US 12,587,872 B2Granted

Using orchestrators for false positive detection and root cause analysis

OwnerMark Cummingsinventor

Life of this patent

Estimating the term…

Loading patent…

Abstract

An alert that is generated by a first orchestrator associated with a first subsystem or received from one or more distributed orchestrators that are associated with one or more corresponding subsystems is analyzed. The alert is triggered by a change in behavior determined by a behavioral analysis algorithm associated with the first orchestrator or corresponding behavior analysis algorithms associated with the one or more distributed orchestrators. It is determined whether an alert is indicative of a false positive based on an objective associated with the first orchestrator, an algorithm associated with the first orchestrator and one or more constraints associated with the first orchestrator. The alert is filtered in response to determining that the alert is indicative of the false positive.

Claims18

Dependent claims

A system, comprising:

a processor configured to:
provide from an orchestrator to an artificial intelligence system that is capable of detecting abnormal behavior an output indicating a subsystem is exhibiting the abnormal behavior;
and
in response to a determination of the artificial intelligence system that the subsystem is exhibiting the abnormal behavior:
simulate a result of implementing a remediation including by:
obtaining data from a plurality of orchestrators associated with a system that includes the subsystem, wherein the orchestrator is included in the plurality of orchestrators;
creating a model of the system using the obtained data;
utilizing the model to simulate an interaction between the subsystem and one or more other subsystems, and perform tests on different simulated combinations and permutations;
and
in response to parameters associated with the simulation falling within desired parameters, implementing the remediation,
a memory coupled to the processor and configured to provide the processor with instructions.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/632,121Filed 10 Apr 2024 · continuation
Priority: 14 Jun 2018
Published: US 2024/0406757 A15 Dec 2024
Granted: 24 Mar 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification22 codes

H04W 24/02
Supervisory, monitoring or testing arrangements: arrangements for optimising operational condition
G06F 9/4411
Bootstrapping: configuring for operating with peripheral devices; Loading of device drivers
G06F 11/079
Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of…
G06F 11/0793
Error or fault processing not based on redundancy, i.e. by taking additional measures to deal with the error or fault not making use of…

Family

Application16/008,673Parent of this continuation-in-part · filed 14 Jun 2018
Application62/884,292Us provisional application · filed 8 Aug 2019
Application16/898,082Parent of this continuation · filed 10 Jun 2020
US 10,694,402 B2Parent of this continuation-in-part · filed 23 Jun 2020
Application17/893,975Parent of this continuation · filed 23 Aug 2022
US 11,477,667 B2Parent of this continuation · filed 18 Oct 2022
Application18/214,310Parent of this continuation · filed 26 Jun 2023
US 11,729,642 B2Parent of this continuation · filed 15 Aug 2023
US 2024/0406757 A1Pre-grant publication · published 5 Dec 2024
US 11,985,522 B2Parent of this continuation
Application16/898,082Parent of this continuation-in-part
US 2018/0368007 A1Published application
US 2022/0277075 A1Published application
US 2023/0061099 A1Published application
US 2023/0403577 A1Published application
US 12,587,872 B2This patent

From the US filing history. Foreign family members aren’t listed.