55 results about "Security operations center" patented technology

Disclosed embodiments provide techniques for cybersecurity AI-driven workflow modifications. A security orchestration, automation, and response (SOAR) platform used to manage a plurality of cybersecurity threat protection applications deployed across a cybersecurity network is accessed. A cybersecurity workflow is executed using the SOAR platform and one or more cybersecurity actions related to the workflow are captured and analyzed for workflow relevance. The cybersecurity actions can include steps taken by security operations center staff and automated cybersecurity threat protection applications. The analysis can be performed by machine learning, and can include evaluations of repeated cybersecurity incidents, operation regression exercises, and suggested remedial steps. The workflow analysis can include identifying recidivistic security operations responses. Based on the analysis, the cybersecurity workflow is updated to improve workflow quality. The updating can include reordering the workflow steps, automating responses of operations staff, or executing actions recommended by separate AI cybersecurity systems.

Disclosed herein are systems and methods for security monitoring and incident response using large language models. In one aspect, an exemplary method comprises: receiving input data from elements of Security Operations Center (SOC), generating and sending a query based on the received input data to a Large Language Model (LLM), parsing a response received from the LLM, and performing analysis to determine whether a threat has been identified. In one aspect, the method further comprises: when a threat is identified, collecting artifacts of the threat, and analyzing the threat further with involvement of security professionals, when a threat is not identified, determining whether additional data is needed, and when additional data is needed, determining a type of the additional data, when the type of additional data that is determined, collecting additional information from elements of the SOC, and when additional data is not needed, terminating the incident response.

A system and method are provided for providing guidance to SOC professionals regarding follow-up response actions to detection incidents. A machine-learning (ML) model is trained to receive incident data for security incidents / detections. The ML model then classifies the incidents / detections and determines thereby follow-on actions. Using the trained ML model to automatically generate follow-on actions enables the Security Operation Center (SOC) to timely triage and remediate a high volume of security incidents / detections. Reinforcement training data is generated based on user feedback generated when the SOC reviews the generated follow-on actions and then responds to the incident. The reinforcement training data is used to update and improve the ML model, allowing the ML model to adapt to evolving security threats and conform to current best practices.

The embodiment of the invention provides an auxiliary decision-making method and system of a safety operation center. The method comprises the following steps: acquiring multi-source heterogeneous data of a target network in a preset historical time period; determining a potential attack chain based on the multi-source heterogeneous data; determining vulnerability data based on the multi-source heterogeneous data and the potential attack chain; based on the vulnerability data, at least one repair reference standard is generated, and the repair reference standard comprises a repair method and repair cost; and generating a repair decision based on the vulnerability data and at least one repair reference criterion, and performing repair based on the repair decision.

A computer-implemented method for cybersecurity management is disclosed. One or more cybersecurity threat protection applications deployed across a managed network are accessed. The cybersecurity threat protection applications are managed using a security orchestration, automation, and response (SOAR) platform. One or more threat protection indications from the cybersecurity threat protection applications are accumulated and analyzed. The analyzing determines an indication abnormality, inferring a cybersecurity threat protection application misconfiguration. The misconfiguration can be based on false positive indications, conflicting indications from two or more cybersecurity threat protection applications, or time-sequenced indications from one or more cybersecurity threat protection applications. The analyzing and inferring are performed using machine learning which is embedded in the SOAR platform. Remedial actions based on the inferred misconfiguration are provided to personnel staffing a security operations center and / or ingested by the SOAR for automatic reconfiguration.

The present invention belongs to the field of network attack detection, and specifically relates to a network security monitoring system for responding to APT attacks. The system comprises an industrial control network gateway security device, an industrial control network management system, and an industrial control network security operations center. The industrial control network gateway security device includes a behavioral data collection module for collecting network traffic and system activity data from various devices, including intrusion detection systems and flow probes, and providing the data to the industrial control network management system. The industrial control network management system includes a data preprocessing module, a subgraph generation module, a behavioral feature extraction module, and a model training and anomaly detection module. The module preprocesses raw data, generates traceability graphs and subgraphs, extracts behavioral features, and establishes a classification model for anomaly detection. The industrial control network security operations center includes a risk warning reporting module that visually reports detected risks to security operations personnel and generates detailed analysis reports.

The invention discloses a network threat systematic protection method, and belongs to the technical field of network security. According to the method, a unified policy center is constructed, and three layers of security policies of an overlay network, a terminal and an application are defined and issued in a unified manner; network admission control, terminal security management and API risk monitoring systems are deployed to execute strategies respectively; an intelligent linkage mechanism is established, and cross-system automatic co-processing is realized; centralized monitoring, data aggregation and visual analysis are carried out through the unified safety operation center, and support is provided for optimization; and continuously optimizing the strategy and the rule based on the operation data. According to the invention, the problems of isolation, strategy splitting and response lag of a protection system in the prior art are solved, and an active defense system with cooperative linkage and continuous evolution is constructed.

A system and method for a flexible, high-speed Managed Detection and Response platform that ingests, parses, normalizes, monitors, and correlates nearly any log source or security tool output. The MDR comprising of a declarative connector service that tags events with appropriate data source labels to facilitating data isolation, proper handling, and provenance across multiple customers and security products but otherwise aggregate alerts into a single data stream for consumption by the MDR SOC operators. A connector service further provides a programmatic (API-based) means to interchange data securely across environments. Event data is aggregated by the Managed Detection and Response platform that then utilizes enhanced log ingest capabilities to process the data allowing SOC operators to be able to write rules against the alerts.

Various techniques for DNS security operations center insights are disclosed. In some embodiments, a system / process / computer program product for DNS security operations center insights includes collecting Domain Name System (DNS) security associated events; generating a plurality of insights based on the collected DNS security associated events; and performing an action based on one or more of the insights.

The invention belongs to the field of network attack detection, and particularly relates to a network security monitoring system for coping with APT (Advanced Persistent Threat) attacks. Comprising an industrial control network gateway security device, an industrial control network management system and an industrial control network security operation center, and the industrial control network gateway security device comprises a behavior data collection module which is used for collecting network traffic and system activity data of various devices including an intrusion detection system and a traffic probe; providing for an industrial control network management system; the industrial control network management system comprises a data preprocessing module, a subgraph generation module, a behavior feature extraction module and a model training and anomaly detection module. Preprocessing the original data, generating a traceability graph and a sub-graph, extracting behavior characteristics, and establishing a classification model for anomaly detection; and the industrial control network security operation center comprises a risk prompt reporting module which reports the detected risk to security operation personnel in a visual mode and generates a detailed analysis report.

The invention discloses an automobile information safety protection method and device based on a multi-level protection mechanism, equipment and a storage medium, and relates to the technical field of new energy automobiles. At least one of external communication protection configuration, internal communication protection configuration, hardware protection configuration and software protection configuration of a vehicle is detected; and generating a protection detection result, thereby performing real-time monitoring and deep analysis on the network traffic, the host behavior and the vehicle network state, and feeding back the obtained monitoring analysis result to the cloud security operation center, so as to respond to an abnormal event in time, realize comprehensive perception and dynamic evaluation of the vehicle information security state, and improve the safety of the vehicle. Multiple threats such as external attacks, internal tampering, hardware vulnerabilities and software risks are effectively identified, and in combination with cloud collaborative response, early warning is performed on security incidents, so that the adaptive adjustment capability of a protection strategy is remarkably enhanced, the probability of occurrence of security incidents is reduced, and vehicle operation security and user data privacy are guaranteed.

A packet-filtering network appliance such as a threat intelligence gateway (TIG) protects TCP / IP networks from Internet threats by enforcing certain policies on in-transit packets that are crossing network boundaries. The policies are composed of packet filtering rules derived from cyber threat intelligence (CTI). Logs of rule-matching packets and their associated flows are sent to cyberanalysis applications located at security operations centers (SOCs) and operated by cyberanalysts. Some cyber threats / attacks, or incidents, are composed of many different flows occurring at a very high rate, which generates a flood of logs that may overwhelm computer, storage, network, and cyberanalysis resources, thereby compromising cyber defenses. The present disclosure describes incident logging, in which a single incident log efficiently incorporates the logs of the many flows that comprise the incident, thereby potentially reducing resource consumption while improving the informational / cyberanalytical value of the incident log for cyberanalysis when compared to the component flow logs. Incident logging vs. flow logging can be automatically and adaptively switched on or off depending on the combination of resource consumption and informational / cyberanalytical value.

A system and method for deploying cybersecurity resources includes sourcing cybersecurity operations data that includes a plurality of distinct datasets derived from a handling of a target cybersecurity event; extracting, from the cybersecurity operations data, at least cybersecurity task feature data relating to a plurality of cybersecurity tasks and metadata, wherein each cybersecurity task of the plurality of cybersecurity tasks includes an identification of an operation executed when handling or the target cybersecurity event and an identification of an operator executing the operation; deriving timestamp data for each operation executed by a respective operator of each respective cybersecurity task of the plurality of cybersecurity tasks instantiating, by computer processors, a cybersecurity event data structure; using entries of the cybersecurity event data structure to compute allocation values for cybersecurity resources for handling impending cybersecurity events; and deploying, within a security operations center (SOC) of the cybersecurity service, the cybersecurity resources.

The application relates to the technical field of network security, and discloses a dynamic network security risk identification system and method based on multi-source intelligence and AI driving, which comprises a dynamic attack graph modeling module, an AI-driven attack simulation engine and a cooperation module.The modeling module fuses multi-source heterogeneous intelligence to construct a network attack graph and calculate node intelligence confidence; the AI engine takes the confidence into a state space, uses a dynamic entropy mechanism to real-time adjust the randomness of reinforcement learning exploration to accurately simulate an attack path; and the cooperation module links external attack surface management and a security operation center to execute closed-loop feedback verification of automatic defense response and path elimination.The application establishes a mapping relationship between intelligence confidence and exploration strategy, effectively solves the problems of uneven multi-source data quality and unknown path missing report, realizes an automatic closed loop from risk perception, simulation deduction to effect verification, and significantly improves risk identification accuracy and response timeliness.

Systems and methods for remote monitoring of a Security Operations Center (SOC) via a mobile application are provided. According to one embodiment, a management service retrieves information regarding multiple network elements that are associated with an enterprise network and extracts parameters of the monitored network elements from the retrieved information. The management service prioritizes the monitored network elements by determining a severity level associated with security-related issues of the network elements and generates various monitoring views that summarize in real time various categories of potential security-related issues detected by the SOC. Further, the management service assigns a priority to each monitoring view and displays a video on the display device that cycles through monitoring views in accordance with their respective assigned priorities.

A system and method for deploying cybersecurity resources includes sourcing cybersecurity operations data that includes a plurality of distinct datasets derived from a handling of a target cybersecurity event; extracting, from the cybersecurity operations data, at least cybersecurity task feature data relating to a plurality of cybersecurity tasks and metadata, wherein each cybersecurity task of the plurality of cybersecurity tasks includes an identification of an operation executed when handling or the target cybersecurity event and an identification of an operator executing the operation; deriving timestamp data for each operation executed by a respective operator of each respective cybersecurity task of the plurality of cybersecurity tasks instantiating, by computer processors, a cybersecurity event data structure; using entries of the cybersecurity event data structure to compute allocation values for cybersecurity resources for handling impending cybersecurity events; and deploying, within a security operations center (SOC) of the cybersecurity service, the cybersecurity resources.

Disclosed techniques include cybersecurity operations center load balancing. A cybersecurity security operations center (SOC) caseload history is accessed. Triage results from the SOC caseload history are analyzed on a computer platform to produce an analyst threat response profile. The analyst threat response profile is augmented with threat response resolution metrics. The threat response resolution metrics are updated with a subjective rating. The subjective rating is supplied by management, peers, or machine learning. Notification of a new cybersecurity threat is received across a cybersecurity network by the SOC. The new cybersecurity threat is assigned to a specific analyst, based on the augmented analyst threat response profile. The assigning is further based on weighting of threat severity, threat complexity, and analyst availability. An existing SOC caseload is reassigned to increase availability of the specific analyst.

The technology described herein relates to Security Operations Center (SOC) operations in a standalone architecture. In embodiments, the SOC comprises a producer that communicates with a first Network Repository Function (NRF) and a second NRF over a network repository function service-based interface. In embodiments, the producer (e.g., a Session Management Function, a Policy Control Function) can monitor heartbeats received from the first NRF and the second NRF. The first NRF, in some embodiments, can transmit a notification to the producer indicating that the first NRF is out-of-service. In some embodiments, the first NRF can also transmit another notification to the producer that indicates the first NRF is in-service. Based on the producer receiving the notification that the first NRF is out-of-service, the producer can suspend the monitoring of the heartbeats sent by the first NRF.

To provide a log analysis device, method, and program which enhance the accuracy of determination of false positives and enhance the accuracy of analysis of cyber attacks using security event logs in analysis in a Security Operations Center.SOLUTION: A log analyzing device 10 includes a log acquiring unit 101 that acquires a log indicating an abnormality detected by a sensor of an ECU in a vehicle, a vehicle-state-information acquiring unit 102 that acquires vehicle-state information indicating an internal state and an external state of the vehicle, a storage unit 104 for storing a false-positive determination rule for determining that an abnormality indicated by the log is a false-positive that is an abnormality not caused by cyber attacks, and a false positive estimation rule for determining the possibility of false positive, a false positive log determination unit 105 for determining whether a log is a determined false positive log or an estimated false positive log based on the log or vehicle state information, and an output unit 107 for outputting the estimated false positive log together with flag information showing the estimated false positive without outputting the determined false positive log.SELECTED DRAWING: Figure 6

A system and method are provided for providing guidance to SOC professionals regarding follow-up response actions to detection incidents. A machine-learning (ML) model is trained to receive incident data for security incidents / detections. The ML model then classifies the incidents / detections and determines thereby follow-on actions. Using the trained ML model to automatically generate follow-on actions enables the Security Operation Center (SOC) to timely triage and remediate a high volume of security incidents / detections. Reinforcement training data is generated based on user feedback generated when the SOC reviews the generated follow-on actions and then responds to the incident. The reinforcement training data is used to update and improve the ML model, allowing the ML model to adapt to evolving security threats and conform to current best practices.

A method for generating representative Key:Value pairs of cyber event or cyber asset behavior and de-duplicating multiple alerts associated with a cyber event or cyber asset behavior. The Key:Value pairs comprise a hash value representative of the cyber event or cyber asset behavior and an asset identifier. The Key:Value pairs provides a security operations center a queryable identifier to easily track the behavior of an asset and determine the number of cyber event observations in a predetermined time period.

A system and method are provided for providing guidance to SOC professionals regarding follow-up response actions to detection incidents. A machine-learning (ML) model is trained to receive incident data for security incidents / detections. The ML model then classifies the incidents / detections and determines thereby follow-on actions. Using the trained ML model to automatically generate follow-on actions enables the Security Operation Center (SOC) to timely triage and remediate a high volume of security incidents / detections. Reinforcement training data is generated based on user feedback generated when the SOC reviews the generated follow-on actions and then responds to the incident. The reinforcement training data is used to update and improve the ML model, allowing the ML model to adapt to evolving security threats and conform to current best practices.

A pipeline has been created that leverages artificial intelligence and machine learning to efficiently extract information from CTI reports obtained from various sources and yielding information that assists security analysts / threat teams (e.g., security operations centers (SoCs)) and improving the quality of CTI. The “CTI analysis pipeline” employs generative artificial intelligence (“genAI”) to summarize a collection of CTI threat reports and extract threat-related information including TTPs from the CTI reports. Relationships among the threat reports are determined based on the extracted threat-related information and encoded in a graph structure. Graph embeddings based on the relationships encoded in the graph structure and semantic embeddings from the report summaries are combined and the combined embeddings are clustered. The resulting clusters and trained clustering model can be used in various ways to improve CTI, such as determining malicious campaigns, augmenting existing campaign information, and detecting new IOCs and TTPs for existing campaigns and new campaigns.

The technology described herein relates to Security Operations Center (SOC) operations in a standalone architecture. In embodiments, the SOC comprises a producer that communicates with a first Network Repository Function (NRF) and a second NRF over a network repository function service-based interface. In embodiments, the producer (e.g., a Session Management Function, a Policy Control Function) can monitor heartbeats received from the first NRF and the second NRF. The first NRF, in some embodiments, can transmit a notification to the producer indicating that the first NRF is out-of-service. In some embodiments, the first NRF can also transmit another notification to the producer that indicates the first NRF is in-service. Based on the producer receiving the notification that the first NRF is out-of-service, the producer can suspend the monitoring of the heartbeats sent by the first NRF.

Various techniques for DNS security operations center insights for mass spreading detection are disclosed. In some embodiments, a system / process / computer program product for DNS security operations center insights for mass spreading detection includes collecting Domain Name System (DNS) security associated events; generating a plurality of insights based on the collected DNS security associated events, wherein at least one of the plurality of insights includes a mass spreading detection insight; and performing an action based on one or more of the insights including the mass spreading detection insight.

Embodiments disclosed herein provide a method and system for detecting real-time security threats by a security management engine deployed at an edge network entity in an open radio access network (O-RAN) system and implementing dynamic security policy in real-time and isolating services or components at system level. The method includes receiving input data from one or more target network entities by the security management engine deployed at the edge network entity. The security management engine compares one or more parameters of the input data with pre-defined reference parameters to identify anomalies. Based on the comparison, the method includes detecting an anomaly corresponding to at least one target network entity, in real-time by the security management engine. Upon detecting an anomaly, a real-time response may be implemented by applying a dynamic policy on an affected component and isolating the affected component.

Disclosed herein are systems, methods, and processes for a machine learned alert triaging classification (ATC) system that uses machine learning techniques to generate an alert triage classification model that can be trained and deployed in modern security operation centers to optimize alert triaging and cyber threat classification. A training dataset of classified records is obtained. Each classified record in the training dataset includes detection characteristics data of a set of machines and threat classification results produced by performing alert triage classification of detection messages associated with the set of machines. An ATC model is trained using the training dataset according to a machine learning technique. The training tunes the ATC model to classify, based on at least the detection characteristics data, a new detection message associated with a machine from the set of machines as a threat or as not a threat.

1. The name of the design product: the security operation center monitoring graphical user interface of electronic equipment. 2. The use of the design product: for program running and data display. 3. The design points of the design product: the graphical user interface in the screen. 4. The picture or photo that best indicates the design points: the front view. 5. The use of the graphical user interface: for viewing the current operation security status and intuitively displaying the overall security data. 6. The human-computer interaction mode of the graphical user interface: the front view is the initial interface; when the "view real-time operation situation" button in the upper left corner of the front view is clicked, the interface change state diagram can be entered.

This invention is related to a data management platform for security incidents, which may be adopted by large-scale enterprises, government agencies, financial institutions and healthcare providers and may be used in security operations centers to meet the needs of institutions and organizations in cybersecurity, network management and data analytics, characterized in that it comprises a WAF (1) which detects attacks by monitoring web applications and records these attacks with timestamps and types thereof, a SQL database (2) where the data collected by WAF (1) is organized, a data transfer module (3) where data collected by WAF (1) is securely transmitted in real time to SQL database (2) via a data transfer interface where the format and transfer protocols are managed, and a storage module (4) in which the data organized in the SQL database (2) are stored for the analyzing and reporting processes.

A server for identifying and prioritizing IT security events associated with a network is caused to receive a dataset representing IT security events specific to one or more resources associated with the network, generate, by defined algorithms, individual scores for the IT security events, correlate each of the individual scores for the IT security events with the one or more resources, aggregate, for a resource of the one or more resources, each of the individual scores correlated with the resource into a security score specific to the resource, determine whether the security score exceeds a defined threshold, and in response to the security score exceeding the defined threshold, generate and transmit a security incident alert specific to the resource to a security operation center. Example servers, systems, apparatuses, methods, and non-transitory computer readable medium for identifying and prioritizing IT security events associated with a network are also disclosed.