# US 12,223,048 B2 · Threat mitigation system and method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,223,048 B2
- Document ID: US12223048B2
- Status: Granted
- Kind: B2
- Application number: 18/130,231
- Filed: 2023-04-03
- Published: 2023-10-05
- Granted: 2025-02-11
- Earliest claimed: 2022-04-01
- Assignees: Reliaquest Holdings, LLC
- Applicants: ReliaQuest Holdings, LLC
- Inventors: Brian P. Murphy; Joe Partlow; Colin O'Connor; Jason Pfeiffer; Brian Philip Murphy
- Web page: https://patentgrep.com/patent/US12223048B2

## CPC

- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 2221/034: Test or assess a computer or a system
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computer-implemented method, computer program product and computing system for receiving a plurality of detection events concerning a plurality of security events occurring on multiple security-relevant subsystems within one or more computing platforms; storing the plurality of detection events to form an event repository; and processing the event repository using a machine learning model to identify attack patterns defined within the plurality of detection events stored within the event repository, thus defining one or more identified attack patterns.

## Claims

### Claim 1

A computer-implemented method, executed on a computing device, comprising:
monitoring and logging, by multiple security-relevant subsystems, activity with respect to one or more computing platforms;
receiving a plurality of detection events concerning a plurality of security events occurring on the multiple security-relevant subsystems within the one or more computing platforms;
storing the plurality of detection events to form an event repository;
analyzing one or more current detection rules using machine learning;
processing the event repository using a machine learning model to identify attack patterns defined within the plurality of detection events stored within the event repository, thus defining one or more identified attack patterns;
defining a new detection rule based, at least in part, upon the one or more identified attack patterns and the one or more current detection rules, wherein defining the new detection rule includes:
defining a universal rule; and
translating the universal rule into customer specific technology rules;
directly executing the customer specific technology rules on one or more pieces of customer technology;
directly detecting security events on the one or more pieces of customer technology; and
directly executing a remedial action plan via the one or more pieces of customer technology.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1 wherein the plurality of security events includes one or more of:
Denial of Service (DOS) events;
Distributed Denial of Service DDOS events;
Man-in-the-Middle (MitM) events;
phishing events;
Password Attack events;
SQL Injection events;
Cross-Site Scripting (XSS) events;
Insider Threat events;
spamming events;
malware events;
web attacks; and
exploitation events.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1 wherein the security-relevant subsystems include one or more of:
CDN (i.e., Content Delivery Network) systems;
DAM (i.e., Database Activity Monitoring) systems;
UBA (i.e., User Behavior Analytics) systems;
MDM (i.e., Mobile Device Management) systems;
IAM (i.e., Identity and Access Management) systems;
DNS (i.e., Domain Name Server) systems;
Antivirus systems;
operating systems;
data lakes;
data logs;
security-relevant software applications;
security-relevant hardware systems; and
resources external to the computing platform.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1 wherein the one or more computing platforms includes:
a first computing platform of a first client; and
at least a second computer platform of at least a second client.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1 wherein one or more artifacts/log entries are associated with each of the plurality of detection events.

### Claim 6 (depends on 5)

The computer-implemented method of claim 5 wherein processing the event repository using a machine learning model to identify attack patterns defined within the plurality of detection events stored within the event repository includes:
processing the event repository using a machine learning model to identify attack patterns defined within the plurality of detection events and their associated artifacts/log entries stored within the event repository.

### Claim 7 (depends on 1)

The computer-implemented method of claim 1 further comprising:
soliciting human feedback concerning the one or more identified attack patterns; and
utilizing the human feedback to train the machine learning model.

### Claim 8 (depends on 1)

The computer-implemented method of claim 1 further comprising:
modifying an existing detection rule based, at least in part, upon the one or more identified attack patterns.

### Claim 9 (depends on 1)

The computer-implemented method of claim 1 further comprising:
initiating an investigation of current activity within the one or more computing platforms based, at least in part, upon the current activity being similar to the one or more identified attack patterns.

### Claim 10

A computer program product residing on a non-transitory computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
monitoring and logging, by multiple security-relevant subsystems, activity with respect to one or more computing platforms;
receiving a plurality of detection events concerning a plurality of security events occurring on the multiple security-relevant subsystems within the one or more computing platforms;
storing the plurality of detection events to form an event repository;
analyzing one or more current detection rules using machine learning;
processing the event repository using a machine learning model to identify attack patterns defined within the plurality of detection events stored within the event repository, thus defining one or more identified attack patterns;
defining a new detection rule based, at least in part, upon the one or more identified attack patterns and the one or more current detection rules, wherein defining the new detection rule includes:
defining a universal rule; and
translating the universal rule into customer specific technology rules;
directly executing the customer specific technology rules on one or more pieces of customer technology;
directly detecting security events on the one or more pieces of customer technology; and
directly executing a remedial action plan via the one or more pieces of customer technology.

### Claim 11 (depends on 10)

The computer program product of claim 10 wherein the plurality of security events includes one or more of:
Denial of Service (DOS) events;
Distributed Denial of Service DDOS events;
Man-in-the-Middle (MitM) events;
phishing events;
Password Attack events;
SQL Injection events;
Cross-Site Scripting (XSS) events;
Insider Threat events;
spamming events;
malware events;
web attacks; and
exploitation events.

### Claim 12 (depends on 10)

The computer program product of claim 10 wherein the security-relevant subsystems include one or more of:
CDN (i.e., Content Delivery Network) systems;
DAM (i.e., Database Activity Monitoring) systems;
UBA (i.e., User Behavior Analytics) systems;
MDM (i.e., Mobile Device Management) systems;
IAM (i.e., Identity and Access Management) systems;
DNS (i.e., Domain Name Server) systems;
Antivirus systems;
operating systems;
data lakes;
data logs;
security-relevant software applications;
security-relevant hardware systems; and
resources external to the computing platform.

### Claim 13 (depends on 10)

The computer program product of claim 10 wherein the one or more computing platforms includes:
a first computing platform of a first client; and
at least a second computer platform of at least a second client.

### Claim 14 (depends on 10)

The computer program product of claim 10 wherein one or more artifacts/log entries are associated with each of the plurality of detection events.

### Claim 15 (depends on 14)

The computer program product of claim 14 wherein processing the event repository using a machine learning model to identify attack patterns defined within the plurality of detection events stored within the event repository includes:
processing the event repository using a machine learning model to identify attack patterns defined within the plurality of detection events and their associated artifacts/log entries stored within the event repository.

### Claim 16 (depends on 10)

The computer program product of claim 10 further comprising:
soliciting human feedback concerning the one or more identified attack patterns; and
utilizing the human feedback to train the machine learning model.

### Claim 17 (depends on 10)

The computer program product of claim 10 further comprising:
modifying an existing detection rule based, at least in part, upon the one or more identified attack patterns.

### Claim 18 (depends on 10)

The computer program product of claim 10 further comprising:
initiating an investigation of current activity within the one or more computing platforms based, at least in part, upon the current activity being similar to the one or more identified attack patterns.

### Claim 19

A computing system including a processor and memory configured to perform operations comprising:
monitoring and logging, by multiple security-relevant subsystems, activity with respect to one or more computing platforms;
receiving a plurality of detection events concerning a plurality of security events occurring on the multiple security-relevant subsystems within the one or more computing platforms;
storing the plurality of detection events to form an event repository;
analyzing one or more current detection rules using machine learning;
processing the event repository using a machine learning model to identify attack patterns defined within the plurality of detection events stored within the event repository, thus defining one or more identified attack patterns;
defining a new detection rule based, at least in part, upon the one or more identified attack patterns and the one or more current detection rules, wherein defining the new detection rule includes:
defining a universal rule; and translating the universal rule into customer specific technology rules;
directly executing the customer specific technology rules on one or more pieces of customer technology;
directly detecting security events on the one or more pieces of customer technology; and
directly executing a remedial action plan via the one or more pieces of customer technology.

### Claim 20 (depends on 19)

The computing system of claim 19 wherein the plurality of security events includes one or more of:
Denial of Service (DOS) events;
Distributed Denial of Service DDOS events;
Man-in-the-Middle (MitM) events;
phishing events;
Password Attack events;
SQL Injection events;
Cross-Site Scripting (XSS) events;
Insider Threat events;
spamming events;
malware events;
web attacks; and
exploitation events.

### Claim 21 (depends on 19)

The computing system of claim 19 wherein the security-relevant subsystems include one or more of:
CDN (i.e., Content Delivery Network) systems;
DAM (i.e., Database Activity Monitoring) systems;
UBA (i.e., User Behavior Analytics) systems;
MDM (i.e., Mobile Device Management) systems;
IAM (i.e., Identity and Access Management) systems;
DNS (i.e., Domain Name Server) systems;
Antivirus systems;
operating systems;
data lakes;
data logs;
security-relevant software applications;
security-relevant hardware systems; and
resources external to the computing platform.

### Claim 22 (depends on 19)

The computing system of claim 19 wherein the one or more computing platforms includes:
a first computing platform of a first client; and
at least a second computer platform of at least a second client.

### Claim 23 (depends on 19)

The computing system of claim 19 wherein one or more artifacts/log entries are associated with each of the plurality of detection events.

### Claim 24 (depends on 23)

The computing system of claim 23 wherein processing the event repository using a machine learning model to identify attack patterns defined within the plurality of detection events stored within the event repository includes:
processing the event repository using a machine learning model to identify attack patterns defined within the plurality of detection events and their associated artifacts/log entries stored within the event repository.

### Claim 25 (depends on 19)

The computing system of claim 19 further comprising:
soliciting human feedback concerning the one or more identified attack patterns; and
utilizing the human feedback to train the machine learning model.

### Claim 26 (depends on 19)

The computing system of claim 19 further comprising:
modifying an existing detection rule based, at least in part, upon the one or more identified attack patterns.

### Claim 27 (depends on 19)

The computing system of claim 19 further comprising:
initiating an investigation of current activity within the one or more computing platforms based, at least in part, upon the current activity being similar to the one or more identified attack patterns.