US 2024/0205250 A1 · SYSTEM AND METHOD FOR IDENTIFYING CYBER-ATTACKS ON A COMPUTING DEVICE OF A PROTECTED NETWORK

Abstract

A method and system for identifying cyber-attacks on a computing device of a protected computer network, by at least one processor may include: monitoring network traffic via a gateway of the protected network; extracting one or more indicators of compromise (IOCs) from the monitored network traffic; classifying the extracted IOCs to produce one or more generalized IOC (GIOC) data elements; chronologically aggregating the one or more GIOC data elements, to produce at least one sequence data structure; and analyzing the at least one sequence data structure, based on a rule-base data structure, to identify an indication of attack (IOA) on a computing device of the protected computer network.

Claims21

Dependent claims

A method of identifying, by at least one processor, cyber-attacks on a computing device of a protected computer network, the method comprising:

monitoring network traffic via a gateway of the protected network;
extracting one or more indicators of compromise (IOCs) from the monitored network traffic;
classifying the extracted IOCs to produce one or more generalized IOC (GIOC) data elements;
chronologically aggregating the one or more GIOC data elements, to produce at least one sequence data structure;
and
analyzing the at least one sequence data structure, based on a rule-base data structure, to identify an indication of attack (IOA) on a computing device of the protected computer network.

3 more elements

A system for identifying cyber-attacks on a computing device of a protected network, the system comprising:

a non-transitory memory device, wherein modules of instruction code are stored, and at least one processor associated with the memory device, and configured to execute the modules of instruction code, whereupon execution of said modules of instruction code, the at least one processor is configured to:
monitor network traffic via a gateway of the protected network;
extract one or more IOCs from the monitored network traffic;
classify the extracted IOCs to produce one or more GIOC data elements;
chronologically aggregate the one or more GIOC data elements, to produce at least one sequence data structure;
and
analyze the at least one sequence data structure, based on a rule-base data structure, to identify an IOA on a computing device of the protected computer network.

4 more elements

Dependencies are inferred from the claim text.

Facts

Application

18/286,125Filed 7 Apr 2022

Priority

8 Apr 2021

Published

20 Jun 2024

Term ends

Not estimatedThe source records don’t support an estimate.

Classification12 codes

H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action
G06F 21/577
Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates…:…

System and method for identifying cyber-attacks on a computing device of a protected network

Life of this patent

System and method for identifying cyber-attacks on a computing device of a protected network

Life of this patent

Abstract

Claims21