US 10,708,290 B2Granted

System and method for prediction of future threat actions

AssigneeSecureworks Corp.

InventorsDoug M. Steelman, Todd Wiedman, Kenneth A. Deitz, Berlene Herren, Edgar L. Deal, Thomas Clements, Brian Miller

Life of this patent

Estimating the term…

Loading patent…

Abstract

An information handling system performs a method for analyzing attacks against a networked system of information handling systems. The method includes detecting a threat indicator, representing the threat indicator in part by numerical parameters, normalizing the numerical parameters, calculating one or more measures of association between the threat indicator and other threat indicators, finding an association of the threat indicator with another threat indicator based upon the normalized numerical parameters, and assigning to the threat indicator a probability that a threat actor group caused the attack, wherein the threat actor group was assigned to the other threat indicator.

Claims18

Dependent claims

A computer implemented method, the computer having a processor and memory, the method comprising:

detecting by the computer a threat indicator that provides an indication of an attack against a networked system of information handling systems;
representing the threat indicator in part by numerical parameters;
normalizing the numerical parameters;
adding attributes to the threat indicator, thereby producing an event that represents an element of an attack against the networked system of information handling systems;
adding attributes to other threat indicators, thereby producing other events;
calculating one or more measures of association between the event and the other events based upon the normalized numerical parameters, wherein the one or more measures of association between the event and other events include one or more of the following:
a Kendall's tau between the event and the other events;
and
a conditional entropy between the event and the other events;
finding an association of the event with another event based upon the one or more measures of association;
determining possible future attacks on the networked system of information handling systems based upon the association;
for each possible future attack of the possible future attacks, determining a probability of the possible future attack based upon the one or more measures of association between the event and the other event;
assessing a risk to the networked system based upon the probabilities of possible future attacks;
and
determining a defense posture for the networked system based upon the risk.

12 more elements

A networked system of information handling systems, comprising:

an intrusion protection and detection system to:
detect a threat indicator that provides an indication of an attack against the networked system;
represent the threat indicator in part by numerical parameters;
normalize the numerical parameters;
add attributes to the threat indicator, thereby producing an event that represents an element of an attack against the networked system of information handling systems;
add attributes to other threat indicators, thereby producing other events;
calculate one or more measures of association between the event and the other events;
find an association of the event with another event based upon the one or more measures of association, wherein the one or more measures of association between the event and other events include one or more of the following:
a Kendall's tau between the event and the other events;
a covariance between the event and the other events;
and
a conditional entropy between the event and the other events;
determine possible future attacks on the networked system of information handling systems based upon the association;
for each possible future attack of the possible future attacks, determining a probability of the possible future attack based upon the one or more measures of association between the event and the other event;
assess a risk to the networked system based upon the probabilities of possible future attacks;
and
determine a defense posture for the networked system based upon the risk.

14 more elements

A non-transitory computer-readable medium including code for performing a method of analyzing attacks on a networked system of information handling systems, the method comprising:

detecting a threat indicator that provides an indication of an attack against the networked system of information handling systems;
representing the threat indicator in part by numerical parameters;
normalizing the numerical parameters;
adding attributes to the threat indicator, thereby producing an event that represents an element of an attack against the networked system of information handling systems;
adding attributes to other threat indicators, thereby producing other events;
calculating one or more measures of association between the event and the other events based upon the normalized numerical parameters, wherein the one or more measures of association between the event and other events include one or more of the following:
a Kendall's tau between the event and the other events;
and
a conditional entropy between the event and the other events;
finding an association of the event with another event based upon the one or more measures of association;
determining possible future attacks on the networked system of information handling systems based upon the association;
for each possible future attack of the possible future attacks, determining a probability of the possible future attack based upon the one or more measures of association between the event and the other event;
assessing a risk to the networked system based upon the probabilities of possible future attacks;
and
determining a defense posture for the networked system based upon the risk.

12 more elements

Dependencies are inferred from the claim text.