US 2021/0264033 A1Published application

Dynamic Threat Actionability Determination and Control System

AssigneeBank of America Corporation

InventorsMary Adelina Quigley, Kimberly Jane Nowell-Berry

Life of this patent

Estimating the term…

Loading patent…

Abstract

Arrangements for dynamically determining actionability of incidents of compromise are provided. In some examples, a plurality of threat intelligence data feeds may be received. The feeds may be analyzed to identify one or more incidents of compromise. In some examples, each incident of compromise may be further evaluated to identify an intelligence type associated with the incident of compromise. Based on the intelligence type, system logs may be evaluated to determine whether they include an occurrence of the incident of compromise. If so, the incident of compromise may be identified as actionable. If not, the incident of compromise may be identified as inactionable. In some examples, additional information associated with actionable incidents of compromise may be retrieved and evaluated to prioritize further processing of the actionable incident of compromise. The actionable incident of compromise, as well as other information, may then be further processed to identify and execute mitigating actions, and the like.

Claims21

Dependent claims

A computing platform, comprising:

at least one processor;
a communication interface communicatively coupled to the at least one processor;
and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
receive a plurality of threat intelligence data feeds from a plurality of sources, each threat intelligence data feed of the plurality of threat intelligence data feeds including intelligence data including a plurality of indicators of compromise and each intelligence feed being received from a respective source;
identify, within a first threat intelligence data feed, a first indicator of compromise;
analyze the identified first indicator of compromise to determine an intelligence type associated with the first indicator of compromise;
based on the identified intelligence type associated with the first indicator of compromise, retrieve one or more system logs associated with the identified intelligence type;
compare the first indicator of compromise to the retrieved one or more system logs to determine whether an occurrence of the first indicator of compromise in the one or more system logs exists;
based on the comparing, generate a binary output, generating the binary output including:
responsive to determining that an occurrence of the first indicator of compromise exists in the one or more system logs, generate the binary output as actionable for the first indicator of compromise;
and
responsive to determining that an occurrence of the first indicator of compromise does not exist in the one or more system logs, generate the binary output as inactionable for the first indicator of compromise.

10 more elements

A method, comprising:

by a computing platform comprising at least one processor, memory, and a communication interface:
receiving, by the at least one processor, a plurality of threat intelligence data feeds from a plurality of sources, each threat intelligence data feed of the plurality of threat intelligence data feeds including intelligence data including a plurality of indicators of compromise and each intelligence feed being received from a respective source;
identifying, by the at least one processor and within a first threat intelligence data feed, a first indicator of compromise;
analyzing, by the at least one processor, the identified first indicator of compromise to determine an intelligence type associated with the first indicator of compromise;
based on the identified intelligence type associated with the first indicator of compromise, retrieving, by the at least one processor, one or more system logs associated with the identified intelligence type;
comparing, by the at least one processor, the first indicator of compromise to the retrieved one or more system logs to determine whether an occurrence of the first indicator of compromise in the one or more system logs exists;
based on the comparing, generating, by the at least one processor, a binary output, generating the binary output including:
when it is determined that an occurrence of the first indicator of compromise exists in the one or more system logs, generate the binary output as actionable for the first indicator of compromise;
and
when it is determined that an occurrence of the first indicator of compromise does not exist in the one or more system logs, generate the binary output as inactionable for the first indicator of compromise.

7 more elements

One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, memory, and a communication interface, cause the computing platform to:

receive a plurality of threat intelligence data feeds from a plurality of sources, each threat intelligence data feed of the plurality of threat intelligence data feeds including intelligence data including a plurality of indicators of compromise and each intelligence feed being received from a respective source;
identify, within a first threat intelligence data feed, a first indicator of compromise;
analyze the identified first indicator of compromise to determine an intelligence type associated with the first indicator of compromise;
based on the identified intelligence type associated with the first indicator of compromise, retrieve one or more system logs associated with the identified intelligence type;
compare the first indicator of compromise to the retrieved one or more system logs to determine whether an occurrence of the first indicator of compromise in the one or more system logs exists;
based on the comparing, generate a binary output, generating the binary output including:
responsive to determining that an occurrence of the first indicator of compromise exists in the one or more system logs, generate the binary output as actionable for the first indicator of compromise;
and
responsive to determining that an occurrence of the first indicator of compromise does not exist in the one or more system logs, generate the binary output as inactionable for the first indicator of compromise.

6 more elements

Dependencies are inferred from the claim text.