US 11,695,798 B2 · Cybersecurity incident response and security operation system employing playbook generation and parent matching through custom machine learning

Abstract

A cybersecurity incident is registered at a security incident response platform. At a playbook generation system, details are received of the cybersecurity incident from the security incident response platform. At least some of the details correspond to a set of features of the cybersecurity incident. A set or subset of nearest neighbors of the cybersecurity incident is localized in a feature space. The nearest neighbors of the cybersecurity incident are other cybersecurity incidents having a distance from the cybersecurity incident within the feature space that is defined by differences in features of the nearest neighbors with respect to the set of features of the cybersecurity incident. A playbook is created for responding to the cybersecurity incident having prescriptive procedures based on occurrences of prescriptive procedures previously employed in response to the nearest neighbor cybersecurity incidents. The differences in features of the nearest neighbors with respect to the set of features of the cybersecurity incident are calculated, for at least one feature, using a present-or-equal metric, and for at least one other feature, using a symmetric difference metric. The playbook generation system is also a parent recommendation system, which identifies a parent for the cybersecurity incident, based on distances of the nearest neighbors of the cybersecurity incident in the feature space. The parent recommendation system adjusts, based on the recommended parent or the parent other than the recommended parent being selected, weights of features upon which distances in the feature space are based.

Claims19

Dependent claims

A computer-implemented method comprising:

detecting, by one or more processors, a cybersecurity incident having a plurality of features;
determining, by the one or more processors, a set of nearest neighbors of the cybersecurity incident in a feature space, the set of nearest neighbors comprising other cybersecurity incidents having a distance from the cybersecurity incident within the feature space and within a predetermined threshold;
determining, by the one or more processors, a runbook associated with the cybersecurity incident based on previous cybersecurity incidents of the set of nearest neighbors, the runbook comprising an incident identifier, a number of parents, a confidence threshold, a distance threshold, a flow of one or more actions to be executed in response to detecting the cybersecurity incident, and flow control for execution of the one or more actions;
causing, by the one or more processors, presentation of the runbook in a user interface (UI) showing details of the cybersecurity incident;
executing, by the one or more processors, the one or more actions of the runbook based on the flow control for the execution;
and
causing, by the one or more processors, presentation in the UI of results after execution of the runbook.

4 more elements

A method computer-implemented method comprising:

detecting, by one or more processors, a cybersecurity incident having a plurality of features;
determining by the one or more processors, a set of nearest neighbors of the cybersecurity incident in a feature space, the set of nearest neighbors comprising other cybersecurity incidents having a distance from the cybersecurity incident within the feature space and within a predetermined threshold, wherein the distance from a neighbor to the cybersecurity incident is calculated, for at least one feature, using a present-or-equal metric having a first value if both values of the feature are missing or both values are present and equal, a second value if only one value of the feature is missing but the other value is present, and a third value if both values of the feature are present and not equal;
determining by the one or more processors, a runbook associated with the cybersecurity incident based on previous cybersecurity incidents of the set of nearest neighbors, the runbook comprising a flow of one or more actions to be executed in response to detecting the cybersecurity incident and flow control for execution of the one or more actions;
causing, by the one or more processors, presentation of the runbook in a user interface (UI) showing details of the cybersecurity incident;
executing, by the one or more processors, the one or more actions of the runbook based on the flow control for the execution;
and
causing, by the one or more processors, presentation in the UI of results after execution of the runbook.

4 more elements

A system comprising:

a memory comprising instructions;
and
one or more computer processors, wherein the instructions, when executed by the one or more computer processors, cause the system to perform operations comprising:
detecting a cybersecurity incident having a plurality of features;
determining a set of nearest neighbors of the cybersecurity incident in a feature space, the set of nearest neighbors comprising other cybersecurity incidents having a distance from the cybersecurity incident within the feature space and within a predetermined threshold;
determining a runbook associated with the cybersecurity incident based on previous cybersecurity incidents of the set of nearest neighbors, the runbook comprising an incident identifier, a number of parents, a confidence threshold, a distance threshold, a flow of one or more actions to be executed in response to detecting the cybersecurity incident, and flow control for execution of the one or more actions;
causing presentation of the runbook in a user interface (UI) showing details of the cybersecurity incident;
executing the one or more actions of the runbook based on the flow control for the execution;
and
causing presentation in the UI of results after execution of the runbook.

7 more elements

Dependencies are inferred from the claim text.

Cybersecurity incident response and security operation system employing playbook generation and parent matching through custom machine learning

Life of this patent

Cybersecurity incident response and security operation system employing playbook generation and parent matching through custom machine learning

Life of this patent

Abstract

Claims19