Method of threat detection in a computer network security system
AssigneeF-Secure Corporation
InventorMatti Aksela
Life of this patent
Estimating the term…
Abstract
A method comprising: receiving raw data related to one or more network nodes, wherein dissimilar data types are aligned as input events; filtering one or more of the input events by using an adjustable threshold that is based on a filtering score, wherein the filtering score is an estimate of the likelihood that the input event is followed by a security related detection; processing only input events passed through the filtering by an enrichment process; and analysing the data received from the enrichment process for generating a security related decision.
Claims24
A method of threat detection, the method comprising:
- receiving raw data related to one or more network nodes, wherein dissimilar data types are aligned as input events;
- filtering one or more of the input events by using an adjustable threshold that is based on a filtering score, wherein the filtering score is an estimate of the likelihood that the input event is followed by a security related detection;
- processing input events passed through the filtering by an enrichment process;
- and
- analysing the data received from the enrichment process for generating a security related decision.
An apparatus in a computer network system comprising:
- one or more processors configured to:
- receive raw data related to one or more network nodes, wherein dissimilar data types are aligned as input events;
- filter one or more of the input events by using an adjustable threshold that is based on a filtering score, wherein the filtering score is an estimate of the likelihood that the input event is followed by a security related detection;
- process input events passed through the filtering by an enrichment process;
- and
- analyse the data received from the enrichment process for generating a security related decision.
Dependencies are inferred from the claim text.