# US 12,764,141 B2 · Adaptive system for network and security management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,764,141 B2
- Document ID: US12764141B2
- Status: Granted
- Kind: B2
- Application number: 18/326,861
- Filed: 2023-05-31
- Published: 2023-12-07
- Granted: 2026-10-13
- Earliest claimed: 2022-06-03
- Assignees: Netenrich, Inc.
- Applicants: Netenrich, Inc.
- Inventors: Praveen Hebbagodi; Christopher Morales
- Web page: https://patentgrep.com/patent/US12764141B2

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 16/285: {Clustering or classification}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Systems and methods are described for identifying computer risks. A system may receive a set of input signals from third-party sources. The system may identify computer risks based on the input signals using a hypothesis generation component. The hypothesis generation component may be designed to identify computer risk based on a current state of a network environment, changes to a risk profile, and critical attack path predictions. The hypothesis generation component may also be designed to evaluate the identified computer risks to prioritize the computer risks, identify a threat hunting hypothesis for each type of risk, and identify migration techniques for the prioritized risks.

## Claims

### Claim 1

A system for identifying computer risks, the system configured to:
receive inputs from various third-party sources, including streaming data and historical data; and
identify a plurality of computer risks based on the received inputs using a hypothesis generation component, wherein the hypothesis generation is designed to:
identify at least one computer risk of the plurality of computer risks as a first computer risk based on a current state of a network environment associated with observed inputs;
identify at least one computer risk of the plurality of computer risks as a second computer risk based on changes to a risk profile of entry points and known vulnerabilities of the network environment;
identify at least one computer risk of the plurality of computer risks as a third computer risk based on critical attack path predictions that cross a predetermined threshold; and
evaluate the identified first computer risk, second computer risk and third computer risk using the hypothesis generation component to:
prioritize the identified first computer risk, second computer risk and third computer risk against other identified risks based on risk scores;
identify threat hunting hypotheses for each type of identified risk; and
identify mitigation techniques for the prioritized first computer risk, second computer risk and third computer risk.

### Claim 2 (depends on 1)

The system as recited in claim 1, wherein the system is further configured to identify prioritized risks resulting from observed attack signals.

### Claim 3 (depends on 2)

The system as recited in claim 2, further comprising a threat hunting model that generates hypotheses characterized by:
breaking down a likelihood of an attack from a risk model into a sequential set of hunting steps; and
providing reasoning behind the likelihood and impact of each step; and
generating threat hunting queries and providing information.

### Claim 4 (depends on 3)

The system as recited in claim 3, wherein the threat hunting model is based on:
examining a number of attack steps and their position in at least one of an attack flow or kill chain;
identifying any existing weaknesses in impacted assets and providing steps to confirm possible exploitation of those weaknesses and gather evidence;
measuring propagation of the attack and providing threat hunting steps for gathering evidence of propagation; and
examining a last observed attack step on a target and providing steps for confirming the observed attack and gathering evidence.

### Claim 5 (depends on 3)

The system as recited in claim 3, wherein the system is configured to utilize large language models in a preferred language of a user to generate the reasoning and threat hunting steps in natural language.

### Claim 6 (depends on 5)

The system as recited in claim 5, wherein the system is configured to generate threat hunting queries for each step using query languages specific to a third-party monitoring systems.

### Claim 7 (depends on 6)

The system as recited in claim 6, wherein the system is configured to generate threat hunting queries that incorporate detection techniques corresponding to a set of defined techniques and one or more impacted entities.

### Claim 8 (depends on 6)

The system as recited in claim 6, wherein the system is configured to generate threat hunting queries that incorporate any identified characterized weaknesses in the system.

### Claim 9 (depends on 8)

The system as recited in claim 8, wherein the characterized weaknesses include at least one of entry points, choke points and targets identified by an identifier corresponding to a defined technique for characterizing a specific vulnerability or exposure.

### Claim 10

A computer-implemented method for identifying computer risks, comprising:
receiving inputs from various third-party sources, including streaming data and historical data; and
identifying computer risks based on the received inputs using a hypothesis generation component, wherein the hypothesis generation is designed to:
identify a first computer risk based on a current state of a network environment associated with observed inputs;
identify a second computer risk based on changes to a risk profile of entry points and known vulnerabilities of the network environment;
identify a third computer risk based on critical attack path predictions that cross a predetermined threshold; and
evaluating the identified first, second and third computer risks using the hypothesis generation component.

### Claim 11 (depends on 10)

The computer-implemented method as recited in claim 10, wherein the hypothesis generation component is configured to:
prioritize the computer risks against other identified risks based on risk scores;
identify threat hunting hypotheses for each type of risk; and
identify mitigation techniques for the prioritized risks.

### Claim 12 (depends on 10)

The computer-implemented method as recited in claim 10, further comprising identifying prioritized risks resulting from observed attack signals.

### Claim 13 (depends on 12)

The computer-implemented method as recited in claim 12, further comprising implementing a system of a threat hunting model that generates hypotheses characterized by:
breaking down a likelihood of an attack from a risk model into a sequential set of hunting steps; and
providing reasoning behind the likelihood and impact of each step; and
generating threat hunting queries and providing information.

### Claim 14 (depends on 13)

The computer-implemented method as recited in claim 13, wherein the threat hunting model is based on:
examining a number of attack steps and their position in at least one of an attack flow or kill chain;
identifying any existing weaknesses in impacted assets and providing steps to confirm possible exploitation of those weaknesses and gather evidence;
measuring propagation of the attack and providing threat hunting steps for gathering evidence of propagation; and
examining a last observed attack step on a target and providing steps for confirming the observed attack and gathering evidence.

### Claim 15 (depends on 13)

The computer-implemented method as recited in claim 13, wherein the system of the threat hunting model is configured to utilize large language models in a preferred language of a user to generate the reasoning and threat hunting steps in natural language.

### Claim 16 (depends on 15)

The computer-implemented method as recited in claim 15, wherein the system is configured to generate threat hunting queries for each step using query languages specific to third-party monitoring systems.

### Claim 17 (depends on 16)

The computer-implemented method as recited in claim 16, wherein the system is configured to generate threat hunting queries that incorporate a detection techniques corresponding to a set of defined techniques and one or more impacted entities.

### Claim 18 (depends on 16)

The computer-implemented method as recited in claim 16, wherein the system is configured to generate threat hunting queries that incorporate any identified characterized weaknesses in the system.

### Claim 19 (depends on 18)

The computer-implemented method as recited in claim 18, wherein the characterized weaknesses include at least one of entry points, choke points and targets identified by an identifier corresponding to a defined technique for characterizing a specific vulnerability or exposure.

### Claim 20

A computer-implemented method for identifying computer risks, comprising:
receiving inputs from various third-party sources, including streaming data and historical data;
identifying computer risks based on the received inputs using a hypothesis generation component, by:
identifying at least one first computer risk based on a current state of a network environment associated with observed inputs;
identifying at least one second computer risk based on changes to a risk profile of entry points and known vulnerabilities of the network environment;
identifying at least one third computer risk based on critical attack path predictions that cross a predetermined threshold; and
evaluating the identified first computer risk, second computer risk and third computer risk using the hypothesis generation component by:
prioritizing the identified first computer risk, second computer risk, and third computer risk against other identified risks based on risk scores;
identifying threat hunting hypotheses for the prioritized first computer risk, second computer risk and third computer risk.