Cyber security analytics architecture
AssigneeBank of America Corporation
InventorsIgor A. Baikalov, Craig Froelich, Terry McConnell, John P. McGloughlin, JR.
Life of this patent
Estimating the term…
Abstract
Systems and methods are disclosed for responding to security events in real time. The disclosed systems and methods utilize the vast amount of risk and asset knowledge collected in a security data warehouse and aggregated in a security information manager, without the expense and latency associated with performing such calculations in real time. The disclosed systems and methods, thereby, significantly extend the time intervals feasible for temporal analysis.
Claims20
A computer-implemented method, comprising:
- transferring, at a security event manager, data to a security data warehouse;
- comparing the data, at the security data warehouse, to information stored in a risk ontology, wherein the comparing is performed to determine whether the data should be transferred to a security information manager;
- receiving, at the security information manager, the data when the security data warehouse determines that the data should be transferred to the security information manager;
- comparing, at the security information manager, the data to stored rules and other stored information to determine a security context;
- transferring, at the security information manager, the security context to the security event manager, wherein the security context allows the security event manager to determine an event's risk level;
- receiving, at the security event manager, an event;
- and
- outputting, at the security event manager, the event's risk level.
A non-transitory computer-readable storage medium having computer-executable program instructions stored thereon that, when executed by a processor, cause the processor to:
- transfer, at a security event manager, data to a security data warehouse;
- compare the data, at the security data warehouse, to information stored in a risk ontology, wherein the comparison is performed to determine whether the data should be transferred to a security information manager;
- receive, at the security information manager, the data when the security data warehouse determines that the data should be transferred to the security information manager;
- compare, at the security information manager, the data to stored rules and other stored information to determine a security context;
- transfer, at the security information manager, the security context to the security event manager, wherein the security context allows the security event manager to determine an event's risk level;
- receive, at a security event manager, data associated with an event;
- and
- output, at the security event manager, the event's risk level.
A system comprising:
- a security event manager configured to monitor and respond to real-time events;
- a security data warehouse configured to receive and store data in its original form, wherein the security data warehouse receives data from the security event manager, assets, monitoring, threat analysis, and External event sources;
- a risk ontology configured to provide a sustainable data model representing assets, relationships, and risk factors;
- and
- a security information manager configured to provide a description of an enterprise's risk landscape by gathering, combining, and rationalizing all of the asset, risk, and relationship data in the enterprise.
Dependencies are inferred from the claim text.