Threat intelligence system and method
AssigneeReliaquest Holdings, LLC
InventorsBrian P. Murphy, Joe Partlow
Life of this patent
Estimating the term…
Abstract
A computer-implemented method, computer program product and computing system for importing threat data from a plurality of threat data sources, thus generating a plurality of raw threat data definitions. The plurality of raw threat data definitions are processed, thus generating a plurality of processed threat data definitions. The plurality of processed threat data definitions are processed to form a master threat data definition. The master threat data definition is provided to one or more client electronic devices.
Claims18
A computer-implemented method, executed on a computing device, comprising:
- importing threat data from a plurality of threat data sources, thus generating a plurality of raw threat data definitions;
- processing the plurality of raw threat data definitions, thus generating a plurality of processed threat data definitions, wherein processing the plurality of raw threat data definitions includes:
- deduplicating the plurality of raw threat data definitions;
- cleaning the plurality of raw threat data definitions to remove false positives;
- determining a category for each of the plurality of raw threat data definitions;
- and
- determining a source for each of the plurality of raw threat data definitions;
- processing the plurality of processed threat data definitions to form a master threat data definition;
- formatting the master threat data definition into a format that is compatible with one or more client electronic devices;
- and
- providing the master threat data definition to the one or more client electronic devices to enable the one or more client electronic devices to detect one or more threats.
A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
- importing threat data from a plurality of threat data sources, thus generating a plurality of raw threat data definitions;
- processing the plurality of raw threat data definitions, thus generating a plurality of processed threat data definitions, wherein processing the plurality of raw threat data definitions includes:
- deduplicating the plurality of raw threat data definitions;
- cleaning the plurality of raw threat data definitions to remove false positives;
- determining a category for each of the plurality of raw threat data definitions;
- and
- determining a source for each of the plurality of raw threat data definitions;
- processing the plurality of processed threat data definitions to form a master threat data definition;
- formatting the master threat data definition into a format that is compatible with one or more client electronic devices;
- and
- providing the master threat data definition to the one or more client electronic devices to enable the one or more client electronic devices to detect one or more threats.
A computing system including a processor and memory configured to perform operations comprising:
- importing threat data from a plurality of threat data sources, thus generating a plurality of raw threat data definitions;
- processing the plurality of raw threat data definitions, thus generating a plurality of processed threat data definitions, wherein processing the plurality of raw threat data definitions includes:
- deduplicating the plurality of raw threat data definitions;
- cleaning the plurality of raw threat data definitions to remove false positives;
- determining a category for each of the plurality of raw threat data definitions;
- and
- determining a source for each of the plurality of raw threat data definitions;
- processing the plurality of processed threat data definitions to form a master threat data definition;
- formatting the master threat data definition into a format that is compatible with one or more client electronic devices;
- and
- providing the master threat data definition to the one or more client electronic devices to enable the one or more client electronic devices to detect one or more threats.
Dependencies are inferred from the claim text.