# US 12,113,810 B2 · Autonomic incident response system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,810 B2 - Document ID: US12113810B2 - Status: Granted - Kind: B2 - Application number: 17/394,214 - Filed: 2021-08-04 - Published: 2021-11-25 - Granted: 2024-10-08 - Earliest claimed: 2021-08-04 - Assignees: 802 Secure, Inc. - Applicants: 802 Secure, Inc. - Inventors: Salim Hariri - Web page: https://patentgrep.com/patent/US12113810B2 ## CPC - H04L 41/046: comprising network management agents or mobile agents therefor - H04L 41/064: {involving time analysis} - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 41/0886: {Fully automatic configuration} - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/062: related to network traffic - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An autonomic incident response system (AIRS) that can be used within any cyber system (computing systems, network devices, applications, cyber-physical systems, data, and files). If a cyber system is attacked, the cyberattack pattern type can be seamlessly identified by the AIRS along with the method used to launch the attack, the vulnerability that was exploited, the impact and consequence of the attack, and finally the recovery actions that can be taken automatically or semi-automatically to stop the attack or mitigate its impact on cyber system operations. ## Claims ### Claim 1 An autonomic incident detection and response system, comprising: at least one processor; and at least one memory coupled to the at least one processor to store instructions, which when executed by the at least one processor, cause the autonomic incident response system to perform operations, the operations comprising: receiving an alert indicating a detected cyber threat incident on a monitored resource; collecting information about an entity associated with the detected cyber threat incident; pre-processing the collected information to generate entity footprint data, the entity footprint data comprising at least one of: system features, network features, or application features of the entity associated with the detected cyber threat incident; obtaining attack footprint data based on the generated entity footprint data; classifying the attack footprint data using statistical time series analysis, to identify an attack pattern; invoking a machine learning model to determine at least one response instruction based on the identified attack pattern; and generating a counter measure based on the at least one response instruction. ### Claim 2 (depends on 1) The autonomic incident detection and response system of claim 1, wherein the operations further comprise: identifying attack pattern attributes based on the identified attack pattern; and applying the generated counter measure in response to the detected cyber threat incident. ### Claim 3 (depends on 1) The autonomic incident detection and response system of claim 1, wherein the alert indicating the detected cyber threat incident is generated based on at least one of: (i) a detection of a malicious event triggered by an attack, a malicious fault, or an accident, (ii) use of signature-based approach for detection against a cyber-attack, or (iii) use of biometrics to detect a malicious event triggered by an insider. ### Claim 4 (depends on 1) The autonomic incident detection and response system of claim 1, wherein obtaining the attack footprint data comprises: selecting numerical features from the entity footprint data, and applying a principal component analysis to the selected numerical features to obtain the attack footprint data. ### Claim 5 (depends on 1) The autonomic incident detection and response system of claim 1, wherein generating the counter measure comprises: automating the at least one response instruction to generate the counter measure. ### Claim 6 (depends on 2) The autonomic incident detection and response system of claim 2, wherein the identified attack pattern attributes and the at least one response instruction are presented through a user interface. ### Claim 7 (depends on 1) The autonomic incident detection and response system of claim 1, wherein classifying the attack footprint data using the statistical time series analysis comprises: calculating an attack classification score based on alert event statistical metrics of the attack footprint data and stored attack pattern statistical metrics, wherein the stored attack pattern statistical metrics are calculated based on attack patterns used in attack pattern training data sets. ### Claim 8 (depends on 7) The autonomic incident detection and response system of claim 7, wherein the operations further comprise: identifying the attack pattern based on the attack classification score. ### Claim 9 A computer-implemented method for an autonomic incident detection and response system, the method comprising: receiving an alert indicating a detected cyber threat incident on a monitored resource; collecting information about an entity associated with the detected cyber threat incident; pre-processing the collected information to generate entity footprint data, the entity footprint data comprising at least one of: system features, network features, or application features of the entity associated with the detected cyber threat incident; obtaining attack footprint data based on the generated entity footprint data; classifying the attack footprint data using statistical time series analysis, to identify an attack pattern; invoking a machine learning model to determine at least one response instruction based on the identified attack pattern; and generating a counter measure based on the at least one response instruction. ### Claim 10 (depends on 9) The method of claim 9, further comprising: identifying attack pattern attributes based on the identified attack pattern; and applying the generated counter measure in response to the detected cyber threat incident. ### Claim 11 (depends on 9) The method of claim 9, wherein the alert indicating the detected cyber threat incident is generated based on at least one of: (i) a detection of a malicious event triggered by an attack, a malicious fault, or an accident, (ii) use of signature-based approach for detection against a cyber-attack, or (iii) use of biometrics to detect a malicious event triggered by an insider. ### Claim 12 (depends on 9) The method of claim 9, wherein obtaining the attack footprint data comprises: selecting numerical features from the entity footprint data, and applying a principal component analysis to the selected numerical features to obtain the attack footprint data. ### Claim 13 (depends on 9) The method of claim 9, wherein generating the counter measure comprises: automating the at least response instruction to generate the counter measure. ### Claim 14 (depends on 10) The method of claim 10, wherein the identified attack pattern attributes and the at least one response instruction are presented through a user interface. ### Claim 15 (depends on 9) The method of claim 9, wherein classifying the attack footprint data using the statistical time series analysis comprises: calculating an attack classification score based on alert event statistical metrics of the attack footprint data and stored attack pattern statistical metrics, wherein the stored attack pattern statistical metrics are calculated based on attack patterns used in attack pattern training data sets. ### Claim 16 (depends on 15) The method of claim 15, further comprising: identifying the attack pattern based on the attack classification score. ### Claim 17 An autonomic incident detection and response system, comprising: at least one processor; and at least one memory coupled to the at least one processor to store instructions, which when executed by the at least one processor, cause the autonomic incident response system to perform operations, the operations comprising: collecting information about a monitored resource; segmenting the collected information into system features, network features, and application features; pre-processing at least one of: the system features, the network features, or the application features, to obtain entity footprint data; and generating an alert indicating a detected cyber threat incident on the monitored resource based on the entity footprint data; wherein: the alert indicating the detected cyber threat incident on the monitored resource is received; information about an entity associated with the detected cyber threat incident is collected; the collected information about the entity associated with the detected cyber threat incident is pre-processed to generate the entity footprint data, the entity footprint data comprising at least one of: system features, network features, or application features of the entity associated with the detected cyber threat incident; attack footprint data is obtained based on the generated entity footprint data; the attack footprint data is classified using statistical time series analysis, to identify an attack pattern; a machine learning model is invoked to determine at least one response instruction based on the identified attack pattern; and a counter measure is generated based on the at least one response instruction. ### Claim 18 (depends on 17) The autonomic incident detection and response system of claim 17, wherein generating the alert relating to the detected threat on the monitored resource comprises: generating the alert relating to the detected threat on the monitored resource in response to detecting from the collected information a malicious event triggered by an attack, a malicious fault, or an accident; or generating the alert relating to the detected threat on the monitored resource in response to detecting from the collected information a cyber-attack using a signature-based approach; or generating the alert relating to the detected threat on the monitored resource in response to detecting from the collected information a malicious event triggered by an insider using biometrics. ### Claim 19 (depends on 17) The autonomic incident detection and response system of claim 17, wherein pre-processing the system features, the network features, and the application features comprises: removing features having a constant integer value; or applying a correlation analysis to eliminate features having a correlation to other features; or removing duplicated features.