Methods and systems for categorizing cyber incident logs featuring dynamic relationships to pre-existing cyber incident reports in real-time
AssigneeCapital One Services, LLC
InventorsVivek Datla, Isha Chaturvedi, Anirban Das
Life of this patent
Estimating the term…
Abstract
Systems and methods for the creation of human-readable cyber incident reports from cyber incident logs, in which the cyber incident reports may link cyber incidents recorded in a cyber incident log to the existing knowledge sources. To do so, the systems and methods overcome the technical problems of conventional systems as well as the technical problems inherent in adapting artificial intelligence solutions to the creation of cyber incident reports.
Claims20
A system for categorizing cyber incident logs featuring dynamic relationships to pre-existing cyber incident reports in real-time, the system comprising:
- one or more processors;
- and
- one or more non-transitory, computer-readable media comprising instructions that, when executed by the one or more processors, cause operations comprising:
- receiving a cyber incident log, wherein the cyber incident log relates to a recorded cyber incident, and wherein the cyber incident log includes a plurality of log sections;
- determining a log section of the plurality of log sections that has a log section characteristic, wherein the log section characteristic is indicative of the log section comprising one or more cyber incident characteristics;
- parsing the log section for a cyber incident characteristic and mapping data, wherein the mapping data describes a relationship of the log section to the plurality of log sections;
- generating a cyber incident log map for the log section based on the mapping data;
- generating, based on the cyber incident log map and the cyber incident characteristic, a cyber incident report type corresponding to the cyber incident log;
- determining, based on the cyber incident report type, a cyber incident report;
- and
- adding the cyber incident report to a plurality of cyber incident reports stored at a data source.
A method for categorizing cyber incident logs featuring dynamic relationships to pre-existing cyber incident reports in real-time, the method comprising:
- receiving a cyber incident log, wherein the cyber incident log includes a plurality of log sections;
- determining a log section of the plurality of log sections that has a log section characteristic, wherein the log section characteristic is indicative of the log section comprising one or more cyber incident characteristics;
- parsing the log section for a cyber incident characteristic and mapping data, wherein the mapping data describes a relationship of the log section to the plurality of log sections;
- generating a cyber incident log map for the log section based on the mapping data;
- generating, based on the cyber incident log map and the cyber incident characteristic;
- a cyber incident report, wherein the cyber incident report corresponds to the cyber incident log.
One or more non-transitory, computer-readable media comprising instructions that, when executed by one or more processors, cause operations comprising:
- receiving a cyber incident log, wherein the cyber incident log includes a plurality of log sections;
- determining a log section of the plurality of log sections that has a log section characteristic, wherein the log section characteristic is indicative of the log section comprising one or more cyber incident characteristics;
- parsing the log section for a cyber incident characteristic and mapping data, wherein the mapping data describes a relationship of the log section to the plurality of log sections;
- generating a cyber incident log map for the log section based on the mapping data;
- and
- generating, based on the cyber incident log map and the cyber incident characteristic, a cyber incident report, wherein the cyber incident report corresponds to the cyber incident log.
Dependencies are inferred from the claim text.