US 10,944,772 B2Granted

Connected security system

AssigneeAccenture Global Solutions Limited

InventorsShaan Mulchandani, Amin Hassanzadeh, Elvis Hovor, Shimon Modi, Walid Negm

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems, methods, and apparatus, including computer programs encoded on computer storage media, for obtaining, processing, and presenting data related to security events, and for implementing courses of action to protect assets in response to the security events. An event management module identifies malicious activity present on a first network domain and/or a second network domain based on received network domain activity. A threat intelligence module receives data identifying the malicious activity in first data constructs of a predefined data structure. The threat intelligence module obtains additional data related to the identified malicious activity and generates second data constructs that include enriched data regarding the malicious activity. The enriched data includes data describing a campaign in which at least a portion of the malicious activity is involved and one or more courses of action. A course of action module receives the second data constructs and implements a given course of action.

Claims21

Dependent claims

A computer-implemented method comprising:

receiving, for an organization that is associated with a particular industry, first, information technology (IT) domain activity data from a first, IT network domain and second, operational technology (OT) domain activity data from a second, OT network domain, the first IT domain activity data and the second OT domain activity data including events, alerts, or both from the respective first and second network domains;
determining, based on the first IT domain activity data and the second OT domain activity data, one or more anomalous correlated event paths through which security events have progressed through at least one of the first IT network domain or the second OT network domain, each anomalous correlated event path including one or more assets of the organization;
generating one or more first data constructs that has a particular data structure and that include (i) the first IT domain activity data, (ii) the second OT domain activity data, and (iii) data describing the one or more anomalous correlated event paths;
receiving, from an external threat feed to which the organization subscribes to receive threat data that is specific to the particular industry, the external threat data including events, alerts, or both for one or more other organizations that are different from the organization and that are also associated with the particular industry;
generating a second data construct that also has the particular data structure and that includes data from the one or more first data constructs and at least a portion of the external threat data that was received through the feed;
determining, based on the one or more anomalous correlated event paths and the external threat data, a risk associated with each of one or more outcomes for the organization;
generating a visualization of the one or more anomalous correlated event paths and each risk;
generating a third data construct that also has the particular data structure and that specifies a course of action determined based on at least one of one or more anomalous correlated event paths and each risk;
and
providing the third data construct to a course of action module that implements the course of action.

7 more elements

A system, comprising:

one or more processors;
and
a computer-readable storage device coupled to the one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving, for an organization that is associated with a particular industry, first, information technology (IT) domain activity data from a first, IT network domain and second, operational technology (OT) domain activity data from a second, OT network domain, the first IT domain activity data and the second OT domain activity data including events, alerts, or both from the respective first and second network domains;
determining, based on the first IT domain activity data and the second OT domain activity data, one or more anomalous correlated event paths through which security events have progressed through at least one of the first IT network domain or the second OT network domain, each anomalous correlated event path including one or more assets of the organization;
generating one or more first data constructs that has a particular data structure and that include (i) the first IT domain activity data, (ii) the second OT domain activity data, and (iii) data describing the one or more anomalous correlated event paths;
receiving, from an external threat feed to which the organization subscribes to receive threat data that is specific to the particular industry, the external threat data including events, alerts, or both for one or more other organizations that are different from the organization and that are also associated with the particular industry;
generating a second data construct that also has the particular data structure and that includes data from the one or more first data constructs and at least a portion of the external threat data that was received through the feed;
determining, based on the one or more anomalous correlated event paths and the external threat data, a risk associated with each of one or more outcomes for the organization;
generating a visualization of the one or more anomalous correlated event paths and each risk;
generating a third data construct that also has the particular data structure and that specifies a course of action determined based on at least one of one or more anomalous correlated event paths and each risk;
and
providing the third data construct to a course of action module that implements the course of action.

10 more elements

A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving, for an organization that is associated with a particular industry, first, information technology (IT) domain activity data from a first, IT network domain and second, operational technology (OT) domain activity data from a second, OT network domain, the first IT domain activity data and the second OT domain activity data including events, alerts, or both from the respective first and second network domains;
determining, based on the first IT domain activity data and the second OT domain activity data, one or more anomalous correlated event paths through which security events have progressed through at least one of the first IT network domain or the second OT network domain, each anomalous correlated event path including one or more assets of the organization;
generating one or more first data constructs that has a particular data structure and that include (i) the first IT domain activity data, (ii) the second OT domain activity data, and (iii) data describing the one or more anomalous correlated event paths;
receiving, from an external threat feed to which the organization subscribes to receive threat data that is specific to the particular industry, the external threat data including events, alerts, or both for one or more other organizations that are different from the organization and that are also associated with the particular industry;
generating a second data construct that also has the particular data structure and that includes data from the one or more first data constructs and at least a portion of the external threat data that was received through the feed;
determining, based on the one or more anomalous correlated event paths and the external threat data, a risk associated with each of one or more outcomes for the organization;
generating a visualization of the one or more anomalous correlated event paths and each risk;
generating a third data construct that also has the particular data structure and that specifies a course of action determined based on at least one of one or more anomalous correlated event paths and each risk;
and
providing the third data construct to a course of action module that implements the course of action.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/191,844Filed 15 Nov 2018 · division
Priority: 9 Dec 2015
Published: US 2019/0089727 A121 Mar 2019
Granted: 9 Mar 2021
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action
H04L 63/1433
For detecting or protecting against malicious traffic: vulnerability analysis
H04L 63/1441
For detecting or protecting against malicious traffic: countermeasures against malicious traffic

Family

Application62/265,186Us provisional application · filed 9 Dec 2015
Application15/051,528Parent of this division · filed 23 Feb 2016
US 2019/0089727 A1Pre-grant publication · published 21 Mar 2019
US 10,148,679 B2Parent of this division
US 2017/0171235 A1Published application
US 10,944,772 B2This patent

From the US filing history. Foreign family members aren’t listed.