IOC Validation Workflow for Risk-Based Security System Routing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional methods for managing indicator of compromise (IOC) in network security systems are inefficient, often failing to timely add IOCs to security systems and prioritize them based on risk levels, leading to exposure to cybersecurity threats.

Innovation Solution

An automated system and method for validating and prioritizing IOCs using internal and external sources, determining appropriate security systems for addition, and continuously monitoring to mitigate threats.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If manual methods are used to manage IOCs, then system complexity is reduced, but IOC processing efficiency and timeliness deteriorate

Engineering Contradiction:

ImproveIOC processing efficiencyVSAvoidsystem complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The system automatically validates IOCs against multiple external sources, determines appropriate security systems, and prioritizes IOCs based on risk indicators without requiring manual intervention. The system serves itself by autonomously completing the entire IOC management workflow from validation to prioritization to addition to security systems.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system performs preliminary validation of IOCs against external sources before adding them to security systems. It pre-determines which security systems should receive each IOC and pre-calculates risk scores and priorities, ensuring that IOCs are ready for immediate deployment when threats are detected.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If IOCs are added to multiple security systems, then security coverage is improved, but redundancy and resource waste increase

Engineering Contradiction:

Improvesecurity coverageVSAvoidresource waste

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The system assigns each IOC to specific security systems based on local characteristics of both the IOC and the security systems. It determines which security systems are most appropriate for each IOC type and adds IOCs only to those systems, avoiding unnecessary duplication while ensuring each IOC reaches the most relevant security controls.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The system continuously monitors IOCs across security systems and identifies redundancies. When an IOC is detected in multiple security systems, the system provides feedback to remove duplicates, optimizing resource utilization while maintaining comprehensive security coverage through intelligent IOC distribution.

Inventive Principle:

Principle #23Feedback

3Reliability

If all IOCs are treated equally, then processing simplicity is maintained, but risk-based prioritization and response effectiveness deteriorate

Engineering Contradiction:

Improveresponse effectivenessVSAvoidprioritization complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system changes the parameter of IOC evaluation by introducing risk indicators and calculating risk scores for each IOC. Instead of treating all IOCs equally, the system transforms IOC data into prioritized rankings based on multiple risk parameters, enabling security teams to respond to the most critical threats first while systematically managing less urgent IOCs.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS12483533B2Automatic validations and prioritizations of indicators of compromise

Publication Date: 2025.11.25 THE TORONTO DOMINION BANK

AI summary

One example method includes receiving indicator of compromise (IOC) intelligence including an IOC. The IOC can then be validated. One or more security systems to add the IOC can then be determined based on one or more risk indicators of the IOC. The IOC can then be added to the one or more security systems. The validation of the IOC may include using machine learning to determine a likelihood of a threat.