System and methods for automated detection, reasoning and recommendations for resilient cyber systems
AssigneeBattelle Memorial Institute
InventorsSutanay Choudhury, Khushbu Agarwal, Pin-Yu Chen, Indrajit Ray
Life of this patent
Estimating the term…
Abstract
A method for securing an IT (information technology) system using a set of methods for knowledge extraction, event detection, risk estimation and explanation for ranking cyber-alerts which includes a method to explain the relationship (or an attack pathway) from an entity (user or host) and an event context to another entity (a high-value resource) and an event context (attack or service failure).
Claims20
A computer-implemented method of protecting a cyber system, the method comprising:
- modeling the cyber system as a heterogenous network of nodes using a tripartite user-host-application graph comprising a user-host sub-graph and a host-application sub-graph;
- transforming the tripartite user-host-application graph into a tabular representation that preserves topological properties of the nodes, wherein each of the nodes from the tripartite user-host-application graph comprise a point in multidimensional vector space within the tabular representation;
- analyzing user traffic within the cyber system based on the tabular representation to identify one or more anomalies within the cyber system;
- and
- generating at least one modification to the cyber system to restrict activity within the cyber system based on the identified anomalies and the modeling.
A system comprising a series of circuitry that implements a cyber security feature, the cyber security feature configured to:
- model an associated cyber system as a heterogenous network of nodes using a tripartite user-host-application graph comprising a user-host sub-graph and a host-application sub-graph;
- transform the tripartite user-host-application graph into a tabular representation that preserves topological properties of the nodes, wherein each of the nodes from the tripartite user-host-application graph comprise a point in multidimensional vector space within the tabular representation;
- analyze user traffic within the cyber system based on the tabular representation to identify one or more anomalies within the cyber system;
- and
- generate at least one modification to the cyber system to restrict activity within the cyber system based on the identified anomalies and the modeling;
- and
- output the at least one modification.
One or more non-transitory computer readable storage media that, when executed by one or more processors, causes the one or more processors to:
- model an associated cyber system as a heterogenous network of nodes using a tripartite user-host-application graph comprising a user-host sub-graph and a host-application sub-graph;
- transform the tripartite user-host-application graph into a tabular representation that preserves topological properties of the nodes, wherein each of the nodes from the tripartite user-host-application graph comprise a point in multidimensional vector space within the tabular representation;
- analyze user traffic within the cyber system based on the tabular representation to identify one or more anomalies within the cyber system;
- and
- generate at least one modification to the cyber system to restrict activity within the cyber system based on the identified anomalies and the modeling;
- and
- output the at least one modification.
Dependencies are inferred from the claim text.