130 results about "Incident response" patented technology

The invention relates to the technical field of network security, in particular to a network security dynamic early warning method and system based on a knowledge graph, and the method comprises the following steps: collecting real-time traffic data of a network, analyzing a data sequence by recognizing the characteristics of a state sequence and using a long and short-term memory network, and recognizing a behavior mode; and constructing a state time sequence model. According to the method, structured analysis of network behaviors is realized through time dependence analysis, refined mining of incidence relations between events, determination of a trigger chain and time relation of potential threats and reasoning process of a knowledge graph, abnormal behaviors and attack behaviors can be identified more accurately, global analysis capability of network threats is enhanced, and the network threats can be analyzed more accurately. The network environment change can be adapted in real time by dynamically adjusting the early warning threshold value and the early warning parameter, a more flexible and efficient threat response mechanism is realized, the combination of the early warning signal and the security event response is updated in real time, and the response speed and the processing efficiency of the security problem are optimized.

Disclosed herein are systems and methods for security monitoring and incident response using large language models. In one aspect, an exemplary method comprises: receiving input data from elements of Security Operations Center (SOC), generating and sending a query based on the received input data to a Large Language Model (LLM), parsing a response received from the LLM, and performing analysis to determine whether a threat has been identified. In one aspect, the method further comprises: when a threat is identified, collecting artifacts of the threat, and analyzing the threat further with involvement of security professionals, when a threat is not identified, determining whether additional data is needed, and when additional data is needed, determining a type of the additional data, when the type of additional data that is determined, collecting additional information from elements of the SOC, and when additional data is not needed, terminating the incident response.

Systems and methods for generating and customizing remediation scripts. Generative AI models can analyze existing scripts and tailor scripts according to specific incidents and environmental parameters, thereby creating a faster, more consistent, and error-free incident response process compared to existing solutions.

A predictive incident management system, consisting of: a sensor input module configured to receive heterogeneous telemetry data streams from mechanical, thermal, electrical and cyber sources; a temporal correlation control unit operationally coupled to the sensor input module, wherein the temporal correlation control unit is configured to normalize received data into a uniform time series envelope that includes identifiers, microsecond-precision timestamps, metric names, values, and context markers, and is further configured to compute sliding window-cross-sensor correlation matrices, event motifs, and lead-lag dependencies across multiple time granularities; a scalable rule processor that is communicatively linked to the control unit for temporal correlation, wherein the rule engine includes an in-memory runtime environment for processing complex events and a domain-specific declarative language, and is configured to apply rules that reference primitive sensor metrics, derived correlation features, and motive-based early warning vectors to classify, escalate, or resolve predicted incidents; A historical repository that is communicatively connected to both the temporal correlation control unit and the rule engine. The repository is configured to store tagged event histories, correlation motif dictionaries, rule versions, and rule origin metadata to ensure the verifiability and explainability of predictions; and An incident response interface is operationally connected to the rule engine. The incident response interface is configured to trigger automated workflows, including the generation of tickets for IT service management, chat ops notifications, the execution of orchestration playbooks, and direct machine control via industrial protocols. the system is configured to perform predictive analyses based on temporal correlations between sensors and to execute context-aware, rule-based incident management in real time.

A system (100) for securing cloud-based large language models through cyber threat defense and compliance monitoring, comprising: (a) an access control and authentication module configured to authenticate users and applications using role-based access control (RBAC) and multi-factor authentication (MFA); (b) a data protection and encryption module configured to encrypt data in transit and at rest and to anonymize sensitive input / output data using cryptographic techniques; (c) a threat detection and behavior monitoring module employing machine learning algorithms to identify anomalies and detect potential cyber threats in real time;(d) a regulatory compliance monitoring module configured to continuously assess system operations against applicable regulatory frameworks and generate alerts in the event of deviations from the regulations; (e) an incident response and mitigation module configured to automatically execute predefined response actions upon detection of threats or regulatory violations; (f) a logging, auditing, and forensic analysis module configured to securely log system activities, interactions, and threat events with cryptographic integrity protection; and (g) a governance and policy management module configured to define, update, and enforce organizational AI usage and compliance policies via the cloud-based LLM infrastructure.

A computing services environment may include a database system, a vector store, a generative language model interface, and / or an incident response system. The database system may be configured to detect a database system incident affecting database system availability or performance and to generate a database incident report characterizing the database system incident. The generative language model interface may be configured to determine a textual description of the database system incident and identify one or more records of the plurality of records by completing an incident evaluation prompt via a generative language model. An incident response engine may be configured to determine an instruction to resolve the database incident based on the textual description and the one or more records, wherein the database system is configured to execute the instruction to update one or more configuration parameters.

A governance, risk, and compliance (GRC) platform that is all-inclusive and that utilizes the attributes of assets to drive activities and manage risk. The platform includes risk mapping and cost analysis for applications, vendor risk analysis, business continuity, disaster recovery, incident response, policy management, and evidence collection. The platform utilizes questionnaires and vulnerability scans to evaluate risk and compliance.

A system and method for providing cybersecurity incident response is presented. The method includes receiving an incident input based on an event in a computing environment; generating an input for a generative artificial intelligence (AI) based on the received incident input; utilizing the generative AI to generate an output based on the generated input; utilizing the generative AI to associate the received incident input with an incident response action of a plurality of incident response actions; generating a query based on the received incident; executing the query on a security database, the security database including a representation of the computing environment; and initiating a mitigation action based on a result of the executed query and the associated incident response action.

Embodiments manage context repositories in computing environments to enhance automated security analysis. Embodiments obtain context records containing supplemental information associated with security events and integrates them into prompts for large language models (LLMs) to generate severity scores for event classification. Embodiments apply criteria to invalidate outdated or unreliable context records based on age, source reliability, and usage frequency, then modifies prompts and repositories accordingly. Enhanced prompts incorporate context record summaries and entity relationship mappings to improve subsequent event analysis. Embodiments dynamically evaluates context records through quality filters, consolidates duplicates, and maintains audit trails with provenance tracking. User interfaces are dynamically transformed based on telemetry metrics and user feedback to optimize analyst workflows. Embodiments enable organizations to maintain curated, high-quality context repositories that continuously improve AI-assisted security analysis while reducing false positives and enhancing incident response effectiveness.

Systems and methods are disclosed for real-time anomaly prediction using near real-time data. The invention addresses delays in telemetry data collection from infrastructure components, by collecting metrics and logging this data in real-time. Extracted logged data undergoes initial analysis to identify patterns and anomalies, followed by cleaning to remove noise and errors. Feature engineering enhances the data, creating or modifying features to improve machine learning model performance. The system calculates weighted means of previous data values and computes first and second-order differences to capture immediate changes and trends. These calculations adjust the extrapolated value to accurately reflect current conditions. The adjusted data is integrated into the dataset and validated. The validated data trains and tests a machine learning model, which is then finalized and deployed for real-time anomaly detection. This system ensures accurate and timely anomaly prediction, enabling automated incident response to maintain the reliability and performance of infrastructure components.

An incident response notification system may be provided by identifying, at a central service, a plurality of user devices to receive a reaction plan for an ongoing incident in an environment; customizing the reaction plan to produce a plurality of individualized versions, wherein each individualized version corresponds to an individual user device of the plurality of user devices and is customized based a device type of each individual user device and a role of a user associated with each individual user device in responding to the ongoing incident; and transmitting the individualized version to each corresponding individual user device of the plurality of user devices.

A network system of pattern analysis includes a centralized AI-based pattern analysis engine and each computing device comprises a local AI-based pattern analysis engine. The pattern analysis engine(s) each analyze computing operations on a local machine basis or a on a network basis depending on where installed. The AI-based pattern analysis engines identify common activity patterns for each machine and exclude the common activity patterns from further analysis of the computing operations, leading to more efficient identification of activity patterns indicative of nefarious activity. Once detected, the AI-based pattern analysis engines trigger an incident response to counter the nefarious activities. The AI-based pattern analysis engines include AI models that are continually or periodically trained to update the baseline common activity patterns.

The invention discloses a chaos annealing ant colony-based adversarial blocking timeliness emergency material transportation toughness intelligent decision-making method, and relates to the technical field of intelligent emergency scheduling and optimization. The method comprises the steps of 1, extracting scene data and converting the scene data into model parameters; step 2, constructing a mathematical model for survivability optimization; 3, initializing algorithm parameters and generating an initial path; 4, dynamically adjusting the temperature and the pheromone volatilization rate; 5, generating an adversarial blocking perception path and implementing detour repair; 6, updating pheromone distribution based on an annealing criterion; and step 7, locking the critical path and outputting an optimal transportation scheme. According to the method, timely delivery of materials can be guaranteed in a complex road network blocking and emergency demand scene, the timeliness and toughness of an emergency transportation system are improved through a chaos annealing mechanism and an adversarial blocking simulation technology, the method can be widely applied to the fields of natural disaster rescue, public health event response and the like, and a scientific basis is provided for emergency decision making.

AI-powered data breach detection and prevention system that includes: a threat monitoring module for continuous analysis of network traffic, system logs and user activities; an AI-powered anomaly detection module that uses machine learning to detect threats, including zero-day attacks and insider threats; a behavioral analysis module that tracks user authentication, access patterns, and privilege escalations; an automated incident response module that isolates threats, blocks unauthorized access, and alerts security teams; a threat intelligence module that integrates global cybersecurity databases for proactive risk mitigation; a multi-layered security system with endpoint protection, encryption and role-based access control; a privacy-preserving mechanism that uses homomorphic encryption and federated learning to protect sensitive data; a compliance and audit module that ensures compliance with cybersecurity regulations.

The invention relates to the technical field of information security early warning, and discloses a low-delay event response method based on an information security monitoring and early warning AI platform, which comprises the following steps of: acquiring various monitoring data in real time through sensor nodes, identifying information abnormality and space-time characteristic node value of the acquired data, and processing according to an information packaging standard; the method comprises the steps of forming an information response chain with a priority response weight, sequentially analyzing to-be-analyzed information through an information analysis layer to obtain an early warning feedback feature, performing information association tracking based on the early warning feedback feature, dividing related information into high association information and common association information, and respectively adjusting response priorities, thereby improving the response speed to a security event. According to the method, low-time-delay processing is ensured, the response priority is optimized through intelligent analysis, irrelevant event interference is effectively reduced, potential threats can be rapidly recognized in multi-dimensional data, the emergency processing capacity of the system is enhanced, and the problem that in the prior art, early warning response cannot be effectively conducted on security events in time is solved.

A dynamic, infrastructure-aware incident response and automated problem resolution system (100) for cloud environments, comprising: (a) an infrastructure and topology mapping module configured to continuously scan, discover, and map virtualized and containerized cloud resources and their interdependencies in real time; (b) an incident detection and correlation module configured to ingest telemetry data from distributed monitoring sources and apply rule-based and machine learning models to detect, correlate and classify system incidents; (c) a context analysis and impact assessment module configured to analyse the scope, severity and business impact of incidents based on real-time infrastructure context and service dependency diagrams; (d) a policy-driven decision engine configured to dynamically select response actions based on predefined rules, compliance policies, service level agreements and historical incident data; e) an Automated Remediation Orchestrator configured to execute predefined or dynamic remediation playbooks through integrations with cloud orchestration and configuration tools; and (f) a feedback loop and learning module configured to collect post-incident data, evaluate the effectiveness of remedial actions, and continuously refine the detection and response logic using machine learning algorithms.

The invention provides a lightweight satellite network security management system and method. According to the system, unified management of a satellite network security control plane is realized through the centralized network controller. The system has the functions of satellite node security authentication, dynamic security policy generation and issuing, real-time network monitoring, rapid security event response and the like. The network controller comprises an authentication module, a strategy generation module, a monitoring module, an event response module and the like, a security strategy can be customized according to satellite characteristics, and security threats can be dealt with through real-time monitoring and timely adjustment. The invention also comprises a lightweight design which is particularly suitable for a satellite environment with limited resources, and a method for continuously optimizing a security policy based on monitoring data and event records. In addition, the provided user interface allows a satellite network administrator to conveniently perform policy configuration and event processing. According to the system, through centralized management and dynamic adjustment, the safety and the operation efficiency of the satellite network are remarkably improved, the system has the advantages of light weight, flexibility, real-time performance and the like, and the safety management requirement of the modern satellite network is met.

Smart job generation for incident response includes receiving a natural language request to generate a job definition. The natural language request includes a natural language description of a job executable by a computing device. The natural language description of the job is decomposed into one or more tasks. Each task of the one or more tasks is a natural language description of a portion of the job. The job definition is generated. The job definition includes one or more instructions. At least one instruction of the one or more instructions corresponds to a task of the one or more tasks, such that performance of the at least one instruction accomplishes the task. The job definition is executed, by the computing device, to perform the job in response to an incident.

The invention discloses a reinforcement learning-based neighborhood event coping strategy generation method and device and a medium, and the method comprises the steps: setting parameters according to a scene of a neighborhood event, and constructing a reinforcement learning model; and obtaining an initial state, carrying out reinforcement learning on the reinforcement learning model by adopting a Q-Learning algorithm, and iteratively determining an optimal strategy by taking reward maximization as a target. The device comprises a setting module and a simulation module. The medium comprises a computer program in which the reinforcement learning-based neighborhood event coping strategy generation method is stored. By using the method, the problem that a traditional risk crisis analysis method lacks universality and dynamic uncertainty is solved, and the unstable risk caused by the neighbor avoidance event can be effectively solved by outputting the optimal behavior strategy. The method can be widely applied to the field of strategy self-generation.

A network system of pattern analysis includes a centralized AI-based pattern analysis engine and each computing device comprises a local AI-based pattern analysis engine. The pattern analysis engine(s) each analyze computing operations on a local machine basis or a on a network basis depending on where installed. The AI-based pattern analysis engines identify common activity patterns for each machine and exclude the common activity patterns from further analysis of the computing operations, leading to more efficient identification of activity patterns indicative of nefarious activity. Once detected, the AI-based pattern analysis engines trigger an incident response to counter the nefarious activities. The AI-based pattern analysis engines include AI models that are continually or periodically trained to update the baseline common activity patterns.

A computer-implemented method (CIM), according to one embodiment, includes, tuning a plurality of Large Language Models (LLMs) to debate one another to determine solutions for incidents, and causing data associated with a first incident to be input into the LLMs. The method further includes incorporating solutions output by the LLMs into a recommendation for resolving the first incident. The recommendation weighs trade-offs of different possible resolutions for solving the first incident. The method further includes outputting the recommendation to a user interface of a user device. A computer program product (CPP), according to another embodiment, includes a set of one or more computer-readable storage media, and program instructions, collectively stored in the set of one or more storage media, for causing a processor set to perform the foregoing method.

Systems and methods for providing user location-based collaboration are provided herein. In an aspect, a method includes receiving, by a video conference provider, a request to initiate an incident response system and establishing, by the video conference provider, an incident response session with the incident response system. The method may also include determining, by the video conference provider, a location associated with the incident response system and determining, by the video conference provider, client devices within a predetermined vicinity of the location. The method may also include transmitting, by the video conference provider, a request to one or more of the client devices to join the incident response session. In an example, the request to initiate an incident response system may be from an administrator of a facility where an incident event has occurred.

An incident management system for managing an incident response may be provided. The incident management system may include an incident management (IM) computing device and a vehicle. The IM computing device may include a processor and memory, the processor may be programmed to receive a notification that an incident has occurred, the notification including sensor data and sub-system data. The processor may analyze the data to determine an incident response, the determination including categorizing the incident based on damage determined from the data. The processor may also identify a responding party based on the incident response and the category of the incident. The processor may further parse the data to generate a set of critical data. The critical data may be based on the responding party. The processor may transmit a message to the responding party including the critical data and the location of the vehicle.

The invention discloses an intelligent dispatching method and system for social governance events, and the method comprises the steps: obtaining audio and video data at different monitoring points, and carrying out the analysis to obtain the number of persons, movement data and posture data; when the detected number of persons exceeds a preset value, the person movement data is further analyzed to calculate a person aggregation degree value. If the aggregation degree value is higher than the historical average value of the monitoring points and lasts for a certain time, the system can extract voice text keywords from the audio and video data, and the social governance event type is determined in combination with personnel movement and posture data. Meanwhile, the system can also obtain the position distribution information of the inspection personnel, and formulate an optimal inspection task assignment scheme according to the event type and the position of the inspection personnel, thereby achieving the quick and accurate assignment of tasks, and improving the event response speed and handling efficiency.

A computing services environment may include a database system, a vector store, a generative language model interface, and / or an incident response system. The database system may be configured to detect a database system incident affecting database system availability or performance and to generate a database incident report characterizing the database system incident. The generative language model interface may be configured to determine a textual description of the database system incident and identify one or more records of the plurality of records by completing an incident evaluation prompt via a generative language model. An incident response engine may be configured to determine an instruction to resolve the database incident based on the textual description and the one or more records, wherein the database system is configured to execute the instruction to update one or more configuration parameters.

A method for security incident detection in a cloud-native distributed control system (DCS) in industrial process automation includes monitoring information technology, IT-related data and operation technology, OT-related data at a production process and at a containerized DCS associated with the production process. The method further comprises joint analysing of first data indicative of first monitoring data from the monitoring of the IT-related data and of second data indicative of second monitoring data from the monitoring of the OT-related data. The method further comprises, based on the joint analysing, detecting a security incident under consideration of predetermined security incident detection rules: The method further comprises, based on a result of the detecting, responding on a detected security incident for handling of the detected security incident under consideration of predetermined security incident response rules.

This invention presents a vehicle safety system (VSS) for autonomous vehicles (AVs) utilizing an onboard unit (OBU) capable of communicating with various entities, comprising roadside units (RSUs), other OBUs, and cloud platforms. The OBU incorporates a safety subsystem designed to implement proactive, active, and passive safety measures. The proactive safety measures comprise incident prediction and warnings. The active safety measures comprise emergency braking, and the passive safety measures comprise incident response and dynamic routing. This VSS can be further enhanced by incorporating sensing and processing capabilities of the RSU network or the cloud platform, enabling distributed and integrated safety functions and improved environmental awareness. The system aims to enhance AV safety by addressing incidents before, during, and after their occurrence through comprehensive safety measures at a system level, comprising a vehicle centric system, a vehicle-road system, or a vehicle cloud system.

An emergency response data system (ERDS) provides AI-based real-time intelligence during a response to an incident. The system includes a monitoring module configured to receive and process incident metadata from an emergency system, such as a Computer-Aided Dispatch (CAD) system, wherein the incident metadata includes location, type of emergency, units dispatched, and comments. An analysis module analyzes the incident metadata and identifies changes in incident circumstances, including comparing current comments with historical comments corresponding to the location. A data retrieval module accesses and retrieves public record information corresponding to the location, including property data, tax records, real estate records, historical records, and permits. An insight generation module generates real-time insights and updates regarding the incident, including reclassifying the type of emergency based on the analyzed metadata and retrieved public records. An alert module transmits the real-time insights to emergency personnel, including field responders and Emergency Communication Centers (ECC).

Several features of cybersecurity frameworks are disclosed. In one example, a computing platform receives, from an enterprise user device, cyber threat investigation information indicating actions performed to address an identified threat for a client through an incident response lifecycle of the identified threat. This computing platform receives, from a client user device, a request for the cyber threat investigation information, and generates, using this cyber threat investigation information, a client interface, which includes a time-series graphical representation of the actions performed to address the identified threat and a play button, selection of which may cause automated progression through the time-series graphical representation within the client interface. This computing platform sends, to the client user device, the client interface and commands to display the client interface, which may cause the client user device to display the client interface.

An emergency response system provides a map-based interface for a telecommunicator to view information about an incident and coordinate a response to the incident. The emergency response system gathers supplemental data regarding locations and other information that may be relevant in assisting with the incident. The interface may automatically select relevant supplemental information based on the incident and provide this incident-specific information for display on the interface. The user may then select a response on the interface such as a unit to dispatch that the system automatically implements, providing unified information and control for incidents, supplemental information, and incident response.