US 2026/0300475 A1Published application

Threat Intel Optimization and Operation

AssigneeITO DB Corporation

InventorNate GUAGENTI

Life of this patent

Estimating the term…

Loading patent…

Abstract

Aspects of the present disclosure relate to standardizing and operationalizing threat intelligence data for cybersecurity applications. A threat intelligence optimization system can generate a portable, high-performance threat intelligence database by initially acquiring data, including digital identifiers and associated threat attributes, from multiple disparate data sources. The system can transform this data, packing numerous attributes into a single, structured data field. This consolidated data can be serialized into a file comprising a binary search tree for rapid lookups and a data section for storing the packed attributes. In some implementations, the file can be structured for compatibility with an existing database format, such as the MaxMind Database (MMDB) format. The system can enable existing security systems, such as firewalls and SIEMs, to natively consume and act upon this custom, enriched intelligence in real-time or near real-time, eliminating integration complexity and performance bottlenecks.

Claims20

Dependent claims

A method for standardizing and operationalizing threat intelligence data for cybersecurity applications, the method comprising:

obtaining, from one or more data sources, multiple sets of threat intelligence data corresponding to detected cybersecurity threats,
wherein each set of threat intelligence data includes a digital identifier and multiple attributes associated with the digital identifier;
for each set of the multiple sets of threat intelligence data:
transforming the obtained set of threat intelligence data into a unified data model, including packing the multiple attributes into a single packed data field;
and
serializing the unified data model into a database file, the database file including a binary search tree and a data section,
wherein the binary search tree is populated with multiple nodes, the nodes representing portions of digital identifiers, including portions of the digital identifier of the obtained set of threat intelligence data, and including pointers, and
wherein the data section stores multiple packed data fields, including the single packed data field corresponding to the obtained set of threat intelligence data, at locations corresponding to the pointers;
and
transmitting the database file to a security asset,
wherein the security asset:
obtains an existing digital identifier;
locates an existing pointer by traversing the binary search tree of the database file using the existing digital identifier;
and
retrieves, using the existing pointer, an existing packed data field from the data section of the database file.

12 more elements

A computer-readable storage medium storing instructions, for standardizing and operationalizing contextual data for real-time lookups, the instructions, when executed by a computing system, cause the computing system to:

obtain, from one or more data sources, multiple data sets, wherein each data set includes a digital identifier and multiple attributes associated with the digital identifier;
for one or more sets of the multiple data sets:
transforming the obtained data set into a unified data model, including packing the multiple attributes into a single packed data field;
and
serializing the unified data model into a database file, the database file including a binary search tree and a data section,
wherein the binary search tree is populated with multiple nodes, the nodes representing portions of digital identifiers, including A) portions of the digital identifier of the obtained data set and B) pointers,
wherein the data section stores multiple packed data fields, including the single packed data field corresponding to the obtained data set, at locations corresponding to the pointers;
and
transmitting the database file to a consuming computing system,
wherein the consuming computing system:
obtains an existing digital identifier;
locates an existing pointer by traversing the binary search tree of the database file using the existing digital identifier;
and
retrieves, using the existing pointer, an existing packed data field from the data section of the database file.

11 more elements

Dependencies are inferred from the claim text.