Back to results
US 11,949,706 B2Granted
System and method for assigning threat valuations to network events and security events
AssigneeFluency Corp.
InventorsChristopher Jordan, Kun Luo
Life of this patent
Estimating the term…
Abstract
A method including receiving a record in a first timeframe; establishing a plurality of threat vectors for the record; merging the plurality of threat vectors to the record; generating a risk valuation for the record based on the plurality of threat vectors; merging the risk valuation to the record to form a risk event; and storing the risk event in a computer-readable data store.
Claims20
A method comprising:
- receiving or retrieving a plurality of events in a first timeframe, each of the events comprising a plurality of attribute-value pairs;
- deriving a first key for each event of the plurality of events;
- superimposing each event of the plurality of events having a same first key into a record to form a plurality of records;
- superimposing a plurality of threat factors to each record of the plurality of records;
- calculating a threat valuation for each record of the plurality of records based on the plurality of threat factors superimposed to the respective record of the plurality of records;
- generating a risk event for each record of the plurality of records if the threat valuation is above a predetermined threshold value;
- and
- storing the risk events in a computer-readable data store.
5 more elements
A method comprising:
- receiving a plurality of events in a first timeframe;
- deriving a primary key and a secondary key for each event of the plurality of events;
- sending each event of the plurality of events to one or more threat vector calculators;
- establishing a plurality of threat vectors for each event of the plurality of events, wherein the one or more threat vector calculators establish the plurality of threat vectors;
- merging the plurality of threat vectors to each event of the plurality of events;
- grouping each event of the plurality of events sharing a secondary key into a plurality of subsets;
- generating a risk valuation for each subset of the plurality of subsets based on the plurality of threat vectors;
- merging the risk valuation to each subset of the plurality of subsets to form a plurality of risk events;
- grouping each subset of the plurality of subsets sharing a primary key into a plurality of sets, wherein a risk factor is assigned to each set of the plurality of sets;
- and
- storing the plurality of sets in a computer-readable data store.
8 more elements
A device comprising:
- a system that receives or retrieves a plurality of events in a sliding window from a plurality of network security systems;
- a processor that forms a plurality of sets by:
- deriving a key for each event of the plurality of events;
- merging each event sharing a key into a record to form a plurality of records;
- merging a plurality of threat factors to each record of the plurality of records;
- grouping each record of the plurality of records sharing a secondary key into a plurality of subsets;
- merging a risk score to each subset of the plurality of subsets based on the threat factors present in the respective subset of the plurality of subsets to form a plurality of security events;
- and
- grouping each subset of the plurality of subsets sharing a primary key into a plurality of sets, wherein a risk factor is assigned to each set of the plurality of sets;
- and
- a computer readable data store that stores the plurality of sets.
8 more elements
Dependencies are inferred from the claim text.