# US 12,120,145 B2 · Threat intelligence system and method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,120,145 B2 - Document ID: US12120145B2 - Status: Granted - Kind: B2 - Application number: 17/863,711 - Filed: 2022-07-13 - Published: 2022-11-03 - Granted: 2024-10-15 - Earliest claimed: 2015-07-02 - Assignees: Reliaquest Holdings, LLC - Applicants: Reliaquest Holdings, LLC - Inventors: Brian P. Murphy; Joe Partlow - Web page: https://patentgrep.com/patent/US12120145B2 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/563: Data redirection of data network streams - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer-implemented method, computer program product and computing system for importing threat data from a plurality of threat data sources, thus generating a plurality of raw threat data definitions. The plurality of raw threat data definitions are processed, thus generating a plurality of processed threat data definitions. The plurality of processed threat data definitions are processed to form a master threat data definition. The master threat data definition is provided to one or more client electronic devices. ## Claims ### Claim 1 A computer-implemented method, executed on a computing device, comprising: importing threat data from a plurality of threat data sources, thus generating a plurality of raw threat data definitions; processing the plurality of raw threat data definitions, thus generating a plurality of processed threat data definitions, wherein processing the plurality of raw threat data definitions includes: deduplicating the plurality of raw threat data definitions; cleaning the plurality of raw threat data definitions to remove false positives; determining a category for each of the plurality of raw threat data definitions; and determining a source for each of the plurality of raw threat data definitions; processing the plurality of processed threat data definitions to form a master threat data definition; formatting the master threat data definition into a format that is compatible with one or more client electronic devices; and providing the master threat data definition to the one or more client electronic devices to enable the one or more client electronic devices to detect one or more threats. ### Claim 2 (depends on 1) The computer-implemented method of claim 1 wherein importing threat data from a plurality of threat data sources includes one or more of: receiving the plurality of raw threat data definitions; and storing the plurality of raw threat data definitions into one or more database tables. ### Claim 3 (depends on 1) The computer-implemented method of claim 1 wherein processing the plurality of raw threat data definitions includes one or more of: converting the plurality of raw threat data definitions into a common format; determining the trust level for each of the plurality of raw threat data definitions; and determining the age level for each of the plurality of raw threat data definitions. ### Claim 4 (depends on 1) The computer-implemented method of claim 1 wherein processing the plurality of processed threat data definitions to form a master threat data definition includes one or more of: combining the plurality of processed threat data definitions to form the master threat data definition. ### Claim 5 (depends on 1) The computer-implemented method of claim 1 wherein providing the master threat data definition to one or more client electronic devices includes: providing at least a portion of the master threat data definition to the one or more client electronic devices using one or more of a Hypertext Markup Language (HTML) report and a pre-formatted data export. ### Claim 6 (depends on 1) The computer-implemented method of claim 1 wherein the plurality of threat data sources includes one or more of: public honeypot servers; private honeypot servers; social network trader sources; and open source threat feeds. ### Claim 7 A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising: importing threat data from a plurality of threat data sources, thus generating a plurality of raw threat data definitions; processing the plurality of raw threat data definitions, thus generating a plurality of processed threat data definitions, wherein processing the plurality of raw threat data definitions includes: deduplicating the plurality of raw threat data definitions; cleaning the plurality of raw threat data definitions to remove false positives; determining a category for each of the plurality of raw threat data definitions; and determining a source for each of the plurality of raw threat data definitions; processing the plurality of processed threat data definitions to form a master threat data definition; formatting the master threat data definition into a format that is compatible with one or more client electronic devices; and providing the master threat data definition to the one or more client electronic devices to enable the one or more client electronic devices to detect one or more threats. ### Claim 8 (depends on 7) The computer program product of claim 7 wherein importing threat data from a plurality of threat data sources includes one or more of: receiving the plurality of raw threat data definitions; and storing the plurality of raw threat data definitions into one or more database tables. ### Claim 9 (depends on 7) The computer program product of claim 7 wherein processing the plurality of raw threat data definitions includes one or more of: converting the plurality of raw threat data definitions into a common format; determining the trust level for each of the plurality of raw threat data definitions; and determining the age level for each of the plurality of raw threat data definitions. ### Claim 10 (depends on 7) The computer program product of claim 7 wherein processing the plurality of processed threat data definitions to form a master threat data definition includes one or more of: combining the plurality of processed threat data definitions to form the master threat data definition. ### Claim 11 (depends on 7) The computer program product of claim 7 wherein providing the master threat data definition to one or more client electronic devices includes: providing at least a portion of the master threat data definition to the one or more client electronic devices using one or more of a Hypertext Markup Language (HTML) report and a pre-formatted data export. ### Claim 12 (depends on 7) The computer program product of claim 7 wherein the plurality of threat data sources includes one or more of: public honeypot servers; private honeypot servers; social network trader sources; and open source threat feeds. ### Claim 13 A computing system including a processor and memory configured to perform operations comprising: importing threat data from a plurality of threat data sources, thus generating a plurality of raw threat data definitions; processing the plurality of raw threat data definitions, thus generating a plurality of processed threat data definitions, wherein processing the plurality of raw threat data definitions includes: deduplicating the plurality of raw threat data definitions; cleaning the plurality of raw threat data definitions to remove false positives; determining a category for each of the plurality of raw threat data definitions; and determining a source for each of the plurality of raw threat data definitions; processing the plurality of processed threat data definitions to form a master threat data definition; formatting the master threat data definition into a format that is compatible with one or more client electronic devices; and providing the master threat data definition to the one or more client electronic devices to enable the one or more client electronic devices to detect one or more threats. ### Claim 14 (depends on 13) The computing system of claim 13 wherein importing threat data from a plurality of threat data sources includes one or more of: receiving the plurality of raw threat data definitions; and storing the plurality of raw threat data definitions into one or more database tables. ### Claim 15 (depends on 13) The computing system of claim 13 wherein processing the plurality of raw threat data definitions includes one or more of: converting the plurality of raw threat data definitions into a common format; determining the trust level for each of the plurality of raw threat data definitions; and determining the age level for each of the plurality of raw threat data definitions. ### Claim 16 (depends on 13) The computing system of claim 13 wherein processing the plurality of processed threat data definitions to form a master threat data definition includes one or more of: combining the plurality of processed threat data definitions to form the master threat data definition. ### Claim 17 (depends on 13) The computing system of claim 13 wherein providing the master threat data definition to one or more client electronic devices includes: providing at least a portion of the master threat data definition to the one or more client electronic devices using one or more of a Hypertext Markup Language (HTML) report and a pre-formatted data export. ### Claim 18 (depends on 13) The computing system of claim 13 wherein the plurality of threat data sources includes one or more of: public honeypot servers; private honeypot servers; social network trader sources; and open source threat feeds.