US 2024/0193267 A1Published application

Methods and systems for cyber threat analysis

OwnerRenze JONGMANinventor

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods and systems for cyber threat analysis are disclosed. The method includes aggregating threat feeds corresponding to threat-related event(s) from cyber threat-related sources. The method includes accessing threat entities from a threat library. The method also includes identifying threat element(s) corresponding to at least one threat entity of the threat entities, in at least one threat feed. The method includes the at least one threat feed with the at least one threat entity, based at least on the identification of the threat element(s). The method includes generating threat-related insights on the threat-related events, based at least on the linking. The method also includes assigning a predefined rating to the at least one threat feed that is linked with the at least one threat entity, based at least on the threat-related insights and the threat severity rating associated with each of the threat entities.

Claims20

Dependent claims

A computer-implemented method, comprising:

aggregating, by a server system, a plurality of threat feeds corresponding to one or more threat-related events, from a plurality of cyber threat-related sources;
accessing, by the server system, a plurality of threat entities from a threat library, the threat library comprising a threat severity rating for each of the plurality of threat entities;
identifying, by the server system, one or more threat elements corresponding to at least one threat entity of the plurality of threat entities, in at least one threat feed of the plurality of threat feeds;
linking, by the server system, the at least one threat feed with the at least one threat entity, based at least on the identification of the one or more threat elements in the at least one threat feed, for categorizing the one or more threat-related events under a predefined threat category;
generating, by the server system, one or more threat-related insights on the one or more threat-related events, based at least on the linking;
and
assigning, by the server system, a predefined rating to the at least one threat feed that is linked with the at least one threat entity, based at least on the one or more threat-related insights and the threat severity rating associated with each of the plurality of threat entities in the threat library.

4 more elements

A server system, comprising:

a memory configured to store instructions;
a communication interface;
and
a processor in communication with the memory and the communication interface, the processor configured to execute the instructions stored in the memory and thereby cause the server system to perform, at least in part, to:
aggregate a plurality of threat feeds corresponding to one or more threat-related events, from a plurality of cyber threat-related sources;
access a plurality of threat entities from a threat library, the threat library comprising a threat severity rating for each of the plurality of threat entities;
identify one or more threat elements corresponding to at least one threat entity of the plurality of threat entities, in at least one threat feed of the plurality of threat feeds;
link the at least one threat feed with the at least one threat entity, based at least on the identification of the one or more threat elements in the at least one threat feed, for categorizing the one or more threat-related events under a predefined threat category;
generate one or more threat-related insights on the one or more threat-related events, based at least on the linking;
and
assign a predefined rating to the at least one threat feed that is linked with the at least one threat entity, based at least on the one or more threat-related insights and the threat severity rating associated with each of the plurality of threat entities in the threat library.

8 more elements

Dependencies are inferred from the claim text.