# US 2019/0379680 A1 · Threat mitigation system and method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0379680 A1
- Document ID: US20190379680A1
- Status: Published application
- Kind: A1
- Application number: 16/432,762
- Filed: 2019-06-05
- Published: 2019-12-12
- Earliest claimed: 2018-06-06
- Assignees: Reliaquest Holdings, LLC
- Applicants: ReliaQuest Holdings, LLC
- Inventors: Brian P. Murphy; Joe Partlow; Colin O'Connor; Jason Pfeiffer
- Web page: https://patentgrep.com/patent/US20190379680A1

## CPC

- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 8/65: Updates (security arrangements therefor G06F21/57)
- G06F 18/20: Analysing
- G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 21/554: {involving event detection and direct action}
- G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements
- G06F 21/561: {Virus type analysis}
- G06F 21/562: {Static detection}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/568: {eliminating virus, restoring damaged files}
- G06F 30/20: Design optimisation, verification or simulation (optimisation, verification or simulation of circuit designs G06F30/30)
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- G06N 20/00: Machine learning
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/0263: {Rule management}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L 63/164: {at the network layer}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 2221/034: Test or assess a computer or a system
- G06F 2221/2115: Third party
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computer-implemented method, computer program product and computing system for: establishing connectivity with a plurality of security-relevant subsystems within a computing platform; obtaining at least one security-relevant information set from each of the plurality of security-relevant subsystems, thus defining a plurality of security-relevant information sets; and processing the plurality of security-relevant information sets using artificial learning/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets.

## Claims

### Claim 1

A computer-implemented method, executed on a computing device, comprising:
establishing connectivity with a plurality of security-relevant subsystems within a computing platform;
obtaining at least one security-relevant information set from each of the plurality of security-relevant subsystems, thus defining a plurality of security-relevant information sets; and
processing the plurality of security-relevant information sets using artificial learning/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1 further comprising:
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform based, at least in part, upon the one or more commonalities identified.

### Claim 3 (depends on 2)

The computer-implemented method of claim 2 wherein combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform based, at least in part, upon the one or more commonalities identified includes:
homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1 wherein establishing connectivity with a plurality of security-relevant subsystems includes:
utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1 wherein processing the plurality of security-relevant information sets using artificial learning/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets includes:
utilizing a decision tree based, at least in part, upon one or more previously-acquired security-relevant information sets.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1 further comprising:
enabling third-party access to the aggregated security-relevant information set.

### Claim 7 (depends on 1)

The computer-implemented method of claim 1 further comprising:
enabling third-party searching of the aggregated security-relevant information set.

### Claim 8 (depends on 1)

The computer-implemented method of claim 1 wherein the plurality of security-relevant information sets utilize a plurality of different formats.

### Claim 9 (depends on 1)

The computer-implemented method of claim 1 wherein the plurality of security-relevant information sets utilize a plurality of different nomenclatures.

### Claim 10 (depends on 1)

The computer-implemented method of claim 1 wherein the plurality of security-relevant subsystems includes one or more of:
a data lake;
a data log;
a security-relevant software application;
a security-relevant hardware system; and
a resource external to the computing platform.

### Claim 11

A computer program product residing on a computer readable medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
establishing connectivity with a plurality of security-relevant subsystems within a computing platform;
obtaining at least one security-relevant information set from each of the plurality of security-relevant subsystems, thus defining a plurality of security-relevant information sets; and
processing the plurality of security-relevant information sets using artificial learning/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets.

### Claim 12 (depends on 11)

The computer program product of claim 11 further comprising:
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform based, at least in part, upon the one or more commonalities identified.

### Claim 13 (depends on 12)

The computer program product of claim 12 wherein combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform based, at least in part, upon the one or more commonalities identified includes:
homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.

### Claim 14 (depends on 11)

The computer program product of claim 11 wherein establishing connectivity with a plurality of security-relevant subsystems includes:
utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.

### Claim 15 (depends on 11)

The computer program product of claim 11 wherein processing the plurality of security-relevant information sets using artificial learning/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets includes:
utilizing a decision tree based, at least in part, upon one or more previously-acquired security-relevant information sets.

### Claim 16 (depends on 11)

The computer program product of claim 11 further comprising:
enabling third-party access to the aggregated security-relevant information set.

### Claim 17 (depends on 11)

The computer program product of claim 11 further comprising:
enabling third-party searching of the aggregated security-relevant information set.

### Claim 18 (depends on 11)

The computer program product of claim 11 wherein the plurality of security-relevant information sets utilize a plurality of different formats.

### Claim 19 (depends on 11)

The computer program product of claim 11 wherein the plurality of security-relevant information sets utilize a plurality of different nomenclatures.

### Claim 20 (depends on 11)

The computer program product of claim 11 wherein the plurality of security-relevant subsystems includes one or more of:
a data lake;
a data log;
a security-relevant software application;
a security-relevant hardware system; and
a resource external to the computing platform.

### Claim 21

A computing system including a processor and memory configured to perform operations comprising:
establishing connectivity with a plurality of security-relevant subsystems within a computing platform;
obtaining at least one security-relevant information set from each of the plurality of security-relevant subsystems, thus defining a plurality of security-relevant information sets; and
processing the plurality of security-relevant information sets using artificial learning/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets.

### Claim 22 (depends on 21)

The computing system of claim 21 further comprising:
combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform based, at least in part, upon the one or more commonalities identified.

### Claim 23 (depends on 22)

The computing system of claim 22 wherein combining the plurality of security-relevant information sets to form an aggregated security-relevant information set for the computing platform based, at least in part, upon the one or more commonalities identified includes:
homogenizing the plurality of security-relevant information sets to form the aggregated security-relevant information set.

### Claim 24 (depends on 21)

The computing system of claim 21 wherein establishing connectivity with a plurality of security-relevant subsystems includes:
utilizing at least one application program interface to access at least one of the plurality of security-relevant subsystems.

### Claim 25 (depends on 21)

The computing system of claim 21 wherein processing the plurality of security-relevant information sets using artificial learning/machine learning to identify one or more commonalities amongst the plurality of security-relevant information sets includes:
utilizing a decision tree based, at least in part, upon one or more previously-acquired security-relevant information sets.

### Claim 26 (depends on 21)

The computing system of claim 21 further comprising:
enabling third-party access to the aggregated security-relevant information set.

### Claim 27 (depends on 21)

The computing system of claim 21 further comprising:
enabling third-party searching of the aggregated security-relevant information set.

### Claim 28 (depends on 21)

The computing system of claim 21 wherein the plurality of security-relevant information sets utilize a plurality of different formats.

### Claim 29 (depends on 21)

The computing system of claim 21 wherein the plurality of security-relevant information sets utilize a plurality of different nomenclatures.

### Claim 30 (depends on 21)

The computing system of claim 21 wherein the plurality of security-relevant subsystems includes one or more of:
a data lake;
a data log;
a security-relevant software application;
a security-relevant hardware system; and
a resource external to the computing platform.