Back to results
US 2018/0295154 A1Published application
Application of advanced cybersecurity threat mitigation to rogue devices, privilege escalation, and risk-based vulnerability and patch management
AssigneeQomplx LLC
InventorsJason Crabtree, Andrew Sellers, Daniel Fricano, Rajat Gupta, Ian MacLeod
Life of this patent
Estimating the term…
Abstract
A system for mitigation of cyberattacks employing an advanced cyber decision platform comprising a time series data store, a directed computational graph module, an action outcome simulation module, and observation and state estimation module, wherein the state of a network is monitored and used to produce a cyber-physical graph representing network resources, simulated network events are produced and monitored, and the network events and their effects are analyzed to produce security recommendations.
Claims10
An advanced cyber decision platform for mitigation of cyberattacks, the platform comprising:
- a time series data store comprising at least a processor, a memory, and a plurality of programming instructions stored in the memory and operating on the processor, wherein the programmable instructions, when operating on the processor, cause the processor to”
- monitor a plurality of network events;
- produce time-series data comprising at least a record of a network event and the time at which the event occurred;
- an observation and state estimation module comprising at least a processor, a memory, and a plurality of programming instructions stored in the memory and operating on the processor, wherein the programmable instructions, when operating on the processor, cause the processor to:
- monitor a plurality of connected resources on a network;
- produce a cyber-physical graph representing at least a portion of the plurality of connected resources, the cyber-physical graph comprising at least the logical relationships between the portion of the plurality of connected resources on the network and the physical relationships between any connected resources that comprise at least a hardware device;
- a directed computational graph module comprising at least a processor, a memory, and a plurality of programming instructions stored in the memory and operating on the processor, wherein the programmable instructions, when operating on the processor, cause the processor to:
- perform a plurality of analysis and transformation operations on at least a portion of the time-series data;
- perform a plurality of analysis and transformation operations on at least a portion of the cyber-physical graph;
- and
- an action-outcome simulation module comprising at least a processor, a memory, and a plurality of programming instructions stored in the memory and operating on the processor, wherein the programmable instructions, when operating on the processor, cause the processor to:
- produce a simulated network event comprising at least a simulated cyberattack;
- produce a plurality of security recommendations based at least in part on the results of analysis performed by the directed computational graph module.
10 more elements
A method for mitigation of cyberattacks employing an advanced cyber decision platform comprising the steps of:
- a) producing, using an observation and state estimation module, a a cyber-physical graph representing at least a portion of the plurality of connected resources, the cyber-physical graph comprising at least the logical relationships between the portion of the plurality of connected resources on the network and the physical relationships between any connected resources that comprise at least a hardware device;
- b) performing, using a directed computational graph module, a plurality of analysis and transformation operations on at least a portion of the cyber-physical graph;
- c) producing, using an action outcome simulation module, a simulated network event comprising at least a simulated cyberattack;
- d) monitoring, using a time series data store, a plurality of network events comprising at least the simulated cyberattack;
- e) producing time-series data based at least in part on the network events;
- f) performing a plurality of analysis and transformation operations on at least a portion of the time-series data;
- and
- g) producing a plurality of security recommendations based at least in part on the results of analysis performed by the directed computational graph module.
5 more elements
A method for mitigation of cyberattacks employing an advanced cyber decision platform comprising the steps of:
- a) continuously monitoring the network for server access requests using digital signatures;
- b) analysis of the access requests for threats to the network using machine learning algorithms to analyze system-wide data;
- c) automatic blocking of the device's access to the network if a threat is detected, and notification of the threat to the system administrator, along with contextually-based, tactical recommendations for optimal response based on potential impact.
A method for mitigation of cyberattacks employing an advanced cyber decision platform comprising the steps of:
- a) continuously monitoring the network for devices connected to the network of which the system administrator may be unaware (i.e., “rogue devices”);
- b) analysis of the rogue devices for threats to the network using machine learning algorithms to analyze system-wide data;
- c) automatic blocking of access to the server if a threat is detected, and notification of the threat to the system administrator, along with contextually-based, tactical recommendations for optimal response based on potential impact.
A method for mitigation of cyberattacks employing an advanced cyber decision platform comprising the steps of:
- a) continuously gathering network vulnerability and software patch data from both sources external to the network and internal to the network;
- b) analysis of the gathered data for threats to the network using machine learning algorithms to analyze system-wide data;
- c) notification of the threat to the system administrator, along with contextually-based, tactical recommendations for optimal response based on potential impact.
Dependencies are inferred from the claim text.