US 2026/0030130 A1 · IDENTIFICATION OF SIMILAR INCIDENTS BASED ON SIMILARITY SCORES

Abstract

According to examples, an apparatus may include a processor and a memory on which are stored machine-readable instructions that, when executed by the processor, may cause the processor to receive event data for a subject incident. The processor may filter a set of candidate incidents to identify a first predefined number of candidate incidents. The first predefined number of candidate incidents may be filtered based on a respective first similarity score assigned to each of the candidate incidents. The processor may assign a respective second similarity score to each of the identified first predefined number of candidate incidents. The second similarity score may be based on common property values between the subject incident and respective candidate incidents. The processor may identify and output a second predefined number of candidate incidents among the first predefined number of candidate incidents based on the assigned second similarity score.

Claims20

Dependent claims

An apparatus comprising:

a processor;
and
a memory storing machine-readable instructions that, when executed by the processor, cause the processor to:
receive event data for a subject incident;
access a set of candidate incidents, a candidate incident of the set of candidate incidents being associated with one or more types of properties and corresponding property values;
for a plurality of predefined types of properties:
calculate a respective first similarity score for a respective candidate incident in the set of candidate incidents, the first similarity score being based on a probability value of a type of property that is common to the subject incident and the respective candidate incident;
and
select a predefined number of candidate incidents from the set of candidate incidents having first similarity scores indicating a similarity between the subject incident and the candidate incidents for a given type of property;
form a candidate incidents pool comprising the selected candidate incidents for the plurality of predefined types of properties;
and
identify one or more security incidents that share property values with the subject incident using the candidate incidents pool.

9 more elements

A non-transitory computer-readable medium on which is stored computer-readable instructions that, when executed by a processor, cause the processor to:

receive event data for a subject incident;
access a set of candidate incidents, wherein a candidate incident is associated with a plurality of property types and corresponding property values;
for a plurality of the property types:
compute a similarity score for a given candidate incident based on one or more property values that are common to the subject incident and the given candidate incident;
and
select one or more candidate incidents for the respective property type based on the similarity scores;
generate a candidate incident pool comprising the selected candidate incidents across the property types;
determine, for at least a portion of the candidate incidents in the candidate incident pool, a respective temporal proximity based on timestamps associated with generation of the subject incident and the candidate incident;
adjust a ranking of the selected candidate incidents based on the similarity scores and the respective temporal proximities;
and
identify one or more security incidents that are potentially correlated with the subject incident based on the ranking of the candidate incidents in the candidate incident pool.

8 more elements

Dependencies are inferred from the claim text.

Identification of similar incidents based on similarity scores

Life of this patent

Identification of similar incidents based on similarity scores

Life of this patent

Abstract

Claims20