System and Method for Vendor Agnostic Automatic Supplementary Intelligence Propagation
AssigneeSecureworks Corp.
InventorsLewis I. McLean, Angus W. Smithson
Life of this patent
Estimating the term…
Abstract
An information handling system includes a storage and a processor. The storage is configured to store network activity logs from a first client system and a second client system. The processor is configured to receive a security alert from the first client system, analyze the security alert to obtain a plurality of indicators, utilize the supplementary indicators to build a statistical security model, and analyze activity on the second client system using the statistical security model to identify an additional security events.
Claims20
An information handling system comprising:
- a storage device configured to store network activity logs from a first client system and a second client system;
- and
- a processor configured to:
- receive a security alert from the first client system;
- analyze the security alert to obtain a plurality of supplementary indicators;
- utilize the supplementary indicators to build a statistical security model;
- and
- analyze activity on the second client system using the statistical security model to identify an additional security event.
A method for automated malware analysis, comprising:
- receiving alerts of one or more security events from a first set of client systems;
- analyzing the security event alerts to obtain a plurality of indicators;
- utilizing the indicators to build a statistical security model;
- and
- analyzing activity of a second client system using the statistical security model to identify an additional security event.
A non-transitory computer-readable medium including code that when executed causes a processor to perform a method, the method comprising:
- receiving alerts of one or more security events from a first set of client systems;
- analyzing the security event alerts to obtain a plurality of indicators;
- utilizing the indicators to build a statistical security model;
- and
- analyzing activity of a second client system using the statistical security model to identify an additional security event.
Dependencies are inferred from the claim text.