Systems and methods for classifying security events as targeted attacks
AssigneeSymantec Corporation
InventorsKevin Alejandro Roundy, Sandeep Bhatkar
Life of this patent
Estimating the term…
Abstract
The disclosed computer-implemented method for classifying security events as targeted attacks may include (1) detecting a security event in connection with at least one organization, (2) comparing the security event against a targeted-attack taxonomy that identifies a plurality of characteristics of targeted attacks, (3) determining that the security event is likely targeting the organization based at least in part on comparing the security event against the targeted-attack taxonomy, and then in response to determining that the security event is likely targeting the organization, (4) classifying the security event as a targeted attack. Various other methods, systems, and computer-readable media are also disclosed.
Claims20
A computer-implemented method for classifying security events as targeted attacks, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
- detecting at least one security event in connection with at least one organization;
- comparing the security event against a targeted-attack taxonomy that identifies a plurality of characteristics of targeted attacks;
- determining, based at least in part on comparing the security event against the targeted-attack taxonomy, that the security event is likely targeting the organization;
- in response to determining that the security event is likely targeting the organization, classifying the security event as a targeted attack.
A system for classifying security events as targeted attacks, the system comprising:
- a detection module, stored in memory, that detects a security event in connection with at least one organization;
- a determination module, stored in memory, that:
- compares the security event against a targeted-attack taxonomy that identifies a plurality of characteristics of targeted attacks;
- determines, based at least in part on comparing the security event against the targeted-attack taxonomy, that the security event is likely targeting the organization;
- a classification module, stored in memory, that classifies the security event as a targeted attack in response to the determination that the security event is likely targeting the organization;
- at least one processor that executes the detection module, the determination module, and the classification module.
A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
- detect a security event in connection with at least one organization;
- compare the security event against a targeted-attack taxonomy that identifies a plurality of characteristics of targeted attacks;
- determine, based at least in part on comparing the security event against the targeted-attack taxonomy, that the security event is likely targeting the organization;
- in response to determining that the security event is likely targeting the organization, classify the security event as a targeted attack.
Dependencies are inferred from the claim text.