# US 10,372,904 B2 · Cost prioritized evaluations of indicators of compromise > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,904 B2 - Document ID: US10372904B2 - Status: Granted - Kind: B2 - Application number: 15/215,468 - Filed: 2016-07-20 - Published: 2017-09-14 - Granted: 2019-08-06 - Earliest claimed: 2016-03-08 - Assignees: Tanium Inc. - Applicants: Tanium Inc. - Inventors: Christian L. Hunt; Thomas R. Gissel; Thomas W. Savage - Web page: https://patentgrep.com/patent/US10372904B2 ## CPC - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 41/0813: characterised by the conditions triggering a change of settings - H04L 41/0894: Policy-based network configuration management - H04L 41/12: Discovery or management of network topologies - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) - G06F 2221/034: Test or assess a computer or a system - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for evaluating indicators of compromise (IOCs) is performed at a device having one or more processors and memory. The method includes receiving respective specifications of a plurality of IOCs, wherein the respective specifications of each IOC of the plurality of IOCs includes a respective cost associated with evaluating the IOC. The method further includes dynamically determining an order for evaluating the plurality of IOCs based on the respective costs associated with the plurality of IOCs, and determining whether a threat is present based on results for evaluating one or more of the plurality of IOCs in accordance with the dynamically determined order, instead of an order by which the plurality of IOCs have been received at the device. ## Claims ### Claim 1 A method of threat management in a network of machines, the method comprising: at a device having one or more processors and memory, wherein the device is a server or a client machine within the network of machines, and the device is separated from external networks by one or more firewalls: receiving respective specifications of a plurality of indicators of compromise (IOCs), wherein the respective specification of each IOC of the plurality of IOCs includes a respective cost associated with evaluating the IOC; dynamically determining, without requiring user intervention after receipt of the respective specifications of the plurality of IOCs, an order for evaluating the plurality of IOCs based on the respective costs associated with evaluating the plurality of IOCs; determining whether a threat is present in the network of machines based on results for evaluating one or more of the plurality of IOCs in accordance with the dynamically determined order, instead of an order by which specifications of the plurality of IOCs have been received at the device; determining modified respective costs associated with the one or more of the plurality of IOCs; dynamically determining a revised order for evaluating the plurality of IOCs based on the respective costs associated with the plurality of IOCs, including the modified respective costs associated with the one or more IOCs; and determining whether a threat is present in the network of machines based on results for evaluating one or more of the plurality of IOCs in accordance with the revised order. ### Claim 2 (depends on 1) The method of claim 1, wherein determining whether a threat is present based on results for evaluating one or more of the plurality of IOCs in accordance with the dynamically determined order further includes: evaluating the plurality of IOCs locally in accordance with the dynamically determined order; and determining whether a threat is present when at least one of the plurality of IOCs has been evaluated. ### Claim 3 (depends on 1) The method of claim 1, wherein determining whether a threat is present based on results for evaluating one or more of the plurality of IOCs in accordance with the dynamically determined order further includes: sending queries into a linear communication orbit comprising a sequence of nodes, to collect IOC evaluation results for the plurality of IOCs in accordance with the dynamically determined order; and determining whether a threat is present when evaluation results for at least one of the plurality of IOCs has been received from the nodes in the linear communication orbit. ### Claim 4 (depends on 1) The method of claim 1, further comprising: upon detection of a threat, automatically performing one or more remedial actions to address the detected threat. ### Claim 5 (depends on 1) The method of claim 1, including: receiving user input modifying the respective costs associated with one or more of the plurality of IOCs; and in response to receiving the user input, modifying the respective costs associated with the one or more of the plurality of IOCs. ### Claim 6 (depends on 1) The method of claim 1, wherein dynamically determining an order for evaluating the plurality of IOCs based on the respective costs associated with the plurality of IOCs includes: ordering the plurality of IOCs based on increasing costs. ### Claim 7 (depends on 1) The method of claim 1, including: receiving a cost quota for evaluating the plurality of IOCs; and determining which ones of the plurality of IOCs to evaluate based on the cost quota and the dynamically determined order for evaluating the plurality of IOCs. ### Claim 8 (depends on 1) The method of claim 1, including: determining a respective frequency for evaluating a respective IOC of the plurality of IOCs based on the respective cost associated with the respective IOC and cost criteria received for evaluating the plurality of IOCs. ### Claim 9 (depends on 1) The method of claim 1, wherein a first IOC of the plurality of IOCs includes a plurality of sub-components, and wherein the respective cost associated with evaluating the first IOC includes a sum of respective sub-costs associated with evaluating the plurality of sub-components of the first IOC. ### Claim 10 (depends on 1) The method of claim 1, including: maintaining an index for looking up local results for one or more indicator items, wherein a cost associated with looking up a local result for a respective indicator item from the index is lower than a cost associated with evaluating the respective indicator item in real-time at the device. ### Claim 11 (depends on 10) The method of claim 10, including: detecting that one or more of the plurality of IOCs include indicator items present in the index; wherein determining modified respective costs associated with the one or more of the plurality of IOCs further includes: in response to detecting that one or more of the plurality of IOCs include at least one indicator item present in the index, modifying the respective costs associated with the one or more of the plurality of IOCs in accordance with the cost for looking up the at least one indicator item in the index. ### Claim 12 A system of threat management in a network of machines, wherein: the system is a server or a client machine within the network of machines, and the system comprises: one or more processors; and memory storing instructions that when executed by the one or more processors cause the processors to perform operations including: receiving respective specifications of a plurality of indicators of compromise (IOCs), wherein the respective specification of each IOC of the plurality of IOCs includes a respective cost associated with evaluating the IOC; dynamically determining, without requiring user intervention after receipt of the respective specifications of the plurality of IOCs, an order for evaluating the plurality of IOCs based on the respective costs associated with evaluating the plurality of IOCs; determining whether a threat is present in the network of machines based on results for evaluating one or more of the plurality of IOCs in accordance with the dynamically determined order, instead of an order by which specifications of the plurality of IOCs have been received at the device; determining modified respective costs associated with the one or more of the plurality of IOCs; dynamically determining a revised order for evaluating the plurality of IOCs based on the respective costs associated with the plurality of IOCs, including the modified respective costs associated with the one or more IOCs; and determining whether a threat is present in the network of machines based on results for evaluating one or more of the plurality of IOCs in accordance with the revised order. ### Claim 13 (depends on 12) The system of claim 12, wherein determining whether a threat is present based on results for evaluating one or more of the plurality of IOCs in accordance with the dynamically determined order further includes: evaluating the plurality of IOCs locally in accordance with the dynamically determined order; and determining whether a threat is present when at least one of the plurality of IOCs has been evaluated. ### Claim 14 (depends on 12) The system of claim 12, wherein determining whether a threat is present based on results for evaluating one or more of the plurality of IOCs in accordance with the dynamically determined order further includes: sending queries into a linear communication orbit comprising a sequence of nodes, to collect IOC evaluation results for the plurality of IOCs in accordance with the dynamically determined order; and determining whether a threat is present when evaluation results for at least one of the plurality of IOCs has been received from the nodes in the linear communication orbit. ### Claim 15 (depends on 12) The system of claim 12, wherein the operations further include: upon detection of a threat, automatically performing one or more remedial actions to address the detected threat. ### Claim 16 (depends on 12) The system of claim 12, wherein the operations include: receiving user input modifying the respective costs associated with one or more of the plurality of IOCs; and in response to receiving the user input, modifying the respective costs associated with the one or more of the plurality of IOCs. ### Claim 17 (depends on 12) The system of claim 12, wherein dynamically determining an order for evaluating the plurality of IOCs based on the respective costs associated with the plurality of IOCs includes ordering the plurality of IOCs based on increasing costs. ### Claim 18 (depends on 12) The system of claim 12, wherein the operations include: receiving a cost quota for evaluating the plurality of IOCs; and determining which ones of the plurality of IOCs to evaluate based on the cost quota and the dynamically determined order for evaluating the plurality of IOCs. ### Claim 19 (depends on 12) The system of claim 12, wherein the operations include: determining a respective frequency for evaluating a respective IOC of the plurality of IOCs based on the respective cost associated with the respective IOC and cost criteria received for evaluating the plurality of IOCs. ### Claim 20 (depends on 12) The system of claim 12, wherein a first IOC of the plurality of IOCs includes a plurality of sub-components, and wherein the respective cost associated with evaluating the first IOC includes a sum of respective sub-costs associated with evaluating the plurality of sub-components of the first IOC. ### Claim 21 (depends on 12) The system of claim 12, wherein the operations include: maintaining an index for looking up local results for one or more indicator items, wherein a cost associated with looking up a local result for a respective indicator item from the index is lower than a cost associated with evaluating the respective indicator item in real-time at the device. ### Claim 22 (depends on 21) The system of claim 21, wherein the operations include: detecting that one or more of the plurality of IOCs include indicator items present in the index; wherein determining modified respective costs associated with the one or more of the plurality of IOCs further includes: in response to detecting that one or more of the plurality of IOCs include at least one indicator item present in the index, modifying the respective costs associated with the one or more of the plurality of IOCs in accordance with the cost for looking up the at least one indicator item in the index. ### Claim 23 A non-transitory computer-readable medium storing instructions that when executed by one or more processors cause the processors to perform operations comprising: receiving respective specifications of a plurality of indicators of compromise (IOCs), wherein the respective specification of each IOC of the plurality of IOCs includes a respective cost associated with evaluating the IOC; dynamically determining, without requiring user intervention after receipt of the respective specifications of the plurality of IOCs, an order for evaluating the plurality of IOCs based on the respective costs associated with evaluating the plurality of IOCs; determining whether a threat is present in a network of machines based on results for evaluating one or more of the plurality of IOCs in accordance with the dynamically determined order, instead of an order by which specifications of the plurality of IOCs have been received at the device; determining modified respective costs associated with the one or more of the plurality of IOCs; dynamically determining a revised order for evaluating the plurality of IOCs based on the respective costs associated with the plurality of IOCs, including the modified respective costs associated with the one or more IOCs; and determining whether a threat is present in the network of machines based on results for evaluating one or more of the plurality of IOCs in accordance with the revised order. ### Claim 24 (depends on 23) The non-transitory computer-readable medium of claim 23, wherein determining whether a threat is present based on results for evaluating one or more of the plurality of IOCs in accordance with the dynamically determined order further includes: evaluating the plurality of IOCs locally in accordance with the dynamically determined order; and determining whether a threat is present when at least one of the plurality of IOCs has been evaluated. ### Claim 25 (depends on 23) The non-transitory computer-readable medium of claim 23, wherein determining whether a threat is present based on results for evaluating one or more of the plurality of IOCs in accordance with the dynamically determined order further includes: sending queries into a linear communication orbit comprising a sequence of nodes, to collect IOC evaluation results for the plurality of IOCs in accordance with the dynamically determined order; and determining whether a threat is present when evaluation results for at least one of the plurality of IOCs has been received from the nodes in the linear communication orbit. ### Claim 26 (depends on 23) The non-transitory computer-readable medium of claim 23, wherein the operations further include: upon detection of a threat, automatically performing one or more remedial actions to address the detected threat. ### Claim 27 (depends on 23) The non-transitory computer-readable medium of claim 23, wherein the operations include: receiving user input modifying the respective costs associated with one or more of the plurality of IOCs; and in response to receiving the user input, modifying the respective costs associated with the one or more of the plurality of IOCs. ### Claim 28 (depends on 23) The non-transitory computer-readable medium of claim 23, wherein dynamically determining an order for evaluating the plurality of IOCs based on the respective costs associated with the plurality of IOCs includes ordering the plurality of IOCs based on increasing costs. ### Claim 29 (depends on 23) The non-transitory computer-readable medium of claim 23, wherein the operations include: receiving a cost quota for evaluating the plurality of IOCs; and determining which ones of the plurality of IOCs to evaluate based on the cost quota and the dynamically determined order for evaluating the plurality of IOCs. ### Claim 30 (depends on 23) The non-transitory computer-readable medium of claim 23, wherein the operations include: determining a respective frequency for evaluating a respective IOC of the plurality of IOCs based on the respective cost associated with the respective IOC and cost criteria received for evaluating the plurality of IOCs. ### Claim 31 (depends on 23) The non-transitory computer-readable medium of claim 23, wherein a first IOC of the plurality of IOCs includes a plurality of sub-components, and wherein the respective cost associated with evaluating the first IOC includes a sum of respective sub-costs associated with evaluating the plurality of sub-components of the first IOC. ### Claim 32 (depends on 23) The non-transitory computer-readable medium of claim 23, wherein the operations include: maintaining an index for looking up local results for one or more indicator items, wherein a cost associated with looking up a local result for a respective indicator item from the index is lower than a cost associated with evaluating the respective indicator item in real-time at the device. ### Claim 33 (depends on 32) The non-transitory computer-readable medium of claim 32, wherein the operations include: detecting that one or more of the plurality of IOCs include indicator items present in the index; wherein determining modified respective costs associated with the one or more of the plurality of IOCs further includes: in response to detecting that one or more of the plurality of IOCs include at least one indicator item present in the index, modifying the respective costs associated with the one or more of the plurality of IOCs in accordance with the cost for looking up the at least one indicator item in the index. ### Claim 34 A method of threat management in a network of machines, the method comprising: at a device having one or more processors and memory, wherein the device is a server or a client machine within the network of machines, and the device is separated from external networks by one or more firewalls: receiving respective specifications of a plurality of indicators of compromise (IOCs), wherein the respective specification of each IOC of the plurality of IOCs includes a respective cost associated with evaluating the IOC; dynamically determining, without requiring user intervention after receipt of the respective specifications of the plurality of IOCs, an order for evaluating the plurality of IOCs based on the respective costs associated with evaluating the plurality of IOCs; sending queries into a linear communication orbit comprising a sequence of machines within the network of machines; collecting IOC evaluation results via the linear communication orbit, from a plurality of machines in the sequence of machines, for the plurality of IOCs evaluated locally at the plurality of machines in accordance with the dynamically determined order; and determining whether a threat is present in the network of machines based on the collected IOC evaluation results, evaluated locally at the plurality of machines in accordance with the dynamically determined order, instead of an order by which specifications of the plurality of IOCs have been received at the device. ### Claim 35 A system of threat management in a network of machines, wherein: the system is a server or a client machine within the network of machines, and the system comprises: one or more processors; and memory storing instructions that when executed by the one or more processors cause the processors to perform operations including: receiving respective specifications of a plurality of indicators of compromise (IOCs), wherein the respective specification of each IOC of the plurality of IOCs includes a respective cost associated with evaluating the IOC; dynamically determining, without requiring user intervention after receipt of the respective specifications of the plurality of IOCs, an order for evaluating the plurality of IOCs based on the respective costs associated with evaluating the plurality of IOCs; sending queries into a linear communication orbit comprising a sequence of machines within the network of machines; collecting IOC evaluation results via the linear communication orbit, from a plurality of machines in the sequence of machines, for the plurality of IOCs evaluated locally at the plurality of machines in accordance with the dynamically determined order; and determining whether a threat is present in the network of machines based on the collected IOC evaluation results, evaluated locally at the plurality of machines in accordance with the dynamically determined order, instead of an order by which specifications of the plurality of IOCs have been received at the device. ### Claim 36 A non-transitory computer-readable medium storing instructions that when executed by one or more processors cause the processors to perform operations comprising: receiving respective specifications of a plurality of indicators of compromise (IOCs), wherein the respective specification of each IOC of the plurality of IOCs includes a respective cost associated with evaluating the IOC; dynamically determining, without requiring user intervention after receipt of the respective specifications of the plurality of IOCs, an order for evaluating the plurality of IOCs based on the respective costs associated with evaluating the plurality of IOCs; sending queries into a linear communication orbit comprising a sequence of machines within the network of machines; collecting IOC evaluation results via the linear communication orbit, from a plurality of machines in the sequence of machines, for the plurality of IOCs evaluated locally at the plurality of machines in accordance with the dynamically determined order; and determining whether a threat is present in the network of machines based on the collected IOC evaluation results, evaluated locally at the plurality of machines in accordance with the dynamically determined order, instead of an order by which specifications of the plurality of IOCs have been received at the device.