# US 12,003,515 B2 · Systems and method of cyber-monitoring which utilizes a knowledge database > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,515 B2 - Document ID: US12003515B2 - Status: Granted - Kind: B2 - Application number: 17/259,453 - Filed: 2019-07-12 - Published: 2021-09-09 - Granted: 2024-06-04 - Earliest claimed: 2018-07-12 - Assignees: Cyber Defence QCD Corporation - Applicants: Cyber Defence Qcd Corporation - Inventors: Tiago Alves De Jesus - Web page: https://patentgrep.com/patent/US12003515B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06N 5/04: Inference or reasoning models - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract The invention relates to systems and methods of cyber-monitoring which utilizes a knowledge database. In particular, the present invention provides a method of monitoring a cyber-network comprises the following steps: providing one or more database(s) of normally-occurring cyber-event(s); detecting cyber-event(s) in the cyber-network; determining if the detected cyber-event(s) is normally-occurring or anomalous by analyzing the detected cyber-event(s) using the one or more database(s) of normally-occurring cyber-events; excluding cyber-event(s) which are classified as normally-occurring to identify anomalous cyber-events; and optionally determining if the anomalous cyber-events are malicious. ## Claims ### Claim 1 A method of monitoring a cyber-network, the method comprising: providing one or more database(s) of normally-occurring cyber-event(s); detecting cyber-event(s) in the cyber-network; comparing the detected cyber-event(s) to the normally-occurring cyber-event(s) in the one or more database(s) of normally-occurring cyber-events; classifying the detected cyber-event(s) as normally-occurring if there is corresponding normally-occurring cyber-event(s) in the one or more database(s); excluding cyber-event(s) which are classified as normally-occurring from further analysis, wherein remaining cyber-event(s) are anomalous cyber-events; and automatically determining if the anomalous cyber-events are malicious. ### Claim 2 (depends on 1) The method of claim 1, wherein the one or more normally-occurring cyber-events have been classified into a category selected from the group consisting of: 1) operating system (OS) activities; 2) generic commercial applications activities; 3) industry specific applications activities; and 4) organizational specific application activities; wherein if said detected cyber-events corresponds to categories 1) to 4), said cyber-event is normal. ### Claim 3 (depends on 2) The method of claim 2, wherein a cyber-event is classified as operating system (OS) activities if it is a program execution seen across all organizations but limited to specific types of OS. ### Claim 4 (depends on 2) The method of claim 2, wherein cyber-event is classified as industry specific applications activities if it is a program execution only seen across organizations within a specific industry. ### Claim 5 (depends on 1) The method of claim 1, the classifying step further comprises sending requests for information or input and analyzing any information received. ### Claim 6 (depends on 1) The method of claim 1, wherein the classifying step comprises grouping detected cyber-events and comparing to groups of known cyber-events in said one or more databases; wherein if there is no corresponding group in said known groups, said grouping of detected cyber-events is anomalous. ### Claim 7 (depends on 1) The method of claim 1, wherein at least one of the one or more database(s) is a database of normally-occurring cyber-event(s) specific for the network or a node thereof. ### Claim 8 (depends on 7) The method of claim 7, wherein the database of normally-occurring cyber-event(s) specific for the network or the node thereof is stored locally in the network or the node thereof. ### Claim 9 (depends on 7) The method of claim 7, wherein the database of normally-occurring cyber-event(s) specific for the network or the node thereof is stored remotely to the network or the node thereof. ### Claim 10 (depends on 1) The method of claim 1, wherein at least one of the one or more database(s) is a global database of normally-occurring cyber-event(s). ### Claim 11 (depends on 10) The method of claim 10, wherein the global database comprises normally-occurring cyber-event(s) specific for the network or the node thereof and other known normally-occurring cyber-event(s). ### Claim 12 (depends on 11) The method of claim 11, wherein the other known normally-occurring cyber-event(s) are normally-occurring cyber events in one or more other monitored network(s) or one or more other monitored node(s). ### Claim 13 (depends on 10) The method of claim 10, wherein the global database is stored remotely to the network or the node thereof. ### Claim 14 (depends on 1) The method of claim 1, wherein at least one of the one or more database(s) is a database of normally-occurring cyber-event(s) specific for the network or a node thereof and at least one of the one or more database(s) is a global database of normally-occurring cyber-event(s). ### Claim 15 (depends on 1) The method of claim 1, wherein the method is a cloud-based method. ### Claim 16 (depends on 15) The method of claim 15, wherein the method is performed in a plurality of clouds, wherein each cloud has a database and is in communication with database on other clouds. ### Claim 17 (depends on 1) The method of claim 1, wherein each of the one or more databases evolves to update normally-occurring cyber-events.