# US 11,308,211 B2 · Security incident disposition predictions based on cognitive evaluation of security knowledge graphs > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,308,211 B2 - Document ID: US11308211B2 - Status: Granted - Kind: B2 - Application number: 16/444,370 - Filed: 2019-06-18 - Published: 2020-12-24 - Granted: 2022-04-19 - Earliest claimed: 2019-06-18 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Burkhard Ringlein; Preeti Ravindra; Bradley E. Harris; Moazzam Khan; James B. Peterson - Web page: https://patentgrep.com/patent/US11308211B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06N 5/022: Knowledge engineering; Knowledge acquisition - G06F 21/552: {involving long-term monitoring or reporting} - G06N 3/045: Combinations of networks - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/08: Learning methods - G06N 3/09: Supervised learning - G06N 20/00: Machine learning - G06F 2221/034: Test or assess a computer or a system - G06N 3/044: Recurrent networks, e.g. Hopfield networks - G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound - G06N 20/20: Ensemble learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Mechanisms are provided to perform security incident disposition operations. A security incident is received that includes a security incident data structure comprising metadata describing properties of the security incident, and a corresponding security knowledge graph which includes nodes representing elements associated with the security incident and edges representing relationships between the nodes. The security incident data structure and security knowledge graph are processed to extract a set of security incident features corresponding to the security incident and input the extracted set of security incident features into a trained security incident machine learning model. The model generates a disposition classification output based on results of processing the extracted set of security incident features. The disposition classification output is output to the source of the security incident data structure. ## Claims ### Claim 1 A method, in a data processing system comprising at least one processor and at least one memory, the at least one memory comprising instructions executed by the at least one processor to cause the at least one processor to implement a security incident disposition system, wherein the security incident disposition system operates to: receive, from a source computing device of a monitored computing environment, a security incident comprising a security incident data structure comprising metadata describing properties of the security incident, and a corresponding security knowledge graph, wherein the security knowledge graph comprises nodes representing elements associated with the security incident, and edges representing relationships between the nodes; process the security incident data structure and security knowledge graph to extract, from the metadata of the security incident data structure and data corresponding to the nodes and edges of the security knowledge graph, a set of security incident features corresponding to the security incident; input the extracted set of security incident features into a trained security incident machine learning model of the security incident disposition system; generate, by the trained security incident machine learning model of the security incident disposition system, a disposition classification output based on results of processing the extracted set of security incident features by the trained security incident machine learning model; and output the disposition classification output to the source computing device. ### Claim 2 (depends on 1) The method of claim 1, wherein the security incident disposition system further operates to: process the security knowledge graph to extract topology features representing an overall topology of the security knowledge graph; and input the extracted topology features into the trained security incident machine learning model, wherein the trained security incident machine learning model generates the disposition classification based on results of processing the extracted set of security incident features and the extracted topology features. ### Claim 3 (depends on 1) The method of claim 1, wherein processing the security incident data structure and securing knowledge graph to extract security incident features further comprises: calculating one or more metrics based on the extracted set of security incident features; and adding the one or more metrics as additional security incident features to the set of security incident features prior to inputting the extracted set of security incident features into the trained security incident machine learning model. ### Claim 4 (depends on 1) The method of claim 1, wherein the disposition classification is a prediction of a responsive action to perform in response to the security incident. ### Claim 5 (depends on 4) The method of claim 4, wherein the disposition classification is one of a predetermined set of potential disposition classifications, each disposition classification corresponding to a different responsive action in a set of responsive actions, and wherein the set of responsive actions comprises at least one of a block responsive action that blocks access by a source of the security incident to computing resources or a redirect responsive action that redirects access by a source of the security incident to alternative computing resources. ### Claim 6 (depends on 4) The method of claim 4, wherein the disposition classification is one of an escalate disposition classification that causes a notification of a potential threat associated with the security incident to a system administrator, or a do not escalate disposition classification which does not result in the notification. ### Claim 7 (depends on 1) The method of claim 1, wherein the trained security incident machine learning model is a neural network trained on a set of training data comprising security incidents, corresponding security knowledge graphs for the security incidents in the set of training data, and corresponding correct disposition classifications for the security incidents, and wherein the trained security incident machine learning model is trained based on training features extracted from the training data and corresponding security knowledge graphs of the set of training data using a machine learning process. ### Claim 8 (depends on 1) The method of claim 1, wherein outputting the disposition classification output to the source computing device further comprises outputting a graphical user interface comprising a graphical representation of the security knowledge graph corresponding to the security incident with graphical features designating different types of elements of the security knowledge graph, and the disposition classification as a recommended disposition for the security incident. ### Claim 9 (depends on 8) The method of claim 8, wherein outputting the graphical user interface further comprises outputting a feedback user interface for receiving user input specifying a correctness or incorrectness of the recommended disposition, and wherein the feedback user interface further comprises one or more use interface elements for specifying a correct disposition for the security incident. ### Claim 10 (depends on 9) The method of claim 9, wherein the security incident disposition system further operates to: receive user input, via the feedback user interface, specifying the recommended disposition to be incorrect and providing a correct disposition for the security incident; generate a dynamic training data set based on the received user input; and retrain the trained security incident disposition system based on the dynamic training data set. ### Claim 11 A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a computing device, causes the computing device to implement a security incident disposition system which operates to: receive, from a source computing device of a monitored computing environment, a security incident comprising a security incident data structure comprising metadata describing properties of the security incident, and a corresponding security knowledge graph, wherein the security knowledge graph comprises nodes representing elements associated with the security incident, and edges representing relationships between the nodes; process the security incident data structure and security knowledge graph to extract, from the metadata of the security incident data structure and data corresponding to the nodes and edges of the security knowledge graph, a set of security incident features corresponding to the security incident; input the extracted set of security incident features into a trained security incident machine learning model of the security incident disposition system; generate, by the trained security incident machine learning model of the security incident disposition system, a disposition classification output based on results of processing the extracted set of security incident features by the trained security incident machine learning model; and output the disposition classification output to the source computing device. ### Claim 12 (depends on 11) The computer program product of claim 11, wherein the security incident disposition system further operates to: process the security knowledge graph to extract topology features representing an overall topology of the security knowledge graph; and input the extracted topology features into the trained security incident machine learning model, wherein the trained security incident machine learning model generates the disposition classification based on results of processing the extracted set of security incident features and the extracted topology features. ### Claim 13 (depends on 11) The computer program product of claim 11, wherein processing the security incident data structure and securing knowledge graph to extract security incident features further comprises: calculating one or more metrics based on the extracted set of security incident features; and adding the one or more metrics as additional security incident features to the set of security incident features prior to inputting the extracted set of security incident features into the trained security incident machine learning model. ### Claim 14 (depends on 11) The computer program product of claim 11, wherein the disposition classification is a prediction of a responsive action to perform in response to the security incident. ### Claim 15 (depends on 14) The computer program product of claim 14, wherein the disposition classification is one of a predetermined set of potential disposition classifications, each disposition classification corresponding to a different responsive action in a set of responsive actions, and wherein the set of responsive actions comprises at least one of a block responsive action that blocks access by a source of the security incident to computing resources or a redirect responsive action that redirects access by a source of the security incident to alternative computing resources. ### Claim 16 (depends on 14) The computer program product of claim 14, wherein the disposition classification is one of an escalate disposition classification that causes a notification of a potential threat associated with the security incident to a system administrator, or a do not escalate disposition classification which does not result in the notification. ### Claim 17 (depends on 11) The computer program product of claim 11, wherein the trained security incident machine learning model is a neural network trained on a set of training data comprising security incidents, corresponding security knowledge graphs for the security incidents in the set of training data, and corresponding correct disposition classifications for the security incidents, and wherein the trained security incident machine learning model is trained based on training features extracted from the training data and corresponding security knowledge graphs of the set of training data using a machine learning process. ### Claim 18 (depends on 11) The computer program product of claim 11, wherein outputting the disposition classification output to the source computing device further comprises outputting a graphical user interface comprising a graphical representation of the security knowledge graph corresponding to the security incident with graphical features designating different types of elements of the security knowledge graph, and the disposition classification as a recommended disposition for the security incident. ### Claim 19 (depends on 18) The computer program product of claim 18, wherein outputting the graphical user interface further comprises outputting a feedback user interface for receiving user input specifying a correctness or incorrectness of the recommended disposition, and wherein the feedback user interface further comprises one or more use interface elements for specifying a correct disposition for the security incident. ### Claim 20 An apparatus comprising: a processor; and a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to implement a security incident disposition system which operates to: receive, from a source computing device of a monitored computing environment, a security incident comprising a security incident data structure comprising metadata describing properties of the security incident, and a corresponding security knowledge graph, wherein the security knowledge graph comprises nodes representing elements associated with the security incident, and edges representing relationships between the nodes; process the security incident data structure and security knowledge graph to extract, from the metadata of the security incident data structure and data corresponding to the nodes and edges of the security knowledge graph, a set of security incident features corresponding to the security incident; input the extracted set of security incident features into a trained security incident machine learning model of the security incident disposition system; generate, by the trained security incident machine learning model of the security incident disposition system, a disposition classification output based on results of processing the extracted set of security incident features by the trained security incident machine learning model; and output the disposition classification output to the source computing device.