US 12,003,515 B2 · Systems and method of cyber-monitoring which utilizes a knowledge database

Abstract

The invention relates to systems and methods of cyber-monitoring which utilizes a knowledge database. In particular, the present invention provides a method of monitoring a cyber-network comprises the following steps: providing one or more database(s) of normally-occurring cyber-event(s); detecting cyber-event(s) in the cyber-network; determining if the detected cyber-event(s) is normally-occurring or anomalous by analyzing the detected cyber-event(s) using the one or more database(s) of normally-occurring cyber-events; excluding cyber-event(s) which are classified as normally-occurring to identify anomalous cyber-events; and optionally determining if the anomalous cyber-events are malicious.

Claims17

Dependent claims

A method of monitoring a cyber-network, the method comprising:

providing one or more database(s) of normally-occurring cyber-event(s);
detecting cyber-event(s) in the cyber-network;
comparing the detected cyber-event(s) to the normally-occurring cyber-event(s) in the one or more database(s) of normally-occurring cyber-events;
classifying the detected cyber-event(s) as normally-occurring if there is corresponding normally-occurring cyber-event(s) in the one or more database(s);
excluding cyber-event(s) which are classified as normally-occurring from further analysis, wherein remaining cyber-event(s) are anomalous cyber-events;
and
automatically determining if the anomalous cyber-events are malicious.

4 more elements

Dependencies are inferred from the claim text.

Facts

Application

17/259,453Filed 12 Jul 2019 · us provisional application

Priority

12 Jul 2018

Published

US 2021/0281587 A19 Sep 2021

Granted

4 Jun 2024

Term ends

Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action
G06N 5/04
Computing arrangements using knowledge-based models: inference or reasoning models

Systems and method of cyber-monitoring which utilizes a knowledge database

Life of this patent

Systems and method of cyber-monitoring which utilizes a knowledge database

Life of this patent

Abstract

Claims17