Correlating distinct events to detect security threats
AssigneeFortinet, Inc.
InventorsMichael A. Bentley, George C. Caragea, Yijou Chen
Life of this patent
Estimating the term…
Abstract
Correlating distinct events to detect security threats, including: receiving data describing an event; identifying a plurality of correlated events by correlating, in response to receiving the data describing the event, the event with one or more other events, wherein the one or more other events occurred before the event; determining a severity for the event based on the plurality of correlated events.
Claims20
A method of correlating distinct events to detect security threats, the method comprising:
- receiving data describing an event;
- tagging the event using one or more tags based on a standardized taxonomy for categorizing types of activity, the categorization including top level categories each having multiple sub-categories;
- identifying a plurality of correlated events by correlating, in response to receiving the data describing the event, the event with one or more other events occurring before the event, the correlation being based at least in part on the one or more event tags;
- and
- determining a severity for the event based on the plurality of correlated events, wherein the sub-categories comprise access token manipulation.
A method of correlating distinct events to detect security threats, the method comprising:
- receiving data describing a first plurality of events associated with an entity;
- determining that the first plurality of events satisfies first criteria for correlating the first plurality of events indicated in a first correlation definition;
- and
- generating, in response to the first correlation definition corresponding to a threat incident, a first alert, wherein
- determining that the first plurality of events satisfies the first criteria comprises tagging the first plurality of events based on a standardized taxonomy for categorizing types of activity, the categorization including top level categories each having multiple sub-categories, and
- the first criteria are based on one or more event tags, wherein the sub-categories comprise access token manipulation.
A computer program product for correlating distinct events to detect security threats, the computer program product disposed on a non-transitory computer readable medium, the computer program product including computer program instructions configurable to carry out the steps of:
- receiving data describing a first plurality of events associated with an entity;
- determining that the first plurality of events satisfies first criteria for correlating the first plurality of events indicated in a first correlation definition;
- and
- generating, in response to the first correlation definition corresponding to a threat incident, a first alert, wherein
- determining that the first plurality of events satisfies the first criteria comprises tagging the first plurality of events based on a standardized taxonomy for categorizing types of activity, the categorization including top level categories each having multiple sub-categories, and
- the first criteria are based on one or more event tag, wherein the sub-categories comprise access token manipulation.
Dependencies are inferred from the claim text.