for resolving the first incident. The recommendation weighs trade-offs of different possible resolutions for solving the first incident. The method further includes outputting the recommendation to a user interface of a user device. A computer program product (CPP), according to another embodiment, includes a set of one or more computer-readable storage media, and program instructions, collectively stored in the set of one or more storage media, for causing a processor set to perform the foregoing method.

An incident management system for managing an incident response may be provided. The incident management system may include an incident management (IM) computing device and a vehicle. The IM computing device may include a processor and memory, the processor may be programmed to receive a notification that an incident has occurred, the notification including sensor data and sub-system data. The processor may analyze the data to determine an incident response, the determination including categorizing the incident based on damage determined from the data. The processor may also identify a responding party based on the incident response and the category of the incident. The processor may further parse the data to generate a set of critical data. The critical data may be based on the responding party. The processor may transmit a message to the responding party including the critical data and the location of the vehicle.

A computing services environment may include a database system, a vector store, a generative language model interface, and / or an incident response system. The database system may be configured to detect a database system incident affecting database system availability or performance and to generate a database incident report characterizing the database system incident. The generative language model interface may be configured to determine a textual description of the database system incident and identify one or more records of the plurality of records by completing an incident evaluation prompt via a generative language model. An incident response engine may be configured to determine an instruction to resolve the database incident based on the textual description and the one or more records, wherein the database system is configured to execute the instruction to update one or more configuration parameters.

A method for security incident detection in a cloud-native distributed control system (DCS) in industrial process automation includes monitoring information technology, IT-related data and operation technology, OT-related data at a production process and at a containerized DCS associated with the production process. The method further comprises joint analysing of first data indicative of first monitoring data from the monitoring of the IT-related data and of second data indicative of second monitoring data from the monitoring of the OT-related data. The method further comprises, based on the joint analysing, detecting a security incident under consideration of predetermined security incident detection rules: The method further comprises, based on a result of the detecting, responding on a detected security incident for handling of the detected security incident under consideration of predetermined security incident response rules.

This invention presents a vehicle safety system (VSS) for autonomous vehicles (AVs) utilizing an onboard unit (OBU) capable of communicating with various entities, comprising roadside units (RSUs), other OBUs, and cloud platforms. The OBU incorporates a safety subsystem designed to implement proactive, active, and passive safety measures. The proactive safety measures comprise incident prediction and warnings. The active safety measures comprise emergency braking, and the passive safety measures comprise incident response and dynamic routing. This VSS can be further enhanced by incorporating sensing and processing capabilities of the RSU network or the cloud platform, enabling distributed and integrated safety functions and improved environmental awareness. The system aims to enhance AV safety by addressing incidents before, during, and after their occurrence through comprehensive safety measures at a system level, comprising a vehicle centric system, a vehicle-road system, or a vehicle cloud system.

An emergency response data system (ERDS) provides AI-based real-time intelligence during a response to an incident. The system includes a monitoring module configured to receive and process incident metadata from an emergency system, such as a Computer-Aided Dispatch (CAD) system, wherein the incident metadata includes location, type of emergency, units dispatched, and comments. An analysis module analyzes the incident metadata and identifies changes in incident circumstances, including comparing current comments with historical comments corresponding to the location. A data retrieval module accesses and retrieves public record information corresponding to the location, including property data, tax records, real estate records, historical records, and permits. An insight generation module generates real-time insights and updates regarding the incident, including reclassifying the type of emergency based on the analyzed metadata and retrieved public records. An alert module transmits the real-time insights to emergency personnel, including field responders and Emergency Communication Centers (ECC).

An emergency response system provides a map-based interface for a telecommunicator to view information about an incident and coordinate a response to the incident. The emergency response system gathers supplemental data regarding locations and other information that may be relevant in assisting with the incident. The interface may automatically select relevant supplemental information based on the incident and provide this incident-specific information for display on the interface. The user may then select a response on the interface such as a unit to dispatch that the system automatically implements, providing unified information and control for incidents, supplemental information, and incident response.

An incident response system can one or more processing circuits. The one or more processing circuits can acquire data from a communication device, receive an indication that a response vehicle is set to leave or has left a location proximate to an incident, and transmit a message to a server including the indication that the response vehicle is set to leave or has left the location proximate to the incident.

This application provides a method and system for rapid response to traffic incidents based on multi-source data fusion, relating to the field of traffic incident response technology. The method includes: extracting traffic feature vectors from multi-source traffic data for multi-source fusion calculation; determining whether abnormal traffic incidents exist in the fused situational data; when abnormal traffic incidents exist, determining the type and locating the information; generating an initial response plan based on the determined type and location information; pushing the initial response plan to the handling department's terminal and receiving execution status information from the handling department; recording the timestamps and operation logs of the entire process, and evaluating the effectiveness of this response process. This application addresses the technical problem of lacking multi-source traffic data fusion analysis in existing technologies, enabling rapid response to traffic incidents based on multi-source traffic data fusion, and achieving the technical effect of improving the accuracy of traffic incident identification.

Techniques are described for a system configured to assign one or more services to a first compute node of a set of compute nodes. The system may obtain an alert for a service. The system may determine an alert context for the alert. The system may add the alert to an alert group of a plurality of alert groups. The system may generate an updated alert group context for the alert group. The system may add a second compute node to the set of compute nodes. The system may provide a plurality of alert group contexts including the updated alert group context to the second compute node. The system may reassign at least one service to the second compute node based on an updated set of compute nodes, wherein the updated set of compute nodes is determined based on a change to the set of compute nodes.

The invention discloses a security event response system and method based on intelligent analysis, and relates to the technical field of network security, an asset business load integrated digital model is constructed, a cross-domain attack surface is identified based on cross-environment asset interaction data in the integrated digital model, and basic data support for subsequent simulation and reasoning is formed; based on the obtained asset, business and cross-domain attack surface data, an attack framework and a dynamic attacker portrait are fused to construct a causal knowledge graph, the causal relationship of unknown attacks is complemented through transfer learning and an unsupervised algorithm, and the causal knowledge graph is updated according to the dynamic change of the environment; according to the method, the conversion of the security event from passive tracing to active prediction is realized, high-risk threats are identified in advance through cross-domain attack path simulation and risk quantification, and the defense initiative is improved.

The present invention generally provides systems and methods for autonomous space characterization, data analysis, anomaly detection, hazard probability assessment, and profile deviance assessment and incident response action, and firefighting employing robotically controlled firefighting equipment, autonomous selection and release of firefighting agent, and the autonomous prediction, detection, classification, and location of existing and impending threats and fire events.

Methods and apparatuses for improving the speed, quality, and relevance of automated responses provided by a question answering system for security data are described. The question answering system may generate and utilize a large language model that is trained to combine the language of security data, such as the language found in security logs and alerts, with natural language text. Given an input prompt (or a search query) from an end user of the question answering system, the question answering system may identify relevant content from the security data and display a response based on the relevant content. The question answering system may allow the end user of the question answering system to query security logs using natural language text without requiring the end user to provide a structured query and without requiring the security data be parsed and ingested into a database system.

Systems and methods for providing cyber-security event responses are presented. The method includes providing the received event input into a large language model (LLM); mapping the received event input into a scene of a plurality of scenes based on an output of the LLM, each scene comprising a plurality of sub-scenes; receiving a user input through a user interface, the user interface configured to present a graphical representation of a set of sub-scenes of the plurality of sub-scenes; selecting a sub-scene based on the received event input; generating a query based on the received event input and a selection of a sub-scene of the plurality of sub-scenes; executing the query on a secure database, the secure database comprising a representation of the computing environment; and initiating a mitigation action based on a result of the executed query.

Comprehensive systems and methods for conducting digital forensics and incident response in containerized computing environments. The system converts stateless containers into persistent containers to prevent automatic termination during forensic investigations. It quarantines the containers using virtual switches and firewalls, captures detailed forensic data including snapshots of all filesystem layers, kernel syscalls, and process data, and mirrors network traffic for secure analysis. The system retrieves logs and artifacts from current and previous nodes, correlates and compares this data using machine learning algorithms, and securely duplicates all artifacts to immutable storage. Automated orchestration ensures consistent execution of forensic processes, and the system reverts containers to their original stateless state post-investigation. A detailed audit log and secure archival of all forensic data are maintained for future reference or legal compliance. The invention addresses the unique challenges of securing and analyzing data in dynamic, distributed containerized environments.

System and method for non-invasive monitoring and exploitation detection in third-party software processes. The system includes modules for scanning process memory to identify sensitive credentials such as application programming interface (API) keys and tokens, monitoring opened file descriptors including files, sockets, and inter-process communication channels, and analyzing network activity including domain name system (DNS) requests and encrypted connections. Runtime metadata such as privileges, environment variables and resource usage is also collected. The system correlates these signals to detect indicators of exploitation, such as unauthorized access, privilege escalation, or injected payloads, without modifying or instrumenting the monitored process. Integration with external security systems may enhance detection accuracy. Alerts and reports are generated in real-time to support incident response and forensic analysis.

To improve efficiency of a reporting process in incident response and improve reporting accuracy.SOLUTION: Report destination determination means determines a report destination for an incident based on information related to the incident. First prompt acquisition means acquires a basic prompt corresponding to the determined report destination. Second prompt acquisition means acquires an optional prompt based on a condition including the report destination. Prompt generation means combines the basic prompt and the optional prompt to generate a combined prompt. Document generation means inputs the combined prompt into a language model to generate a report document regarding the incident.SELECTED DRAWING: Figure 2

Every major DAO governance failure traces to a common root cause: governance logic, voting, and treasury access reside in software that adversaries can reach. The disclosed invention provides a hardware-anchored DAO governance architecture defeating five adversary classes. A supply-chain attestation layer verifies firmware integrity against a public transparency log at node initialization. A Silicon Root-of-Trust Anchor Layer binds governance to processor-embedded cryptographic keys. A Heterogeneous TEE Orchestration Layer enforces Byzantine fault-tolerant canonical quorum through threshold BLS signatures across independent hardware architecture families. An Atomic Governance Transition Engine executes indivisible state changes: record incorporation, key destruction, counter advancement, and IOMMU treasury isolation. A Quantum-Resistant Governance Key Lifecycle Engine performs CRYSTALS-Kyber (ML-KEM, FIPS 203) key rotation with cryptographic agility. A Cross-Chain Governance Attestation Bridge publishes TEE-signed proofs to multiple blockchains. A Deterministic Governance Replay Engine reconstructs governance decisions in isolated sandboxes. An Automated Governance Incident Response Engine and Governance Regulator Verification Network provide hardware-enforced, independently auditable compliance enforcement.

One example provides a server (110) that includes an electronic processor (210) configured to broadcast an incident alert (416) to a plurality of communication devices (130) within a geographical area associated with an imminent incident. The incident alert (416) includes an enrollment feature. The electronic processor (210) is configured to receive, via the enrollment feature in response to the incident alert (416), enrollment notifications from the plurality of communication devices (130) for enrolling the plurality of communication devices (130) in incident response location tracking for the incident, divide the plurality of communication devices (130) into a plurality of location-based clusters (426) based on pre-incident location information (422) of the plurality of communication devices (130); and rank the plurality of location-based clusters (426) based on location behavior of communications devices within each of the plurality of location-based clusters (426).

An incident response system and an incident response method [that] are able to generate and configure a processing workflow that includes a combination of external systems and individual processing components depending on the type of risk in order to respond to individual incidents. The incident response system, which responds to the individual incidents, includes a playbook DB, a playbook selection section, a workflow generation section, and a workflow engine section. The playbook DB stores processing workflows which are response flows for incidents of risks, as playbooks for individual types of risks. The playbook selection section acquires incident information regarding an incident that has occurred or appears to occur, and extracts a corresponding one of the playbooks that is appropriate for the incident from the playbooks created for the individual types of risks. The workflow generation section generates the processing workflows appropriate for the individual incidents incident.