US 2019/0379696 A1 · Cognitive Malicious Activity Identification and Handling

Abstract

Mechanisms are provided to implement a malicious activity response system (MARS) that automatically identifies and handles malicious activities within the data processing system. The MARS identifies threat intelligence associated with characteristics of malicious activity. The MARS forms a hypothesis for the malicious attack to identify a malicious attack that is occurring. The MARS identifies a trap for use in isolating the malicious activity; deploys the trap and automatically reconfiguring a network associated with the data processing system such that the malicious activity is routed to the trap thereby isolating the malicious activity, observes a behavior of the malicious activity within the trap; and extracts features associated with the malicious activity in the trap. The MARS then utilizes the extracted features to improve an operation of the malicious activity response system in handling future malicious activity.

Claims20

Dependent claims

A method, in a data processing system comprising a processor and a memory, the memory comprising instructions that are executed by the processor to cause the processor to be configured to implement a malicious activity response system that automatically identifies and handles malicious activities within the data processing system, the method comprising:

identifying threat intelligence associated with characteristics of the malicious activity;
forming a hypothesis for the malicious attack to identify a malicious attack that is occurring;
identifying a trap for use in isolating the malicious activity;
deploying the trap and automatically reconfiguring a network associated with the data processing system such that the malicious activity is routed to the trap thereby isolating the malicious activity;
observing a behavior of the malicious activity within the trap;
extracting features associated with the malicious activity in the trap;
and
utilizing the extracted features to improve an operation of the malicious activity response system in handling future malicious activity.

5 more elements

A computer program product comprising a computer readable storage medium having a computer readable program stored therein, wherein the computer readable program, when executed on a data processing system, causes the data processing system to implement a malicious activity response system that automatically identifies and handles malicious activities within the data processing system, and further causes the data processing system to:

identify threat intelligence associated with characteristics of the malicious activity;
form a hypothesis for the malicious attack to identify a malicious attack that is occurring;
identify a trap for use in isolating the malicious activity;
deploy the trap and automatically reconfiguring a network associated with the data processing system such that the malicious activity is routed to the trap thereby isolating the malicious activity;
observe a behavior of the malicious activity within the trap;
extract features associated with the malicious activity in the trap;
and
utilize the extracted features to improve an operation of the malicious activity response system in handling future malicious activity.

5 more elements

An apparatus comprising:

a processor;
and
a memory coupled to the processor, wherein the memory comprises instructions which, when executed by the processor, cause the processor to implement a malicious activity response system that automatically identifies and handles malicious activities within the data processing system, and further causes the processor to:
identify threat intelligence associated with characteristics of the malicious activity;
form a hypothesis for the malicious attack to identify a malicious attack that is occurring;
identify a trap for use in isolating the malicious activity;
deploy the trap and automatically reconfiguring a network associated with the data processing system such that the malicious activity is routed to the trap thereby isolating the malicious activity;
observe a behavior of the malicious activity within the trap;
extract features associated with the malicious activity in the trap;
and
utilize the extracted features to improve an operation of the malicious activity response system in handling future malicious activity.

8 more elements

Dependencies are inferred from the claim text.

Cognitive Malicious Activity Identification and Handling

Life of this patent

Cognitive Malicious Activity Identification and Handling

Life of this patent

Abstract

Claims20