Back to results
US 11,777,984 B1Granted
Automatic threat detection and remediation
AssigneeWells Fargo Bank, N.A.
InventorsDivakar Sastry Prayaga, Rajasekhar Kode
Life of this patent
Estimating the term…
Abstract
Threats to systems and data captured by such systems can be automatically detected and remediated. Inbound traffic on an enterprise network can be monitored and analyzed to detect a threat based on parameters of the inbound traffic. In response, a patch can be identified or generated to address known or unknown threats based on a comparison of parameters. Once identified or generated, the patch can be conveyed to a target computing resource for deployment to address the threat.
Claims15
A system, comprising:
- a processor coupled to a memory that includes instructions, that when executed by the processor, cause the processor to:
- detect a first threat based on analysis of a first plurality of parameter values of inbound traffic to an enterprise network;
- automatically determine based on the first plurality of parameter values a first patch that mitigates the first threat on a computing resource in the enterprise network;
- detect a second threat based on analysis of a second plurality of parameter values;
- when the first plurality of parameter values and the second plurality of parameter values have one or more parameter values in common, automatically generate a second patch for the second threat based in part on a portion of the first patch and the second plurality of parameter values;
- and
- convey the second patch to the computing resource for application;
- generate a third patch for an unknown threat from at least one existing patch associated with a known threat;
- identify one or more parameter values associated with the at least one existing patch;
- compute a similarity score based on a result of a comparison of the one or more parameter values for associated with the threat and the one or more parameter values associated with the at least one existing patch;
- and
- determine the at least one existing patch based on comparison of the similarity score to a predetermined threshold.
9 more elements
A method, comprising:
- monitoring inbound traffic to an enterprise network;
- detecting a first threat based on analysis of a first plurality of parameter values of the inbound traffic;
- automatically determining based on the first plurality of parameter values a first patch that mitigates the first threat on a computing resource in the enterprise network;
- detecting a second threat based on analysis of a second plurality of parameter values;
- when the first plurality of parameter values and the second plurality of parameter values have one or more parameter values in common, automatically generating a second patch for the second threat based in part on a portion of the first patch and the second plurality of parameter values;
- providing the second patch to the computing resource for deployment of the patch on the computing resource;
- generating a third patch for an unknown threat from at least one existing patch associated with a known threat;
- identifying one or more parameter values associated with the at least one existing patch;
- computing a similarity score based on a result of a comparison of the one or more parameter values for associated with the threat and the one or more parameter values associated with the at least one existing patch;
- and
- determining the at least one existing patch based on comparison of the similarity score to a predetermined threshold.
8 more elements
A method, comprising:
- executing, on a processor, instructions that cause the processor to perform operations comprising:
- monitoring inbound traffic to an enterprise network;
- detecting presence of an unknown threat, prior to the unknown threat impacting an enterprise server, based on analysis of values of a first plurality of parameters of the inbound traffic;
- identifying at least one first patch associated with a threat based on the first plurality of parameter values;
- detecting a second threat based on analysis of a second plurality of parameter values;
- when the first plurality of parameter values and the second plurality of parameter values have one or more parameter values in common, automatically generating a second patch for the second threat based in part on a portion of the at least one patch to address the unknown threat and the second plurality of parameter values;
- conveying the second patch for application on a kernel of the enterprise server;
- generating a third patch for an unknown threat from at least one existing patch associated with a known threat;
- identifying one or more parameter values associated with the at least one existing patch;
- computing a similarity score based on a result of a comparison of the one or more parameter values for associated with the threat and the one or more parameter values associated with the at least one existing patch;
- and
- determining the at least one existing patch based on comparison of the similarity score to a predetermined threshold.
9 more elements
Dependencies are inferred from the claim text.