Artificial intelligence researcher assistant for cybersecurity analysis

An apparatus for a cyber threat defense system, comprising:

• a collation module configured to collect input data describing network activity executed by a network entity, where the network entity includes at least one of a user and a network device using a network;
• a comparison module configured to compare the input data from the collation module to at least one machine-learning model trained on a normal benign behavior of that network entity using a normal behavior benchmark describing parameters corresponding to a normal pattern of activity for that network entity to spot behavior on the network deviating from the normal benign behavior to identify whether the network entity is in a breach state of the normal behavior benchmark;
• a cyber threat module configured to identify whether the breach state identified by the comparison module and a chain of relevant behavioral parameters deviating from the normal benign behavior of that network entity correspond to a cyber threat;
• a host module configured to identify a host identifier identifying an external host accessed by the network entity in the input data from the collation module and to determine at least one host metric based on the breach state and the chain of relevant parameters deviating from the normal benign behavior;
• a researcher module configured to collect host research data describing the external host identified by the host module using the at least one host metric from the host module;
• a scoring module configured to analyze the host research data from the researcher module using the at least one host metric from the host module and generate an automatic threat score describing an autonomously-determined threat level presented by the external host based on at least the host research data;
• and
• a user interface module configured to present a threat-tracking graphical user interface to a user analyst that displays the automatic threat score generated by the scoring module,
• where the researcher module is further configured to cooperate with one or more machine learning models to analyze i) data being displayed and called up on the threat-tracking graphical user interface, and ii) queries being made by the user analyst on the threat-tracking graphical user interface, in order to analyze what is happening in the network being protected by the cyber threat defense system and what the user analyst is looking at in order to then anticipatorily go out to internal and external sources to anticipate and assist in finding potentially relevant data to assist in a current investigation, that the machine learning models infer is occurring.

A cyber threat investigative tool, comprising

• a collation module configured to collect, from i) passive ingestion of network traffic, ii) one or more probes, and iii) a cyber defense appliance located on a network and iv) any combination of these three, input data describing network activity executed by one or more network entities;
• a researcher module configured to cooperate with one or more machine learning models to analyze i) data being displayed and called up on a graphical user interface, and ii) queries being made by a user analyst on the graphical user interface, in order to analyze what is happening in the network being protected by the cyber defense appliance and what the user analyst is looking at in order to then anticipatorily go out to internal and external sources to anticipate and assist in finding potentially relevant data to assist in a current investigation, that the machine learning models infer is occurring;
• and
• a user interface module configured to present the graphical user interface to the user analyst that also displays the potentially relevant data to assist in a current investigation from the researcher module.