System and Method for Assigning Threat Valuations to Network Events and Security Events
AssigneeFluency Corp.
InventorsChristopher Jordan, Kun Luo
Life of this patent
Estimating the term…
Abstract
An embodiment is a method including receiving a plurality of event records in a first timeframe, each event record comprising a plurality of attribute-value pairs, grouping the event records by a destination address and a source address to form grouped event records, establishing a plurality of threat vectors for each of the grouped event records based on the attribute-value pairs, merging the plurality of threat vectors with the corresponding grouped event records to form a plurality of risk events, and storing the plurality of risk events in a computer-readable data store.
Claims20
A method, comprising:
- receiving a plurality of event records in a first timeframe, each event record comprising a plurality of attribute-value pairs;
- grouping the event records by a destination address and a source address to form grouped event records;
- establishing a plurality of threat vectors for each of the grouped event records based on the attribute-value pairs;
- merging the plurality of threat vectors with the corresponding grouped event records to form a plurality of risk events;
- and
- storing the plurality of risk events in a computer-readable data store.
A system, comprising:
- one or more processors;
- a storage device storing a program to be executed by the one or more processors, the program including instructions for:
- receiving a plurality of events in a sliding window from a plurality of network security systems;
- deriving a primary and secondary keys for each event of the plurality of events;
- merging each event sharing a primary and secondary keys into a record to form a plurality of records;
- merging a plurality of threat factors to each record of the plurality of records;
- grouping each record of the plurality of records sharing a secondary keys into a plurality of subsets;
- merging a risk score to each subset of the plurality of subsets based on the threat factors present in the respective subset of the plurality of subsets to form a plurality of security events;
- grouping each subset of the plurality of subsets sharing a primary keys into a plurality of sets, wherein a risk factor is assigned to each set of the plurality of sets;
- and
- storing the plurality of sets in a computer-readable data store.
A method, comprising:
- receiving a plurality of events in a first timeframe, each event comprising a plurality of attribute-value pairs;
- deriving a first derived key for each event based on a source IP address, a destination IP address, or a protocol;
- superimposing each event having a same derived key into a record to form a plurality of records;
- superimposing a plurality of threat vectors to each record, wherein the plurality of threat vectors includes statistics evaluations, flow anomalies, reputation information, and alerts based on other network security systems;
- calculating a threat valuation for each record based on the plurality of threat vectors superimposed to the respective record using a machine learning algorithm;
- generating a risk event for each record if the threat valuation is above a predetermined threshold value;
- and
- storing the risk events in a computer-readable data store.
Dependencies are inferred from the claim text.