# US 10,873,603 B2 · Cyber security sharing and identification system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,873,603 B2 - Document ID: US10873603B2 - Status: Granted - Kind: B2 - Application number: 15/923,949 - Filed: 2018-03-16 - Published: 2018-11-22 - Granted: 2020-12-22 - Earliest claimed: 2014-02-20 - Assignees: Palantir Technologies Inc. - Applicants: Palantir Technologies Inc. - Inventors: Jacob Albertson; Melody Hildebrandt; Harkirat Singh; Shyam Sankar; Rick Ducott; Peter Maag; Marissa Kimball - Web page: https://patentgrep.com/patent/US10873603B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - G06F 21/55: Detecting local intrusion or implementing counter-measures - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and techniques for sharing security data are described herein. Security rules and/or attack data may be automatically shared, investigated, enabled, and/or used by entities. A security rule may be enabled on different entities comprising different computing systems to combat similar security threats and/or attacks. Security rules and/or attack data may be modified to redact sensitive information and/or configured through access controls for sharing. ## Claims ### Claim 1 A computer implemented method comprising: by a computer system comprising one or more computer hardware processors and one or more storage devices, communicating with a plurality of entities; receiving security attack data from a first entity of the plurality of entities, the security attack data comprising information regarding one or more first security attacks; identifying, based on sharing rules associated with the first entity, one or more recipient entity of a subset of the plurality of entities that are authorized to access a ruleset from the first entity; and facilitating sharing of the ruleset from the first entity to the one or more recipient entity, wherein the ruleset (i) is determined by the first entity, and (ii) is associated with the security attack data, wherein the ruleset comprises instructions selectably applicable by the one or more recipient entity to detect a potential security attack, wherein the instructions are configured to: in response to detecting the potential security attack, add data associated with the potential security attack to a cluster as a seed, wherein the cluster comprises a plurality of connected objects and a representation of the cluster is displayable in a user interface. ### Claim 2 (depends on 1) The computer implemented method of claim 1, wherein the sharing rules associated with the first entity further exclude sharing ruleset data from the first entity to particular one or more entities. ### Claim 3 (depends on 1) The computer implemented method of claim 1, wherein the ruleset further comprises second instructions configured to: access one or more data objects associated with the one or more recipient entity, the one or more data objects comprising a plurality of network communications. ### Claim 4 (depends on 3) The computer implemented method of claim 3, wherein the one or more data objects further comprise a first user login object and a second user login object, the first user login object comprising data indicating a first login for a particular user at a first time and a first location, the second user login object comprising data indicating a second login for the particular user at a second time and a second location, and wherein the ruleset further comprises third instructions configured to: calculate, from first user login object and the second user login object, a duration of time between the first time for the first login and the second time for the second login; calculate, from first user login object and the second user login object, a distance between the first location for the first login and the second location for the second login; calculate a speed from the duration of time and the distance; and determine the potential security attack where the speed is greater than a threshold value. ### Claim 5 (depends on 4) The computer implemented method of claim 4, wherein the ruleset further comprises fourth instructions configured to: in response to determining the potential security attack, generate an alert. ### Claim 6 Non-transitory computer storage medium comprising instructions for causing one or more computing devices to perform operations comprising: communicating with a plurality of entities; receiving security attack data from a first entity of the plurality of entities, the security attack data comprising information regarding one or more first security attacks; identifying, based on sharing rules associated with the first entity, one or more recipient entity of a subset of the plurality of entities that are authorized to access a ruleset from the first entity; and transmitting at least a portion of a ruleset from the first entity to the one or more recipient entity, wherein the ruleset (i) is determined by the first entity, and (ii) is associated with the security attack data, wherein the ruleset comprises instructions selectably applicable by the one or more recipient entity to detect a potential security attack, wherein the instructions are configured to: in response to detecting the potential security attack, add data associated with the potential security attack to a cluster as a seed, wherein the cluster comprises a plurality of connected objects and a representation of the cluster is displayable in a user interface. ### Claim 7 (depends on 6) The non-transitory computer storage medium of claim 6, wherein the sharing rules associated with the first entity further exclude sharing ruleset data from the first entity to particular one or more entities. ### Claim 8 (depends on 6) The non-transitory computer storage medium of claim 6, wherein the ruleset further comprises second instructions configured to: access one or more data objects associated with the one or more recipient entity, the one or more data objects comprising a plurality of network communications. ### Claim 9 (depends on 6) The non-transitory computer storage medium of claim 6, wherein the ruleset further comprises second instructions configured to: receive a user agent identifier for a first login; perform, at the one or more recipient entity, a search for the user agent identifier, wherein performing the search further comprises: determining that the user agent identifier is a new user agent identifier; and in response to determining that the user agent identifier is a new user agent identifier, generate an alert. ### Claim 10 A system for sharing security information, the system comprising: one or more computer processors executing code instructions, to: communicate with a plurality of entities; receive security attack data from a first entity of the plurality of entities, the security attack data comprising information regarding one or more first security attacks; identify, based on sharing rules associated with the first entity, one or more recipient entity of a subset of the plurality of entities that are authorized to access ruleset data from the first entity; and facilitate sharing of at least a portion of a ruleset from the first entity to the one or more recipient entity, wherein the ruleset (i) is determined by the first entity, and (ii) is associated with the security attack data, wherein the ruleset comprises instructions selectably applicable by the one or more recipient entity to detect a potential security attack, wherein the instructions are configured to: in response to detecting the potential security attack, add data associated with the potential security attack to a cluster as a seed, wherein the cluster comprises a plurality of connected objects and a representation of the cluster is displayable in a user interface. ### Claim 11 (depends on 10) The system of claim 10, wherein the ruleset further comprises second instructions configured to: access one or more data objects associated with the one or more recipient entity, the one or more data objects comprising a plurality of network communications. ### Claim 12 (depends on 10) The system of claim 10, wherein the ruleset further comprises second instructions configured to: identify a first login for a particular user at a first time and a first location; identify a second login for the particular user at a second time and a second location; calculate a duration of time between the first time for the first login and the second time for the second login; calculate a distance between the first location for the first login and the second location for the second login; calculate a speed from the duration of time and the distance; and determine the potential security attack where the speed is greater than a threshold value. ### Claim 13 (depends on 12) The system of claim 12, wherein the ruleset further comprises third instructions configured to: in response to determining the potential security attack, generate an alert. ### Claim 14 (depends on 10) The system of claim 10, wherein the one or more computer processors execute further code instructions, to: facilitate sharing of at least a portion of a second ruleset from the first entity, the second ruleset comprising second instructions different from the instructions of the ruleset. ### Claim 15 (depends on 14) The system of claim 14, wherein the second instructions are configured to: receive a user agent identifier for a first login; perform, at the one or more recipient entity, a search for the user agent identifier, wherein performing the search further comprises: determining that the user agent identifier is a new user agent identifier. ### Claim 16 (depends on 10) The system of claim 10, where the seed comprises at least one of: (i) an IP address or (ii) a user login identifier for the particular user.