Back to results
US 11,165,807 B2Granted
System and method for assigning threat valuations to network events and security events
AssigneeFluency Corp.
InventorsChristopher Jordan, Kun Luo
Life of this patent
Estimating the term…
Abstract
A method including receiving a record in a first timeframe; establishing a plurality of threat vectors for the record; merging the plurality of threat vectors to the record; generating a risk valuation for the record based on the plurality of threat vectors; merging the risk valuation to the record to form a risk event; and storing the risk event in a computer-readable data store.
Claims20
A method comprising:
- receiving a plurality of records in a first timeframe;
- parsing each record of the plurality of records;
- sending each record of the plurality of records to one or more threat vector calculators;
- establishing a plurality of threat vectors for each record of the plurality of records, wherein the one or more threat vector calculators establish the plurality of threat vectors;
- merging the plurality of threat vectors to each record of the plurality of records;
- grouping each record of the plurality of records sharing a destination address into a plurality of subsets;
- generating a risk valuation for each subset of the plurality of subsets based on the plurality of threat vectors;
- merging the risk valuation to each subset of the plurality of subsets to form a plurality of risk events;
- grouping each subset of the plurality of subsets sharing a source address into a plurality of sets, wherein a risk factor is assigned to each set of the plurality of sets;
- and
- storing the plurality of sets in a computer-readable data store.
8 more elements
A device comprising:
- a system that receives or retrieves a plurality of events in a sliding window from a plurality of network security systems;
- a processor that forms a plurality of sets by:
- merging each event sharing an IP-couple-pair into a record to form a plurality of records;
- distributing each record of the plurality of records to a plurality of threat valuation systems;
- merging a plurality of threat factors to each record of the plurality of records;
- grouping each record of the plurality of records sharing a destination address into a plurality of subsets;
- merging a risk score to each subset of the plurality of subsets based on the threat factors present in the respective subset of the plurality of subsets to form a plurality of security events;
- and
- grouping each subset of the plurality of subsets sharing a source address into a plurality of sets, wherein a risk factor is assigned to each set of the plurality of sets;
- and
- a computer readable data store that stores the plurality of sets.
8 more elements
A method comprising:
- receiving a plurality of records;
- establishing a threat vector for each record of the plurality of records;
- merging the threat vector to each record of the plurality of records;
- grouping each record of the plurality of records sharing a destination address into a plurality of subsets;
- generating a risk valuation for each subset of the plurality of subsets based on the threat vectors;
- merging the risk valuation to each subset of the plurality of subsets to form a plurality of risk events;
- grouping each subset of the plurality of subsets sharing a source address into a plurality of sets, wherein a risk factor is assigned to each set of the plurality of sets;
- providing a notification if the risk factor is above a threshold value.
5 more elements
Dependencies are inferred from the claim text.