Back to results
US 10,476,752 B2Granted
Blue print graphs for fusing of heterogeneous alerts
AssigneeNEC Corporation
InventorsKenji Yoshihira, Zhichun Li, Zhengzhang Chen, Haifeng Chen, Guofei Jiang, LuAn Tang
Life of this patent
Estimating the term…
Abstract
Methods and systems for reporting anomalous events include building a process graph that models states of process-level events in a network. A topology graph is built that models source and destination relationships between connection events in the network. A set of alerts is clustered based on the process graph and the topology graph. Clustered alerts that exceed a threshold level of trustworthiness are reported.
Claims18
A method for reporting anomalous events, comprising:
- building a process graph that models states of process-level events in a network using a processor, wherein the nodes in the process graph including process nodes, file nodes, and socket nodes;
- building a topology graph that models source host and destination host relationships between connection events in the network using the processor;
- clustering a set of alerts based on the process graph and the topology graph;
- and
- reporting clustered alerts that exceed a threshold level of trustworthiness to reduce a false alert rate:
- and
- performing a security management action responsive to the reported clustered alerts.
4 more elements
A system for reporting anomalous events, comprising:
- a blue print update module comprising a processor configured to build a process graph that models states of process-level events in a network and to build a topology graph that models source host and destination host relationships between connection events in the network, wherein the nodes in the process graph including process nodes, file nodes, and socket nodes;
- a clustering module configured to cluster a set of alerts based on the process graph and the topology graph;
- and
- a user interface configured to report clustered alerts that exceed a threshold level of trustworthiness to reduce a false alert rate;
- and
- a system recovery module configured to perform a security management action responsive to the reported clustered alerts.
3 more elements
Dependencies are inferred from the claim text.