Methods and systems for categorizing cyber incident logs featuring dynamic relationships to pre-existing cyber incident reports in real-time
AssigneeCapital One Services, LLC
InventorsVivek Datla, Isha Chaturvedi, Anirban Das
Life of this patent
Estimating the term…
Abstract
Systems and methods for the creation of human-readable cyber incident reports from cyber incident logs, in which the cyber incident reports may link cyber incidents recorded in a cyber incident log to the existing knowledge sources. To do so, the systems and methods overcome the technical problems of conventional systems as well as the technical problems inherent in adapting artificial intelligence solutions to the creation of cyber incident reports.
Claims20
A system for categorizing cyber incident logs featuring dynamic relationships to pre-existing cyber incident reports in real-time, the system comprising:
- one or more processors;
- and
- one or more non-transitory, computer-readable media comprising instructions that, when executed by the one or more processors, cause operations comprising:
- receiving a cyber incident log, wherein the cyber incident log relates to a recorded cyber incident, and wherein the cyber incident log includes a plurality of log sections;
- determining a log section of the plurality of log sections that has a log section characteristic, wherein the log section characteristic is indicative of the log section comprising one or more cyber incident characteristics;
- parsing the log section for a cyber incident characteristic and mapping data, wherein the mapping data describes a relationship of the log section to the plurality of log sections;
- generating a cyber incident log map for the log section based on the mapping data;
- generating a feature input based on the cyber incident log map and the cyber incident characteristic;
- inputting the feature input into a first model, wherein the first model is trained to determine similarities between one or more of a plurality of historic cyber incident reports and inputted feature inputs;
- determining, based on a first output of the first model, a cyber incident report type corresponding to the cyber incident log;
- inputting the feature input and the cyber incident report type into a second model, wherein the second model is trained to generate cyber incident reports based on cyber incident report types;
- determining, based on a second output of the second model, a cyber incident report;
- and
- adding the cyber incident report to a plurality of cyber incident reports stored at a data source.
A method for categorizing cyber incident logs featuring dynamic relationships to pre-existing cyber incident reports in real-time, the method comprising:
- receiving a cyber incident log, wherein the cyber incident log includes a plurality of log sections;
- determining a log section of the plurality of log sections that has a log section characteristic, wherein the log section characteristic is indicative of the log section comprising one or more cyber incident characteristics;
- parsing the log section for a cyber incident characteristic and mapping data, wherein the mapping data describes a relationship of the log section to the plurality of log sections;
- generating a cyber incident log map for the log section based on the mapping data;
- generating a feature input based on the cyber incident log map and the cyber incident characteristic;
- inputting the feature input into a model to generate an output, wherein the model is trained to determine similarities between one or more of a plurality of cyber incident reports and inputted feature inputs;
- and
- generating for display, in a user interface of a user device of a user, based on the output of the model, a cyber incident report, wherein the cyber incident report corresponds to the cyber incident log.
One or more non-transitory, computer-readable media comprising instructions that, when executed by one or more processors, cause operations comprising:
- receiving a cyber incident log, wherein the cyber incident log includes a plurality of log sections;
- determining a log section of the plurality of log sections that has a log section characteristic, wherein the log section characteristic is indicative of the log section comprising one or more cyber incident characteristics;
- parsing the log section for a cyber incident characteristic and mapping data, wherein the mapping data describes a relationship of the log section to the plurality of log sections;
- generating a cyber incident log map for the log section based on the mapping data;
- inputting the cyber incident log map and the cyber incident characteristic into a model to generate an output, wherein the model is trained to determine similarities between one or more of a plurality of cyber incident reports and inputted feature inputs;
- and
- generating, based on the output, a cyber incident report, wherein the cyber incident report corresponds to the cyber incident log.
Dependencies are inferred from the claim text.