# US 2017/0026391 A1 · System and method for the automated detection and prediction of online threats

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2017/0026391 A1
- Document ID: US20170026391A1
- Status: Published application
- Kind: A1
- Application number: 14/807,827
- Filed: 2015-07-23
- Published: 2017-01-26
- Earliest claimed: 2015-07-23
- Assignees: Seclytics, Inc.
- Inventors: Saeed Abu-Nimeh
- Web page: https://patentgrep.com/patent/US20170026391A1

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 16/24578: {using ranking}
- G06F 16/285: {Clustering or classification}
- G06F 21/552: {involving long-term monitoring or reporting}
- H04L 63/1433: {Vulnerability analysis}
- G06N 20/00: Machine learning
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

A method for monitoring online security threats comprising of a machine-learning service that receives data related to a plurality of features related to internet traffic metrics, the service then processes said data by performing operations selected from among: an operation of ranking at least one feature, an operation of classifying at least one feature, an operation of predicting at least one feature, and an operation of clustering at least one feature, and as a result the machine learning service outputs metrics that aid in the detection, identification, and prediction of an attack.

## Claims

### Claim 1

A method for monitoring online security threats comprising;
receiving data related to a plurality of features by a machine-learning service, wherein the received data comprises of internet traffic metrics;
generating an output by the machine-learning service performing a machine-learning operation on at least one feature of the plurality of features, wherein the machine-learning operation is selected from among:
an operation of ranking at least one feature, an operation of classifying at least one feature, an operation of predicting at least one feature, and an operation of clustering at least one feature, wherein the output comprises detection, identification, and prediction of an attack; and
sending the output from the machine-learning service.

### Claim 2 (depends on 1)

The method of claim 1 wherein the received data related to a plurality of internet traffic metrics comprises of at least one among: Threat feeds, DNS Logs, HTTP Logs, HTML Webpages, Malware Payload, Malware Sandbox, Syslogs, PCAPs, and RIR information.

### Claim 3 (depends on 1)

The method of claim 1 wherein the machine learning service is executing on a cloud platform.

### Claim 4 (depends on 3)

The method of claim 3 wherein the machine learning service is interfaced via an Application Programming Interface (API).

### Claim 5 (depends on 3)

The method of claim 3 wherein the machine learning service revives multiple threat feeds from multiple client users respectively,
the multiple threat feeds are aggregated and processed by the machine learning service,
the machine learning service's output is categorized into groups based on the threat feed sent by each respective client user, and
the grouped output is sent to the respective client user.

### Claim 6 (depends on 1)

The method of claim 1, wherein for the step of classifying the received data further comprising;
extracting a set of meta information from the threat data; extracting a set of features from the meta information;
clustering the set of features based on network size; and building a model of cluster classifiers.

### Claim 7 (depends on 6)

The method of claim 6 wherein, the set of meta information comprises of at least one among: a time series, URLs, Domains, attack Category, Threat Feed, Payload Analysis, BGP Extraction.

### Claim 8 (depends on 6)

The method of claim 6 wherein, the set of features comprises of at least one among: queuing based features, URL based features, domain based features, and BGP based features.

### Claim 9 (depends on 8)

The method of claim 8 wherein the queuing based features comprises of a network infection utilization which is calculated by taking the ratio between an infection arrival rate and an infection service rate.

### Claim 10 (depends on 6)

The method of claim 6 the set of meta information comprises of at least one among: new IP assignments, new IP allocations, new IP re-assignments, and new IP re-allocations.

### Claim 11 (depends on 6)

The method of claim 6 wherein, the set of features comprises of at least one of contact entropy based features and pDNS based features.