Cybersecurity Platform with Autonomous Artificial Intelligence Agents
AssigneeGoogle Inc.
InventorsScott Eric Coull, Nicholas Todd Smith, David Benjamin Krisiloff, Christopher Schawn Andrews, Ethan McAvoy Rudd
Life of this patent
Estimating the term…
Abstract
A computing system for autonomous cybersecurity operations includes one or more processors; and one or more non-transitory computer-readable media that store one or more sets of computer-executable instructions that, when executed by the one or more processors, cause the computing system to implement a multi-agent cybersecurity operations framework comprising a plurality of cybersecurity agents; wherein the plurality of cybersecurity agents autonomously interoperate to perform investigation and triage of cybersecurity events for one or more computer networks.
Claims21
A computing system for autonomous cybersecurity operations, the computing system comprising:
- one or more processors;
- and
- one or more non-transitory computer-readable media that store one or more sets of computer-executable instructions that, when executed by the one or more processors, cause the computing system to implement a multi-agent cybersecurity operations framework comprising a plurality of cybersecurity agents;
- wherein the plurality of cybersecurity agents autonomously interoperate to perform investigation and triage of cybersecurity events for one or more computer networks;
- wherein each of the plurality of cybersecurity agents comprises a respective structured description of analysis principles and policies for a respective task or workflow performed by the respective cybersecurity agent;
- wherein each of the plurality of cybersecurity agents is configured to implement or make calls to one or more sequence processing models when performing its respective task or workflow;
- and
- wherein, when each cybersecurity agent implements or makes calls to the one or more sequence processing models, the cybersecurity agent is configured to provide at least a portion of the structured description of analysis principles and policies as conditioning data for the one or more sequence processing models.
One or more non-transitory computer-readable media that store:
- an investigative state repository that stores previous analysis traces or outcomes associated with previous cybersecurity events;
- and
- one or more sets of computer-executable instructions that, when executed by a computing system, cause the computing system to implement a multi-agent cybersecurity operations framework comprising a plurality of cybersecurity agents;
- wherein the plurality of cybersecurity agents autonomously interoperate to perform investigation and triage of cybersecurity events for one or more computer networks;
- wherein each of the plurality of cybersecurity agents is configured to implement or make calls to one or more sequence processing models when performing its respective task or workflow;
- and
- wherein, when at least one of the cybersecurity agents implements or makes calls to the one or more sequence processing models, the cybersecurity agent is configured to perform retrieval-augmented-generation with respect to the investigative state repository.
A computer-implemented method, comprising:
- receiving, by a computing system comprising one or more processors, data descriptive of a cybersecurity event;
- instantiating, by the computing system, a multi-agent cybersecurity operations framework comprising a plurality of cybersecurity agents,
- wherein each of the plurality of cybersecurity agents is configured to implement or make calls to one or more sequence processing models when performing its respective task or workflow;
- executing, by the computing system, a multi-stage pipeline that includes interactive communications between the plurality of cybersecurity agents to autonomously generate an output of the agentic framework;
- and
- performing, by the computing system, one or more automated alert or remediation actions based on the output of the agentic framework.
Dependencies are inferred from the claim text.