# US 12,225,043 B2 · Systems and methods for security process analysis > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,043 B2 - Document ID: US12225043B2 - Status: Granted - Kind: B2 - Application number: 18/667,464 - Filed: 2024-05-17 - Published: 2024-11-21 - Granted: 2025-02-11 - Earliest claimed: 2023-05-17 - Assignees: Gutsy.IO, LTD - Applicants: Gutsy.IO, LTD - Inventors: Ben Bernstein; John Morello; Dima Stopel - Web page: https://patentgrep.com/patent/US12225043B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and system for cyber-security processes mining are provided. The method comprises correlating events received from a plurality of data sources into a plurality of flows, wherein a flow of the plurality of flows is a sequence of events having a same identifier, and wherein at least one of the plurality of data sources is a cyber-security system; correlating the plurality of flows into a plurality of variants, wherein a variant out of the plurality of variants includes one or more flows having the same repeatable pattern; associating the plurality of variants with at least one cyber-security process based on a predefined template defining the cyber-security process; and causing a display of the least one cyber-security process and its plurality of variants. ## Claims ### Claim 1 A method for cyber-security processes mining, comprising: correlating events received from a plurality of data sources into a plurality of flows, wherein a flow of the plurality of flows is a sequence of events having a same identifier, and wherein at least one of the plurality of data sources is a cyber-security system; correlating the plurality of flows into a plurality of variants, wherein a variant out of the plurality of variants includes one or more flows having the same repeatable pattern; correlating flows having a repeatable pattern into a variant, wherein a repeatable pattern includes a same number of events of the same type; associating the plurality of variants with at least one cyber-security process based on a predefined template defining the cyber-security process; and causing a display of the least one cyber-security process and its plurality of variants. ### Claim 2 (depends on 1) The method of claim 1, further comprising: tagging a variant of the plurality of variants with at least one of a cyber-security risk. ### Claim 3 (depends on 1) The method of claim 1, further comprising: analyzing variants associated with the least one cyber-security process to determine a target variant, wherein the target variant defines an optimal execution of the process. ### Claim 4 (depends on 1) The method of claim 1, wherein correlating the received events into the plurality of flows further comprises: correlating the received events received from the plurality of data sources into the plurality of flows based on a flow identifier (ID) which is similar to the same identifier of each event in the respective flow; and organizing the received event having the same flow ID in a sequence based on their respective timestamps. ### Claim 5 (depends on 1) The method of claim 1, wherein each variant of the plurality of variants is of flow having a different identifier. ### Claim 6 (depends on 1) The method of claim 1, wherein the data sources further include at least one non-cyber-security system. ### Claim 7 (depends on 6) The method of claim 6, wherein the at least one non-cyber-security system is any one of: a ticking system, a development pipeline platform, a standards system, and a workflow system. ### Claim 8 (depends on 6) The method of claim 6, wherein the at least one cyber-security system is any one of: an intrusion detection system (IDS), an intrusion prevention system (IPS), a data loss prevention (DLP) system, a network security tool, a vulnerability scanner, a cloud vulnerability scanner, a security information and event management (SIEM) system, and a web application firewall (WAF). ### Claim 9 (depends on 1) The method of claim 1, wherein the cyber-security process includes a sequence of steps related to a cyber-security issue. ### Claim 10 (depends on 1) The method of claim 1, further comprising: generating insights related to the plurality of variants of a cyber-security process; and comparing the generated insights to a set of key performance indicators (KPIs). ### Claim 11 A non-transitory computer-readable medium storing a set of instructions for cyber-security processes mining, the set of instructions comprising: one or more instructions that, when executed by one or more processors of a device, cause the device to: correlate events received from a plurality of data sources into a plurality of flows, wherein a flow of the plurality of flows is a sequence of events having a same identifier, and wherein at least one of the plurality of data sources is a cyber-security system; correlate the plurality of flows into a plurality of variants, wherein a variant out of the plurality of variants includes one or more flows having the same repeatable pattern; correlate flows having a repeatable pattern into a variant, wherein a repeatable pattern includes a same number of events of the same type; associate the plurality of variants with at least one cyber-security process based on a predefined template defining the cyber-security process; and cause a display of the least one cyber-security process and its plurality of variants. ### Claim 12 A system for cyber-security processes mining comprising: one or more processors configured to: correlate events received from a plurality of data sources into a plurality of flows, wherein a flow of the plurality of flows is a sequence of events having a same identifier, and wherein at least one of the plurality of data sources is a cyber-security system; correlate the plurality of flows into a plurality of variants, wherein a variant out of the plurality of variants includes one or more flows having the same repeatable pattern; correlate flows having a repeatable pattern into a variant, wherein a repeatable pattern includes a same number of events of the same type; associate the plurality of variants with at least one cyber-security process based on a predefined template defining the cyber-security process; and cause a display of the least one cyber-security process and its plurality of variants. ### Claim 13 (depends on 12) The system of claim 12, wherein the system is further configured to: tag a variant of the plurality of variants with at least one of a cyber-security risk. ### Claim 14 (depends on 12) The system of claim 12, wherein the system is further configured to: analyze variants associated with the least one cyber-security process to determine a target variant, wherein the target variant defines an optimal execution of the process. ### Claim 15 (depends on 12) The system of claim 12, wherein the system is further configured to: correlate the received events received from the plurality of data sources into the plurality of flows based on a flow identifier (ID) which is similar to the same identifier of each event in the respective flow; and organize the received event having the same flow ID in a sequence based on their respective timestamps. ### Claim 16 (depends on 12) The system of claim 12, wherein each variant of the plurality of variants is of flow having a different identifier. ### Claim 17 (depends on 12) The system of claim 12, wherein the data sources further include at least one non-cyber-security system. ### Claim 18 (depends on 17) The system of claim 17, wherein the at least one non-cyber-security system is any one of: a ticking system, a development pipeline platform, a standards system, and a workflow system. ### Claim 19 (depends on 17) The system of claim 17, wherein the at least one cyber-security system is any one of: an intrusion detection system (IDS), an intrusion prevention system (IPS), a data loss prevention (DLP) system, a network security tool, a vulnerability scanner, a cloud vulnerability scanner, a security information and event management (SIEM) system, and a web application firewall (WAF). ### Claim 20 (depends on 12) The system of claim 12, wherein the cyber-security process includes a sequence of steps related to a cyber-security issue.