US 11,693,959 B2 · Systems and methods for intelligent cybersecurity alert similarity detection and cybersecurity alert handling

Abstract

A system and method for generating event-specific handling instructions for accelerating a threat mitigation of a cybersecurity event includes identifying a cybersecurity event; generating a cybersecurity event digest based on the cybersecurity event, computing a cybersecurity hashing-based signature of the cybersecurity event based on the cybersecurity event digest; searching, based on the distinct cybersecurity hashing-based signature of the cybersecurity event, an n-dimensional space comprising a plurality of historical cybersecurity event hashing-based signatures; returning one or more historical cybersecurity events or historical cybersecurity alerts homogeneous to the cybersecurity event based on the search; deriving one or more cybersecurity event-specific handling actions for the cybersecurity event based on identifying a threat handling action corresponding to each of the one or more historical cybersecurity events or historical cybersecurity alerts homogeneous to the cybersecurity event; and executing one or more cybersecurity threat mitigation actions to resolve or mitigate the cybersecurity event.

Claims17

Dependent claims

A method for accelerating a threat mitigation or disposal of a cybersecurity event, the method comprising:

identifying a target cybersecurity event comprising a plurality of distinct pieces of event data;
generating a cybersecurity event digest based on the target cybersecurity event, wherein the generating the cybersecurity event digest includes composing at least one string of text that informs a characterization of the target cybersecurity event based on a subset of the plurality of distinct pieces of event data;
computing, via a hashing algorithm, a cybersecurity hashing-based signature of the target cybersecurity event based on the cybersecurity event digest;
selectively returning, based on the cybersecurity hashing-based signature of the target cybersecurity event, one or more historical cybersecurity events substantially similar to the target cybersecurity event;
generating a cybersecurity event-specific handling action for the target cybersecurity event based on identifying a historical event handling action corresponding to at least a subset of the one or more historical cybersecurity events;
and
executing the cybersecurity event-specific handling action including adding the target cybersecurity event to an active, ongoing cybersecurity incident that includes a plurality of distinct cybersecurity events related to the target cybersecurity event.

4 more elements

A method for accelerating a threat mitigation or disposal of a cybersecurity alert, the method comprising:

generating a cybersecurity alert digest based on a target cybersecurity alert, wherein the cybersecurity alert digest includes at least one string of text that informs a characterization of the target cybersecurity alert;
searching, based on a cybersecurity hashing-based signature of the cybersecurity alert digest, an n-dimensional data structure comprising a plurality of historical cybersecurity alert hashing-based signatures that correspond to a plurality of historical cybersecurity alerts;
returning one or more historical cybersecurity alerts based on the search;
determining a cybersecurity alert-specific handling action for the target cybersecurity alert based on an identification of a historical cybersecurity handling action corresponding to at least a subset of the one or more historical cybersecurity alerts;
and
executing the cybersecurity alert-specific handling action that resolves or mitigates a threat of the target cybersecurity alert, the executing further includes:
(i-a) automatically routing the target cybersecurity alert to a cybersecurity alert disposal queue;
and
(i-b) automatically assigning a disposal rationale to the target cybersecurity alert based on the cybersecurity alert-specific handling action;
or
(ii) routing the target cybersecurity alert to a cybersecurity incident queue prior to an execution of an automated cybersecurity investigation workflow for the target cybersecurity alert.

8 more elements

Dependencies are inferred from the claim text.

Systems and methods for intelligent cybersecurity alert similarity detection and cybersecurity alert handling

Life of this patent

Systems and methods for intelligent cybersecurity alert similarity detection and cybersecurity alert handling

Life of this patent

Abstract

Claims17