# US 12,182,266 B2 · Threat mitigation system and method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,182,266 B2
- Document ID: US12182266B2
- Status: Granted
- Kind: B2
- Application number: 18/130,152
- Filed: 2023-04-03
- Published: 2023-10-05
- Granted: 2024-12-31
- Earliest claimed: 2022-04-01
- Assignees: Reliaquest Holdings, LLC
- Applicants: ReliaQuest Holdings, LLC
- Inventors: Brian P. Murphy; Joe Partlow; Colin O'Connor; Jason Pfeiffer; Brian Philip Murphy
- Web page: https://patentgrep.com/patent/US12182266B2

## CPC

- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 2221/034: Test or assess a computer or a system
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computer-implemented method, computer program product and computing system for receiving a plurality of detection events concerning a plurality of security events occurring on a security-relevant subsystem within a computing platform; identifying two or more associated detection events included within the plurality of detection events; and grouping the two or more associated detection events to define a security incident.

## Claims

### Claim 1

A computer-implemented method, executed on a computing device, comprising:
monitoring and logging, by a security-relevant subsystem, activity with respect to a computing platform;
detecting, by the security-relevant subsystem, a plurality of detection events;
receiving the plurality of detection events concerning a plurality of security events occurring on the security-relevant subsystem within the computing platform; wherein the plurality of security events are detected on the security-relevant subsystem using one or more detection rules executed on the security-relevant subsystem, including defining a universal detection rule and translating the universal detection rule into a technology-specific detection rule for the security-relevant subsystem;
identifying two or more associated detection events included within the plurality of detection events;
grouping the two or more associated detection events to define a security incident;
receiving one or more additional detection events concerning one or more additional security events occurring on the security-relevant subsystem within the computing platform;
adding the one or more additional detection events to the security incident if the one or more additional detection events are related to the two or more associated detection events;
normalizing the plurality of detection events into a common ontology, wherein normalizing the plurality of detection events into a common ontology includes:
translating a syntax of each of the plurality of detection events into a common syntax;
generating comparison information that compares current security-relevant capabilities of the computing platform to comparative platform information determined for a comparative platform to identify a threat context indicator and assign a threat level; and
effectuating one or more remedial operations concerning one or more know conditions and assigned threat level.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1 wherein the plurality of security events includes one or more of:
Denial of Service (DOS) events;
Distributed Denial of Service DDOS events;
Man-in-the-Middle (MitM) events;
phishing events;
Password Attack events;
SQL Injection events;
Cross-Site Scripting (XSS) events;
Insider Threat events;
spamming events;
malware events;
web attacks; and
exploitation events.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1 wherein the security-relevant subsystem includes one or more of:
CDN (i.e., Content Delivery Network) systems;
DAM (i.e., Database Activity Monitoring) systems;
UBA (i.e., User Behavior Analytics) systems;
MDM (i.e., Mobile Device Management) systems;
IAM (i.e., Identity and Access Management) systems;
DNS (i.e., Domain Name Server) systems;
Antivirus systems;
operating systems;
data lakes;
data logs;
security-relevant software applications;
security-relevant hardware systems; and
resources external to the computing platform.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1 wherein one or more artifacts/log entries are associated with each of the plurality of detection events.

### Claim 5 (depends on 4)

The computer-implemented method of claim 4 wherein identifying two or more associated detection events included within the plurality of detection events includes:
identifying two or more detection events included within the plurality of detection events that have common artifacts/log entries.

### Claim 6 (depends on 4)

The computer-implemented method of claim 4 wherein grouping the two or more associated detection events into a security incident includes:
grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident.

### Claim 7

A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
monitoring and logging, by a security-relevant subsystem, activity with respect to a computing platform;
detecting, by the security-relevant subsystem, a plurality of detection events;
receiving the plurality of detection events concerning a plurality of security events occurring on the security-relevant subsystem within the computing platform; wherein the plurality of security events are detected on the security-relevant subsystem using one or more detection rules executed on the security-relevant subsystem, including defining a universal detection rule and translating the universal detection rule into a technology-specific detection rule for the security-relevant subsystem;
identifying two or more associated detection events included within the plurality of detection events;
grouping the two or more associated detection events to define a security incident;
receiving one or more additional detection events concerning one or more additional security events occurring on the security-relevant subsystem within the computing platform;
adding the one or more additional detection events to the security incident if the one or more additional detection events are related to the two or more associated detection events;
normalizing the plurality of detection events into a common ontology, wherein normalizing the plurality of detection events into a common ontology includes:
translating a syntax of each of the plurality of detection events into a common syntax;
generating comparison information that compares current security-relevant capabilities of the computing platform to comparative platform information determined for a comparative platform to identify a threat context indicator and assign a threat level; and
effectuating one or more remedial operations concerning one or more know conditions and assigned threat level.

### Claim 8 (depends on 7)

The computer program product of claim 7 wherein the plurality of security events includes one or more of:
Denial of Service (DOS) events;
Distributed Denial of Service DDOS events;
Man-in-the-Middle (MitM) events;
phishing events;
Password Attack events;
SQL Injection events;
Cross-Site Scripting (XSS) events;
Insider Threat events;
spamming events;
malware events;
web attacks; and
exploitation events.

### Claim 9 (depends on 7)

The computer program product of claim 7 wherein the security-relevant subsystem includes one or more of:
CDN (i.e., Content Delivery Network) systems;
DAM (i.e., Database Activity Monitoring) systems;
UBA (i.e., User Behavior Analytics) systems;
MDM (i.e., Mobile Device Management) systems;
IAM (i.e., Identity and Access Management) systems;
DNS (i.e., Domain Name Server) systems;
Antivirus systems;
operating systems;
data lakes;
data logs;
security-relevant software applications;
security-relevant hardware systems; and
resources external to the computing platform.

### Claim 10 (depends on 7)

The computer program product of claim 7 wherein one or more artifacts/log entries are associated with each of the plurality of detection events.

### Claim 11 (depends on 10)

The computer program product of claim 10 wherein identifying two or more associated detection events included within the plurality of detection events includes:
identifying two or more detection events included within the plurality of detection events that have common artifacts/log entries.

### Claim 12 (depends on 10)

The computer program product of claim 10 wherein grouping the two or more associated detection events into a security incident includes:
grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident.

### Claim 13

A computing system including a processor and memory configured to perform operations comprising:
monitoring and logging, by a security-relevant subsystem, activity with respect to a computing platform;
detecting, by the security-relevant subsystem, a plurality of detection events;
receiving the plurality of detection events concerning a plurality of security events occurring on the security-relevant subsystem within the computing platform; wherein the plurality of security events are detected on the security-relevant subsystem using one or more detection rules executed on the security-relevant subsystem, including defining a universal detection rule and translating the universal detection rule into a technology-specific detection rule for the security-relevant subsystem;
identifying two or more associated detection events included within the plurality of detection events;
grouping the two or more associated detection events to define a security incident;
receiving one or more additional detection events concerning one or more additional security events occurring on the security-relevant subsystem within the computing platform;
adding the one or more additional detection events to the security incident if the one or more additional detection events are related to the two or more associated detection events;
normalizing the plurality of detection events into a common ontology, wherein normalizing the plurality of detection events into a common ontology includes:
translating a syntax of each of the plurality of detection events into a common syntax;
generating comparison information that compares current security-relevant capabilities of the computing platform to comparative platform information determined for a comparative platform to identify a threat context indicator and assign a threat level; and
effectuating one or more remedial operations concerning one or more know conditions and assigned threat level.

### Claim 14 (depends on 13)

The computing system of claim 13 wherein the plurality of security events includes one or more of:
Denial of Service (DOS) events;
Distributed Denial of Service DDOS events;
Man-in-the-Middle (MitM) events;
phishing events;
Password Attack events;
SQL Injection events;
Cross-Site Scripting (XSS) events;
Insider Threat events;
spamming events;
malware events;
web attacks; and
exploitation events.

### Claim 15 (depends on 13)

The computing system of claim 13 wherein the security-relevant subsystem includes one or more of:
CDN (i.e., Content Delivery Network) systems;
DAM (i.e., Database Activity Monitoring) systems;
UBA (i.e., User Behavior Analytics) systems;
MDM (i.e., Mobile Device Management) systems;
IAM (i.e., Identity and Access Management) systems;
DNS (i.e., Domain Name Server) systems;
Antivirus systems;
operating systems;
data lakes;
data logs;
security-relevant software applications;
security-relevant hardware systems; and
resources external to the computing platform.

### Claim 16 (depends on 13)

The computing system of claim 13 wherein one or more artifacts/log entries are associated with each of the plurality of detection events.

### Claim 17 (depends on 16)

The computing system of claim 16 wherein identifying two or more associated detection events included within the plurality of detection events includes:
identifying two or more detection events included within the plurality of detection events that have common artifacts/log entries.

### Claim 18 (depends on 16)

The computing system of claim 16 wherein grouping the two or more associated detection events into a security incident includes:
grouping the one or more artifacts/log entries associated with each of the two or more associated detection events to form an artifact/log entry set for the security incident.