Back to results
US 11,902,302 B2Granted
Systems and methods for efficient combining of characteristc detection rules
AssigneeKnowBe4, Inc.
InventorsMarcio Castilho, Alin Irimie, Michael Hanley, Daniel Cormier, Raymond Skinner
Life of this patent
Estimating the term…
Abstract
System and methods are described which are useful for efficiently combining characteristic detection rules, such as may be done to efficiently and quickly assist in the dispositioning of user reported security threats.
Claims18
A method comprising:
- identifying, by the device, one or more indexes of one or more characteristic detection rules within a combination rule that have one of a binary or textual pattern that match at least a portion of an electronic communication received by the device, each of the one or more indexes identifying a position of a respective characteristic detection rule within the combination rule, each of the one or more characteristic detection rules having a revision identifier;
- determining, by the device, that the combination rule matches the electronic communication based at least on applying at least one or more logical operators of the combination rule to at least the one or more characteristic detection rules identified by the one or more indexes;
- identifying, by the device using the revision identifier, historical versions of each of the one or more characteristic detection rules;
- and
- identifying, by the device using the revisions identifier, whether a previous version of each of the one or more characteristic detection rules matched a previous electronic communication.
2 more elements
A system comprising;
- one or more processors, coupled to memory device and configured to:
- identify one or more indexes of one or more characteristic detection rules within a combination rule that have one of a binary or textual pattern that match at least a portion of an electronic communication received by the device, each of the one or more indexes identifying a position of a respective characteristic detection rule within the combination rule, each of the one or more characteristic detection rules having a revision identifier;
- determine that the combination rule matches the electronic communication based at least on applying at least one or more logical operators of the combination rule to at least the one or more characteristic detection rules identified by the one or more indexes;
- identify, using the revision identifier, historical versions of each of the one or more characteristic detection rules;
- and
- identify, using the revisions identifier, whether a previous version of each of the one or more characteristic detection rules matched a previous electronic communication.
3 more elements
Dependencies are inferred from the claim text.