US 2024/0403427 A1 · METHODS AND APPARATUS TO IMPLEMENT A DETERMINISTIC INDICATOR AND CONFIDENCE SCORING MODEL

Abstract

Methods, apparatus, systems, and articles of manufacture are disclosed. In one example, an apparatus includes at least one memory, instructions, and processor circuitry. The processor circuitry at least executes or instantiates the instructions to receive a group of indicators from a campaign attack, then query an indicator database with an indicator from the group of indicators, and then predict an identification of the campaign attack in response to the indicator having a current deterministic indicator and confidence scoring (DISC) score in the indicator database, wherein the DISC score represents at least one of a lethality component, a determinism component, or a confidence component of the indicator.

Claims20

Dependent claims

An apparatus, comprising:

at least one memory;
machine-readable instructions;
and
at least one processor circuit to be programmed by the machine-readable instructions to:
obtain a first indicator;
determine whether the first indicator has a deterministic indicator and confidence model (DISC) score assigned to the first indicator in an indicator database;
in response to a determination that the first indicator does not have the DISC score, compute a first DISC score for the first indicator, wherein to compute the first DISC score the at least one processor circuit is to:
compare the first indicator to a second indicator in the indicator database to determine a similarity between the first indicator and the second indicator;
and
determine the first indicator based on the similarity between the first indicator and the second indicator.

7 more elements

At least one non-transitory machine-readable medium comprising machine-readable instructions to cause at least one processor circuit to at least:

obtain a first indicator;
determine whether the first indicator has a deterministic indicator and confidence model (DISC) score assigned to the first indicator in an indicator database;
in response to a determination that the first indicator does not have the DISC score, compute a first DISC score for the first indicator, wherein to compute the first DISC score the at least one processor circuit is to:
compare the first indicator to a second indicator in the indicator database to determine a similarity between the first indicator and the second indicator;
and
determine the first indicator based on the similarity between the first indicator and the second indicator.

3 more elements

A method comprising:

obtaining a first indicator;
determining, by at least one processor circuit programmed by at least one instruction, whether the first indicator has a deterministic indicator and confidence model (DISC) score assigned to the first indicator in an indicator database;
and
in response to a determination that the first indicator does not have the DISC score, computing, by one or more of the at least one processor circuit, a first DISC score for the first indicator by:
comparing the first indicator to a second indicator in the indicator database to determine a similarity between the first indicator and the second indicator;
and
determining the first indicator based on the similarity between the first indicator and the second indicator.

4 more elements

Dependencies are inferred from the claim text.

Facts

Application

18/799,680Filed 9 Aug 2024

Priority

31 Dec 2021

Published

5 Dec 2024

Term ends

Not estimatedThe source records don’t support an estimate.

Classification9 codes

G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06F 21/56
Detecting local intrusion or implementing counter-measures: computer malware detection or handling, e.g. anti-virus arrangements
G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action
G06N 7/01
Computing arrangements based on specific mathematical models: probabilistic graphical models, e.g. probabilistic networks

Methods and apparatus to implement a deterministic indicator and confidence scoring model

Life of this patent

Methods and apparatus to implement a deterministic indicator and confidence scoring model

Life of this patent

Abstract

Claims20