Autonomic incident response system
Assignee802 Secure, Inc.
InventorSalim Hariri
Life of this patent
Estimating the term…
Abstract
An autonomic incident response system (AIRS) that can be used within any cyber system (computing systems, network devices, applications, cyber-physical systems, data, and files). If a cyber system is attacked, the cyberattack pattern type can be seamlessly identified by the AIRS along with the method used to launch the attack, the vulnerability that was exploited, the impact and consequence of the attack, and finally the recovery actions that can be taken automatically or semi-automatically to stop the attack or mitigate its impact on cyber system operations.
Claims19
An autonomic incident detection and response system, comprising:
- at least one processor;
- and
- at least one memory coupled to the at least one processor to store instructions, which when executed by the at least one processor, cause the autonomic incident response system to perform operations, the operations comprising:
- receiving an alert indicating a detected cyber threat incident on a monitored resource;
- collecting information about an entity associated with the detected cyber threat incident;
- pre-processing the collected information to generate entity footprint data, the entity footprint data comprising at least one of:
- system features, network features, or application features of the entity associated with the detected cyber threat incident;
- obtaining attack footprint data based on the generated entity footprint data;
- classifying the attack footprint data using statistical time series analysis, to identify an attack pattern;
- invoking a machine learning model to determine at least one response instruction based on the identified attack pattern;
- and
- generating a counter measure based on the at least one response instruction.
A computer-implemented method for an autonomic incident detection and response system, the method comprising:
- receiving an alert indicating a detected cyber threat incident on a monitored resource;
- collecting information about an entity associated with the detected cyber threat incident;
- pre-processing the collected information to generate entity footprint data, the entity footprint data comprising at least one of:
- system features, network features, or application features of the entity associated with the detected cyber threat incident;
- obtaining attack footprint data based on the generated entity footprint data;
- classifying the attack footprint data using statistical time series analysis, to identify an attack pattern;
- invoking a machine learning model to determine at least one response instruction based on the identified attack pattern;
- and
- generating a counter measure based on the at least one response instruction.
An autonomic incident detection and response system, comprising:
- at least one processor;
- and
- at least one memory coupled to the at least one processor to store instructions, which when executed by the at least one processor, cause the autonomic incident response system to perform operations, the operations comprising:
- collecting information about a monitored resource;
- segmenting the collected information into system features, network features, and application features;
- pre-processing at least one of:
- the system features, the network features, or the application features, to obtain entity footprint data;
- and
- generating an alert indicating a detected cyber threat incident on the monitored resource based on the entity footprint data;
- wherein:
- the alert indicating the detected cyber threat incident on the monitored resource is received;
- information about an entity associated with the detected cyber threat incident is collected;
- the collected information about the entity associated with the detected cyber threat incident is pre-processed to generate the entity footprint data, the entity footprint data comprising at least one of:
- system features, network features, or application features of the entity associated with the detected cyber threat incident;
- attack footprint data is obtained based on the generated entity footprint data;
- the attack footprint data is classified using statistical time series analysis, to identify an attack pattern;
- a machine learning model is invoked to determine at least one response instruction based on the identified attack pattern;
- and
- a counter measure is generated based on the at least one response instruction.
Dependencies are inferred from the claim text.