# US 12,762,233 B2 · Selectively prioritizing alerts received for an advanced cybersecurity threat prioritization system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,762,233 B2
- Document ID: US12762233B2
- Status: Granted
- Kind: B2
- Application number: 18/369,030
- Filed: 2023-09-15
- Published: 2025-03-20
- Granted: 2026-10-13
- Earliest claimed: 2023-09-15
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Aankur Bhatia; Namrata Tolani; Erin Hwang; Abhishek Basu; Ajmeera Balaji Naik; Ikenna Precious Chima; Oleksandr Shmaliy; Adrian Mahjour
- Web page: https://patentgrep.com/patent/US12762233B2

## CPC

- G06F 21/564: {by virus signature recognition}
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 2221/034: Test or assess a computer or a system
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A computer-implemented method, according to one approach includes having a historical risk score generated for a current cybersecurity event in response to detecting the current cybersecurity event. A sigma rule detection score is also generated for the current cybersecurity event, in addition to an anomaly risk score that is generated for the current cybersecurity event. An IoC score is further generated for the current cybersecurity event. A machine learning model is used to evaluate the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score. The machine learning model is also used to create a consolidated risk score corresponding to: the current cybersecurity event, the consolidated risk score incorporating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score.

## Claims

### Claim 1

A computer-implemented method, comprising, in response to detecting a current cybersecurity event:
causing a historical risk score to be generated for the current cybersecurity event, wherein the current cybersecurity event comprises a real-time event impacting availability of information assets belonging to an organization accessed through a network;
causing a sigma rule detection score to be generated for the current cybersecurity event;
causing an anomaly risk score to be generated for the current cybersecurity event;
causing an Indicator of Compromise (IoC) score to be generated for the current cybersecurity event; and
using a machine learning model to:
evaluate the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score to determine a predicted threat of impact on the information assets, and
create a consolidated risk score corresponding to weighted values for: the current cybersecurity event, the consolidated risk score incorporating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score based on the predicted threat of impact.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein causing the historical risk score to be generated for the current cybersecurity event includes:
using a second machine learning model to compare the current cybersecurity event to historical cybersecurity events; and
determining the historical risk score based at least in part on the comparison and the comparing corresponding responses to the historical cybersecurity events.

### Claim 3 (depends on 2)

The computer-implemented method of claim 2, wherein determining the historical risk score includes:
applying a time decay to the historical cybersecurity events and the corresponding responses.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, wherein causing the sigma rule detection score to be generated for the current cybersecurity event includes:
identifying a number of rules that have been fired as a result of the current cybersecurity event;
determining a risk score based at least in part on the number of fired rules; and
normalizing the determined risk score.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, wherein causing the anomaly risk score to be generated for the current cybersecurity event includes:
inspecting information associated with the current cybersecurity event;
identifying anomalies in the information; and
determining a numeric value for each of the anomalies, the numeric values indicating an amount that the respective anomaly deviates from a majority of the information associated with the current cybersecurity event.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, wherein causing the IoC score to be generated for the current cybersecurity event includes:
inspecting information associated with the current cybersecurity event;
identifying one or more types of IoCs in the information;
comparing the identified IoCs to information associated with historical cybersecurity events; and
determining the IoC score based at least in part on overlaps between the identified IoCs and the information associated with the historical cybersecurity events,
wherein the one or more types of IoCs identified in the information are determined based on the current cybersecurity event.

### Claim 7 (depends on 1)

The computer-implemented method of claim 1, wherein using the machine learning model to create the consolidated risk score includes:
generating a weighted value for each of: the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score;
applying the weighted values to the respective historical risk score, sigma rule detection score, anomaly risk score, and IoC score; and
combining the weighted historical risk score, the weighted sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score to form the consolidated risk score.

### Claim 8 (depends on 7)

The computer-implemented method of claim 7, wherein the machine learning model is trained using random forest classifiers and/or permutation importance algorithms to generate weighted values for each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score.

### Claim 9 (depends on 1)

The computer-implemented method of claim 1, wherein the historical risk score, the sigma rule detection score, and the anomaly risk score are generated by an advanced threat prioritization system having a historical risk score module configured to generate the historical risk score, a sigma rule detection score module configured to generate the sigma rule detection score, an anomaly risk score module configured to generate the anomaly risk score, and an IoC score module configured to generate the IoC score.

### Claim 10

A computer program product, comprising a computer readable storage medium having program instructions embodied therewith, the program instructions readable by a processor, executable by the processor, or readable and executable by the processor, to cause the processor to, in response to detecting a current cybersecurity event:
cause a historical risk score to be generated for the current cybersecurity event, wherein the current cybersecurity event comprises a real-time event impacting availability of information assets belonging to an organization accessed through a network;
cause a sigma rule detection score to be generated for the current cybersecurity event;
cause an anomaly risk score to be generated for the current cybersecurity event;
cause an Indicator of Compromise (IoC) score to be generated for the current cybersecurity event; and
use a machine learning model to:
evaluate the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score to determine a predicted threat of impact on the information assets, and
create a consolidated risk score corresponding to weighted values for: the current cybersecurity event, the consolidated risk score incorporating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score based on the predicted threat of impact.

### Claim 11 (depends on 10)

The computer program product of claim 10, wherein causing the historical risk score to be generated for the current cybersecurity event includes:
using a second machine learning model to compare the current cybersecurity event to historical cybersecurity events; and
determining the historical risk score based at least in part on comparing corresponding responses to the historical cybersecurity events.

### Claim 12 (depends on 11)

The computer program product of claim 11, wherein determining the historical risk score includes:
applying a time decay to the historical cybersecurity events and the corresponding responses.

### Claim 13 (depends on 10)

The computer program product of claim 10, wherein causing the sigma rule detection score to be generated for the current cybersecurity event includes:
identifying a number of rules that have been fired as a result of the current cybersecurity event;
determining a risk score based at least in part on the number of fired rules; and
normalizing the determined risk score.

### Claim 14 (depends on 10)

The computer program product of claim 10, wherein causing the anomaly risk score to be generated for the current cybersecurity event includes:
inspecting information associated with the current cybersecurity event;
identifying anomalies in the information; and
determining a numeric value for each of the anomalies, the numeric values indicating an amount that the respective anomaly deviates from a majority of the information associated with the current cybersecurity event.

### Claim 15 (depends on 10)

The computer program product of claim 10, wherein causing the IoC score to be generated for the current cybersecurity event includes:
inspecting information associated with the current cybersecurity event;
identifying one or more types of IoCs in the information;
comparing the identified IoCs to information associated with historical cybersecurity events; and
determining the IoC score based at least in part on overlaps between the identified IoCs and the information associated with the historical cybersecurity events,
wherein the one or more types of IoCs identified in the information are determined based on the current cybersecurity event.

### Claim 16 (depends on 10)

The computer program product of claim 10, wherein using the machine learning model to create the consolidated risk score includes:
generating a weighted value for each of: the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score;
applying the weighted values to the respective historical risk score, sigma rule detection score, anomaly risk score, and IoC score; and
combining the weighted historical risk score, the weighted sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score to form the consolidated risk score.

### Claim 17 (depends on 16)

The computer program product of claim 16, wherein the machine learning model is trained using random forest classifiers and/or permutation importance algorithms to generate weighted values for each of the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score.

### Claim 18

An advanced threat prioritization system, comprising:
a processor; and
logic integrated with the processor, executable by the processor, or integrated with and executable by the processor, the logic being configured to, in response to detecting a current cybersecurity event:
cause a historical risk score to be generated for the current cybersecurity event, wherein the current cybersecurity event comprises a real-time event impacting availability of information assets belonging to an organization accessed through a network;
cause a sigma rule detection score to be generated for the current cybersecurity event;
cause an anomaly risk score to be generated for the current cybersecurity event;
cause an Indicator of Compromise (IoC) score to be generated for the current cybersecurity event; and
use a machine learning model to:
evaluate the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score to determine a predicted threat of impact on the information assets, and
create a consolidated risk score corresponding to weighted values for: the current cybersecurity event, the consolidated risk score incorporating the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score based on the predicted threat of impact.

### Claim 19 (depends on 18)

The advanced threat prioritization system of claim 18, wherein causing the historical risk score to be generated for the current cybersecurity event includes:
using a second machine learning model to compare the current cybersecurity event to historical cybersecurity events; and
determining the historical risk score based at least in part on comparing corresponding responses to the historical cybersecurity events,
wherein comparing the current cybersecurity event to the historical cybersecurity events includes comparing features selected from the group consisting of: log severity scores, model escalation probabilities, rare scores, and observable scores.

### Claim 20 (depends on 18)

The advanced threat prioritization system of claim 18, wherein causing the sigma rule detection score to be generated for the current cybersecurity event includes:
identifying a number of rules that have been fired as a result of the current cybersecurity event;
determining a risk score based at least in part on the number of fired rules; and
normalizing the determined risk score.

### Claim 21 (depends on 18)

The advanced threat prioritization system of claim 18, wherein causing the anomaly risk score to be generated for the current cybersecurity event includes:
inspecting information associated with the current cybersecurity event;
identifying anomalies in the information; and
determining a numeric value for each of the anomalies, the numeric values indicating an amount that the respective anomaly deviates from a majority of the information associated with the current cybersecurity event.

### Claim 22 (depends on 18)

The advanced threat prioritization system of claim 18, wherein causing the IoC score to be generated for the current cybersecurity event includes:
inspecting information associated with the current cybersecurity event;
identifying one or more types of IoCs in the information;
comparing the identified IoCs to information associated with historical cybersecurity events; and
determining the IoC score based at least in part on overlaps between the identified IoCs and the information associated with the historical cybersecurity events,
wherein the one or more types of IoCs identified in the information are determined based on the current cybersecurity event.

### Claim 23 (depends on 18)

The advanced threat prioritization system of claim 18, wherein using the machine learning model to create the consolidated risk score includes:
generating a weighted value for each of: the historical risk score, the sigma rule detection score, the anomaly risk score, and the IoC score;
applying the weighted values to the respective historical risk score, sigma rule detection score, anomaly risk score, and IoC score; and
combining the weighted historical risk score, the weighted sigma rule detection score, the weighted anomaly risk score, and the weighted IoC score to form the consolidated risk score.