Back to results
US 10,706,144 B1Granted
Cyber defense with graph theoretical approach
AssigneeBlueRISC, Inc.
InventorsCsaba Andras Moritz, Kristopher Carver, Santosh Khasanvis, Jeffry Gummeson
Life of this patent
Estimating the term…
Abstract
An example process that is performed by one or more processing devices uses one or more system states to detect cyber-attacks. The example process includes the following operations: generating a first graph that models states based on information obtained from an electronic device; and performing a correlation of the first graph with one or more second graphs to detect a possibility of a cyber-attack against the electronic device.
Claims40
A method performed by one or more processing devices, comprising:
- generating a first graph that models states based on information obtained from an electronic device, the first graph comprising nodes containing the information and edges between the nodes that comprise the states;
- performing a correlation of the first graph with at least two second graphs to detect a possibility of a cyber-attack against the electronic device, wherein the correlation determines whether a first node of the first graph overlaps a second node in at least one of the at least two second graphs, the first graph being separate from the at least two second graphs, where the first node overlaps the second node if the first node and the second node have the same weight;
- wherein the at least two second graphs comprise an attack graph containing information about malicious cyber activity;
- notifying the electronic device in the event that the possibility of the cyber-attack is detected based on the correlation;
- and
- wherein the at least two second graphs comprise a device graph that models states based on information obtained from the electronic device at a different time than the first graph.
3 more elements
One or more non-transitory machine-readable storage media storing instructions that are executable by one or more processing devices to perform operations comprising:
- generating a first graph that models states based on information obtained from an electronic device, the first graph comprising nodes containing the information and edges between the nodes that comprise the states;
- performing a correlation of the first graph with at least two second graphs to detect a possibility of a cyber-attack against the electronic device, wherein the correlation determines whether a first node of the first graph overlaps a second node in at least one of the at least two second graphs, the first graph being separate from the at least two second graphs, where the first node overlaps the second node if the first node and the second node have the same weight;
- wherein the at least two second graphs comprise an attack graph containing information about malicious cyber activity;
- notifying the electronic device in the event that the possibility of the cyber-attack is detected based on the correlation;
- and
- wherein the at least two second graphs comprise a device graph that models states based on information obtained from the electronic device at a different time than the first graph.
3 more elements
A system comprising:
- one or more processing devices;
- and
- one or more non-transitory machine-readable storage media storing instructions that are executable by the one or more processing devices to perform operations comprising:
- generating a first graph that models states based on information obtained from an electronic device, the first graph comprising nodes containing the information and edges between the nodes that comprise the states;
- performing a correlation of the first graph with at least two second graphs to detect a possibility of a cyber-attack against the electronic device, wherein the correlation determines whether a first node of the first graph overlaps a second node in at least one of the at least two second graphs, the first graph being separate from the at least two second graphs, where the first node overlaps the second node if the first node and the second node have the same weight;
- wherein the at least two second graphs comprise an attack graph containing information about malicious cyber activity;
- notifying the electronic device in the event that the possibility of the cyber-attack is detected based on the correlation;
- and
- wherein the at least two second graphs comprise a device graph that models states based on information obtained from the electronic device at a different time than the first graph.
6 more elements
Dependencies are inferred from the claim text.