Granted Patent B1

US 9,998,480 · App. 15/055,653 · Granted Jun 12, 2018

Abstract

Claims (64)

1. A computer-implemented method for predicting security threats, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

predicting that a candidate security target is an actual target of a specific security attack according to a non-collaborative-filtering calculation;

predicting that the candidate security target is an actual target of a set of multiple specific security attacks, including the specific security attack, according to a collaborative filtering calculation that makes predictions that are more customized to the candidate security target than predictions that the non-collaborative-filtering calculation makes;

filtering, based on the specific security attack also being predicted by the non-collaborative-filtering calculation, the specific security attack from the set of multiple specific security attacks predicted by the collaborative filtering calculation at least in part by:

identifying overlapping specific security attacks that overlap between both a set of specific security attacks predicted according to the non-collaborative-filtering calculation and the set of multiple specific security attacks predicted according to the collaborative filtering calculation; and

filtering each of the overlapping specific security attacks from the set of multiple specific security attacks predicted by the collaborative filtering calculation; and

notifying, by transmitting a notification, the candidate security target to perform a security action to protect itself from another specific security attack remaining in the filtered set of multiple specific security attacks based on an analysis of the filtered set of multiple specific security attacks.

2. The method of claim 1 , wherein predicting that the candidate security target is the actual target of the specific security attack according to the non-collaborative-filtering calculation is based on both:

a count for the candidate security target, among candidate security targets under analysis, in terms of previous attacks on the candidate security target; and

a count for the specific security attack, among security attacks under analysis, in terms of previous instances of the specific security attack.

3. The method of claim 2 , wherein predicting that the candidate security target is the actual target of the specific security attack according to the non-collaborative-filtering calculation comprises calculating a product of the count for the candidate security target and the count for the specific security attack.

4. The method of claim 1 , wherein the analysis of the filtered set of multiple specific security attacks comprises:

identifying attributes of the candidate security target; and

calculating, according to a machine learning algorithm, a level of predictive power for each of the attributes in predicting specific security attacks remaining in the filtered set of multiple specific security attacks.

5. The method of claim 4 , wherein the attributes comprise at least one of:

an identifier of a customer sector; and

an identifier of software installed by a customer.

6. The method of claim 4 , wherein the machine learning algorithm comprises a naive Bayes algorithm.

7. The method of claim 1 , wherein the analysis of the filtered set of multiple specific security attacks comprises categorizing specific security attacks in the set of multiple specific security attacks into categories that each indicates a type of security attack.

8. The method of claim 1 , wherein the analysis of the filtered set of multiple specific security attacks comprises:

identifying attributes of at least one of the multiple specific security attacks; and

calculating, according to a machine learning algorithm, a level of predictive power for each of the attributes in predicting specific security attacks remaining in the filtered set of multiple specific security attacks.

9. The method of claim 1 , wherein at least one of the non-collaborative-filtering calculation and the collaborative filtering calculation comprises constructing a matrix that specifies:

candidate security targets along one of rows and columns of the matrix; and

specific security attacks along the other of the rows and the columns of the matrix.

10. A system for predicting security threats, the system comprising:

a prediction module, stored in memory, that:

predicts that a candidate security target is an actual target of a specific security attack according to a non-collaborative-filtering calculation;

predicts that the candidate security target is an actual target of a set of multiple specific security attacks, including the specific security attack, according to a collaborative filtering calculation that makes predictions that are more customized to the candidate security target than predictions that the non-collaborative-filtering calculation makes;

a filtering module, stored in memory, that filters, based on the specific security attack also being predicted by the non-collaborative-filtering calculation, the specific security attack from the set of multiple specific security attacks predicted by the collaborative filtering calculation at least in part by:

identifying overlapping specific security attacks that overlap between both a set of specific security attacks predicted according to the non-collaborative-filtering calculation and the set of multiple specific security attacks predicted according to the collaborative filtering calculation; and

filtering each of the overlapping specific security attacks from the set of multiple specific security attacks predicted by the collaborative filtering calculation;

a notification module, stored in memory, that notifies, by transmitting a notification, the candidate security target to perform a security action to protect itself from another specific security attack remaining in the filtered set of multiple specific security attacks based on an analysis of the filtered set of multiple specific security attacks; and

at least one physical processor configured to execute the prediction module, the filtering module, and the notification module.

11. The system of claim 10 , wherein the non-collaborative-filtering calculation is based on both:

a count for the candidate security target, among candidate security targets under analysis, in terms of previous attacks on the candidate security target; and

a count for the specific security attack, among security attacks under analysis, in terms of previous instances of the specific security attack.

12. The system of claim 11 , wherein the prediction module predicts that the candidate security target is the actual target of the specific security attack according to the non-collaborative-filtering calculation by calculating a product of the count for the candidate security target and the count for the specific security attack.

13. The system of claim 10 , wherein the notification module is programmed to perform the analysis of the filtered set of multiple specific security attacks by:

identifying attributes of the candidate security target; and

calculating, according to a machine learning algorithm, a level of predictive power for each of the attributes in predicting specific security attacks remaining in the filtered set of multiple specific security attacks.

14. The system of claim 13 , wherein the attributes comprise at least one of:

an identifier of a customer sector; and

an identifier of software installed by a customer.

15. The system of claim 13 , wherein the machine learning algorithm comprises a naive Bayes algorithm.

16. The system of claim 10 , wherein the notification module is programmed to perform the analysis of the filtered set of multiple specific security attacks by categorizing specific security attacks in the set of multiple specific security attacks into categories that each indicates a type of security attack.

17. The system of claim 10 , wherein the notification module is programmed to perform the analysis of the filtered set of multiple specific security attacks by:

identifying attributes of at least one of the multiple specific security attacks; and

calculating, according to a machine learning algorithm, a level of predictive power for each of the attributes in predicting specific security attacks remaining in the filtered set of multiple specific security attacks.

18. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

predict that a candidate security target is an actual target of a specific security attack according to a non-collaborative-filtering calculation;

predict that the candidate security target is an actual target of a set of multiple specific security attacks, including the specific security attack, according to a collaborative filtering calculation that makes predictions that are more customized to the candidate security target than predictions that the non-collaborative-filtering calculation makes;

filter, based on the specific security attack also being predicted by the non-collaborative-filtering calculation, the specific security attack from the set of multiple specific security attacks predicted by the collaborative filtering calculation at least in part by:

identifying overlapping specific security attacks that overlap between both a set of specific security attacks predicted according to the non-collaborative-filtering calculation and the set of multiple specific security attacks predicted according to the collaborative filtering calculation; and

filtering each of the overlapping specific security attacks from the set of multiple specific security attacks predicted by the collaborative filtering calculation; and

notify, by transmitting a notification, the candidate security target to perform a security action to protect itself from another specific security attack remaining in the filtered set of multiple specific security attacks based on an analysis of the filtered set of multiple specific security attacks.

19. The method of claim 1 , further comprising performing, by the candidate security target, the security action in response to the candidate security target receiving the notification.

20. The method of claim 19 , wherein the security action comprises at least one of:

updating a malware signature database;

updating a published application to a more recent or secure version;

executing a malware inoculation program;

increasing a sandbox, quarantine, or firewall barrier;

disconnecting, isolating, or powering down a computing resource; and

heightening a security system setting.

Assignments (6)