# US 2019/0377876 A1 · Threat mitigation system and method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0377876 A1
- Document ID: US20190377876A1
- Status: Published application
- Kind: A1
- Application number: 16/432,711
- Filed: 2019-06-05
- Published: 2019-12-12
- Earliest claimed: 2018-06-06
- Assignees: Reliaquest Holdings, LLC
- Applicants: ReliaQuest Holdings, LLC
- Inventors: Brian P. Murphy; Joe Partlow; Colin O'Connor; Jason Pfeiffer
- Web page: https://patentgrep.com/patent/US20190377876A1

## CPC

- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 8/65: Updates (security arrangements therefor G06F21/57)
- G06F 18/20: Analysing
- G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 21/554: {involving event detection and direct action}
- G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements
- G06F 21/561: {Virus type analysis}
- G06F 21/562: {Static detection}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/568: {eliminating virus, restoring damaged files}
- G06F 30/20: Design optimisation, verification or simulation (optimisation, verification or simulation of circuit designs G06F30/30)
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- G06N 20/00: Machine learning
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/0263: {Rule management}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L 63/164: {at the network layer}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 2221/034: Test or assess a computer or a system
- G06F 2221/2115: Third party
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computer-implemented method, computer program product and computing system for: detecting a security event within a computing platform based upon identified suspect activity; gathering artifacts concerning the security event; and assigning a threat level to the security event based, at least in part, upon the gathered artifacts.

## Claims

### Claim 1

A computer-implemented method, executed on a computing device, comprising:
detecting a security event within a computing platform based upon identified suspect activity;
gathering artifacts concerning the security event; and
assigning a threat level to the security event based, at least in part, upon the gathered artifacts.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1 wherein detecting a security event within a computing platform based upon identified suspect activity includes:
monitoring a plurality of sources to identify suspect activity within the computing platform.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1 wherein gathering artifacts concerning the security event includes:
gathering artifacts concerning the security event from a plurality of sources associated with the computing platform.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1 wherein assigning a threat level to the security event includes:
assigning a threat level using artificial intelligence/machine learning.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1 further comprising:
executing a remedial action plan based, at least in part, upon the assigned threat level.

### Claim 6 (depends on 5)

The computer-implemented method of claim 5 wherein executing a remedial action plan includes:
allowing the suspect activity to continue.

### Claim 7 (depends on 5)

The computer-implemented method of claim 5 wherein executing a remedial action plan includes:
generating a security event report based, at least in part, upon the gathered artifacts, and
providing the security event report to an analyst for further review.

### Claim 8 (depends on 5)

The computer-implemented method of claim 5 wherein executing a remedial action plan includes:
autonomously executing a threat mitigation plan.

### Claim 9 (depends on 1)

The computer-implemented method of claim 1 further comprising:
allowing a third-party to manually search for artifacts.

### Claim 10

A computer program product residing on a computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
detecting a security event within a computing platform based upon identified suspect activity;
gathering artifacts concerning the security event; and
assigning a threat level to the security event based, at least in part, upon the gathered artifacts.

### Claim 11 (depends on 10)

The computer program product of claim 10 wherein detecting a security event within a computing platform based upon identified suspect activity includes:
monitoring a plurality of sources to identify suspect activity within the computing platform.

### Claim 12 (depends on 10)

The computer program product of claim 10 wherein gathering artifacts concerning the security event includes:
gathering artifacts concerning the security event from a plurality of sources associated with the computing platform.

### Claim 13 (depends on 10)

The computer program product of claim 10 wherein assigning a threat level to the security event includes:
assigning a threat level using artificial intelligence/machine learning.

### Claim 14 (depends on 10)

The computer program product of claim 10 further comprising:
executing a remedial action plan based, at least in part, upon the assigned threat level.

### Claim 15 (depends on 14)

The computer program product of claim 14 wherein executing a remedial action plan includes:
allowing the suspect activity to continue.

### Claim 16 (depends on 14)

The computer program product of claim 14 wherein executing a remedial action plan includes:
generating a security event report based, at least in part, upon the gathered artifacts; and
providing the security event report to an analyst for further review.

### Claim 17 (depends on 14)

The computer program product of claim 14 wherein executing a remedial action plan includes:
autonomously executing a threat mitigation plan.

### Claim 18 (depends on 10)

The computer program product of claim 10 further comprising:
allowing a third-party to manually search for artifacts.

### Claim 19

A computing system including a processor and memory configured to perform operations comprising:
detecting a security event within a computing platform based upon identified suspect activity;
gathering artifacts concerning the security event; and
assigning a threat level to the security event based, at least in part, upon the gathered artifacts.

### Claim 20 (depends on 19)

The computing system of claim 19 wherein detecting a security event within a computing platform based upon identified suspect activity includes:
monitoring a plurality of sources to identify suspect activity within the computing platform.

### Claim 21 (depends on 19)

The computing system of claim 19 wherein gathering artifacts concerning the security event includes:
gathering artifacts concerning the security event from a plurality of sources associated with the computing platform.

### Claim 22 (depends on 19)

The computing system of claim 19 wherein assigning a threat level to the security event includes:
assigning a threat level using artificial intelligence/machine learning.

### Claim 23 (depends on 19)

The computing system of claim 19 further comprising:
executing a remedial action plan based, at least in part, upon the assigned threat level.

### Claim 24 (depends on 23)

The computing system of claim 23 wherein executing a remedial action plan includes:
allowing the suspect activity to continue.

### Claim 25 (depends on 23)

The computing system of claim 23 wherein executing a remedial action plan includes:
generating a security event report based, at least in part, upon the gathered artifacts; and
providing the security event report to an analyst for further review.

### Claim 26 (depends on 23)

The computing system of claim 23 wherein executing a remedial action plan includes:
autonomously executing a threat mitigation plan.

### Claim 27 (depends on 19)

The computing system of claim 19 further comprising:
allowing a third-party to manually search for artifacts.